at least 18% of what gets labeled as “direct traffic” is not actually direct traffic. That’s just the bucket analytics providers throw stuff into when they can’t classify it any other way. How do they know this? By looking closer at some of this so-called “direct traffic.” A lot of the pages had URLs three levels deep. Did someone really type that URL in by hand? They most likely were sent from somewhere. Either: From a secure site From inside an app From incognito or private browsing From somewhere with a new referrer string that isn’t recognized yet He offered some simple heuristics to discover your dark traffic. First, finding direct visits that were actually sent from social networks. Aggregate everything classified as direct traffic Remove your homepage and major section fronts that might be bookmarked from the data set What you have left is probably dark social Filter for just new users Verify links against social campaigns What you have left is probably dark search