I started getting traffic from a domain identified as dangerous by my antivirus when I tried to access it. After some googling I learned it was referral spam. I configured GA4 list of unwanted referrals to see if that solves the issue.

Identifying the session source in GA4

I found a very clear explanation of how to know the session source in here.

Summary: Reports > Generate Leads > Traffic acquisition > Click the “+” sign button > Traffic source > Session source

Learning about referral spam

Through this reddit post I learned about referral spam.

Blacklisting the offending domain

GA4 allows having a list of unwanted referrals, as explained here. I imagine I will have to keep updating this list in the future.

Summary: Admin (gear at the bottom) > Data collection and modification > Data streams > Web > Click the Property > Configure tag settings > Show all (or Show More) > List unwanted referrals