Recently I'm having a lot of requests that I see in google analytics from these domains (+25 others...):
scanner-irvin.top
scanner-viktor.top
compliance-alex.top
scanner-ivan.top
scanner-jess.top
scanner-julia.top
scanner-walt.top
scanner-elena.top
scanner-Jessica.top
But I don't know how to block these requests via Request Filtering in IIS 8.5. Via a Deny Sequence for example the keyword "bad" can be added and if "bad" appears in the url of your own site it will block it I suppose, but how to block the hosts?
The samples on the IIS website are from older versions or not that detailed.
You can't block so called "ghost referrals", that you see in Google Analytics, on your web server. The traffic never reaches your site. See https://moz.com/blog/stop-ghost-spam-in-google-analytics-with-one-filter for a detailed explanation.