My blog was getting bogus referral traffic due to the Malware injected into my WordPress theme. Several times my blog getting problems and incapable to discover the malware in blog even the Google webmaster tools did not identify it.
I used Wordfence plugin for locating Malware, but this couldn’t Serve at all and believe it’s not a worth to rely on plugins as these plugin people always want to generate income from upgrades.
In the shared hosting environment, it is tough to find what is being conducted and the server guys also won’t be able to help us.
I was getting all the referral traffic and decreased in SERP for so many search phrases, later the host has suspended for using more CPU.
I don’t have a choice to see what was happening within the blog, but in the end switched to another host to see where the issue is arriving. At this time hosted onlyw one domain so it helped me to find malware that was injected into the theme and the scammer is playing remotely with his scripts. Once switched to default theme all referral traffic gone away.
If I see presently referral traffic in Analytics, then they were genuine not bots. Make sure always use few plugins so that the blog loads fast on VPS too.