Online dating referrers
Spam bots can use various methods to disguise themselves, so that they can’t be easily detected by any security measure.
They can pretend to be a web browser (like chrome, internet explorer etc).
They spam under the belief that if a server log is publicly accessible (i.e.
it can be crawled and indexed by Google) then Google treat the referrer value in the server log as a backlink thus positively influencing the search engine ranking of the website being promoted.
Even using the premium version of Google Analytics does not protect from you being hacked/spammed.
Affiliates are most likely to benefit from sending fake traffic as they get commission.
They can pretend to be traffic coming from a legitimate website.
Not all spam bots are developed to send fake traffic to Google Analytics.
The fake referrer header contains the website URL which spammer wants to promote and/or build back links.
Bots are generally used for web indexing (indexing the contents of websites).