Welcome to the Q&A Forum

Hey there, Do you see any of these referrals on your reports 4webmasters, free-social-buttons, trafficmonetize... (there are many) If you do then you don't have to worry about security issues or anything apart from your data quality. You are not being attacked, at least personally, this type of spam is called ghost since it doesn't have any interaction with your site whatsoever and strikes many GA users. As I mention the only thing you should worry about (big thing though) is your data. Here is a related question on MOZ that will help you get rid of it, I strongly recommend you to follow the valid hostname solution. Hope it helps, Carlos