Easy to miss if you only look at analytics UI. You can only see it when you compare server logs against GA.

Just the other day I was thinking why does the American Osteopathic College of Radiology website link to a listitcle about Halloween constumes on a website with 10 pageviews/week? Google Analytics was showing two visits even after I used several filters to weed out most of the uninteresting traffic. Checking the logs showed that it was clearly referrer spam.

A few days earlier, I got an alert that the same aocr.org was possibly hotlinking some image. Again, checking the logs on my image server showed that it was just some bot crawling images and using the aforementioned website as referrer.