Referral spam is when bots create fake traffic on a site to stuff a Google Analytics referral report with spammy links. The goal is to encourage a GA user to click on the link, which then takes them to a malware-ridden site or service scam.