GlossaryDark social

What is dark social?

Dark social is sharing that analytics cannot attribute: links passed in private messages, chat apps, email and text, which arrive with no referrer and get filed under "direct" traffic.

The term was coined in 2012 to describe why "direct" traffic was so large. A link pasted into Slack, iMessage or WhatsApp opens with no referrer, so the visit looks like someone typed the URL by hand. For most sites it is the biggest source of traffic that nobody can explain.

Server logs add one signal analytics does not have: the link unfurler fetch that the chat app made when the link was pasted. That fetch names the app and the URL, so you can see which pages are being shared privately and roughly where, even though the people who clicked stay anonymous.

agenttraffic also lets you register your own share-link pattern (a ?ref= or ?preset= parameter you hand out) and reports how often each shared link was opened.

Related terms

  • Link unfurler: A link unfurler is the fetcher a chat app or social platform sends to build a preview when someone pastes a link.
  • Server log: A server log (or access log) is the file a web server or CDN writes with one line per request it answered: time, path, status, client IP, user agent and referrer.
  • Floor: A floor is a count reported as "at least this many": the number that could be measured, with the acknowledgement that the true number may be higher.

Published 2026-09-21, updated 2026-09-21.

See it in your logs

One command, nothing to install

Point it at CloudFront, nginx or Apache logs. Every AI agent that visited gets its own row, verified against the addresses its operator publishes.

$ npx agenttraffic ./logs --days 7Quick start

Roadmap

Get a weekly report in your inbox

The command-line tool is free and stays free. A hosted version that emails you each week is on the roadmap. Leave your email and you'll hear once, when it exists.