Update time: June 17, 2024
If you’ve been looking at your GA4 Pages and screens report recently and noticed something weird — traffic coming from a domain called gtm-msr.appspot.com that you’ve never heard of — you’re not alone.
Don’t panic. Your GTM container isn’t compromised, and your data isn’t being hacked. But it is being polluted by automated traffic that you need to block.
If my guess was correct, you have come to the right place. In this article, I’ll explain what this traffic is, how it gets into your GA4 property, and — most importantly — how to stop it in under a minute.
What is this strange traffic?
A few months ago, I was digging through the Pages and screens report in GA4 and noticed something that didn’t belong. Alongside my actual pages, there was a row showing a domain I’d never seen before:gtm-msr.appspot.com
At first glance, the data looked like normal pageviews — event count, users, the usual metrics. But the page title and page location clearly didn’t come from my website.
So I did some digging.
Turns out, gtm-msr.appspot.com is a Google-hosted service that can load and render GTM containers remotely. Here’s how it works:
Someone takes a URL like https://gtm-msr.appspot.com/render2?id=GTM-XXXXXXX
This is not a domain owned or controlled by me.
They open it — in a browser, a script, or an automated tool
That page loads your GTM container，your GA4 page_view tag fires automatically，GA4 records a pageview where the page location is gtm-msr.appspot.com, not your actual website
The result: your GA4 data gets polluted with fake pageviews from a domain you don’t control.
Why does this happen?
The mechanism is surprisingly simple. Your GTM container is publicly accessible — that’s by design, since Google needs to serve it to your website visitors. But anyone can request that container from any domain, including gtm-msr.appspot.com.
When they do, and if your GA4 tag fires on all pages without any domain restriction, it happily records the pageview. The event is real — the pageview happened — it just happened on someone else’s (virtual) page.
The fix: Restrict Your GA4 page_view Trigger by Domain
The most effective solution is to add a domain restriction to your GA4 page_view trigger in GTM. This takes about 30 seconds.
Step 1: Open your GA4 tag in GTM
Go to Tags, find the GA4 configuration tag that sends the page_view event, and click into it.
Step 2: Edit the trigger
Scroll down to the Triggering section and click on your current trigger (most likely All Pages or Window Loaded).
Step 3: Add a domain filter
In the trigger configuration, add the following condition:
With this restriction in place: Even if gtm-msr.appspot.com loads your GTM container, GA4 page_view tag will not fire.
Step 4: Save, preview, test
Save the trigger and the tag. Use GTM Preview mode to test on your actual website — the GA4 tag should still fire. Then visit https://gtm-msr.appspot.com/render2?id=GTM-XXXXXXX (replace with your container ID). If the domain restriction is working, the tag won’t fire, and you’ll see the tag blocked in the preview panel.
Step 5: Publish
Once you’ve confirmed it works, publish the container.
A note about other approaches
You might be thinking: “Can I just filter this out in GA4 instead?”
You can — you can create a filter to exclude gtm-msr.appspot.com from your reports. But that only hides the data after it’s already been collected. It still counts toward your event quota, and it’s still sitting in your BigQuery export (if you have one). The domain restriction in GTM is the cleaner solution — it stops the data at the source.
Final Words
Seeing traffic from gtm-msr.appspot.com in your GA4 reports is unsettling the first time, but once you understand the mechanism, it’s easy to fix. A simple hostname restriction on your GTM trigger is all it takes, and you can set it up in less than a minute.
Have you seen other strange domains showing up in your GA4 data? Or did this fix work for you? Drop a comment and let me know .