I recently discovered that one of the users of my self-built analytics tool has added a site with a '.go.id' domain, which is an official Indonesian government site, directly embedding my tracking snippet. We're seeing over 10,000 genuine pageviews in just a couple of days. The user registered with a generic Gmail account without any organizational or government affiliation, which raises some concerns for me. Here are my main questions:
- Is the user a legitimate developer or contractor for the government site?
- Could this be a case of unauthorized code addition or misconfiguration?
- As the platform owner, should I leave it as is, disable tracking, or attempt to get in touch with the site operator?
I'd appreciate any insights or advice on how to navigate this situation. Also, for context, I'm currently based in Germany.
2 Answers
I wouldn’t jump to any conclusions just yet. Why do you think it’s suspicious? The Indonesian government might indeed have a real need for analytics like anyone else. Just because your service is new doesn’t mean it’s not being used legitimately.
If it's related to a regional government, honestly, it's not that surprising. Some local governments have a surprisingly low level of security. I'd recommend reaching out to the user first to understand their use case before taking any drastic measures. Disabling tracking without some conversation could end up damaging your reputation.
Well, my service is still fairly new, so it's not what you'd expect a government to find easily. Plus, they signed up with a Gmail address, which raises some flags. I'd expect a government employee to use an official email. It could be a contractor, but it also might be someone exploiting access to track data for personal reasons. It just feels a bit odd.