Google Analytics, Casualty of Spam

http://www.ditherandbicker.com/posts/2015-01-10-rip-google-analytics.html

by amitmittal1993 • 12 years ago

207 83 12 years ago

PinguTS• 12 years ago

It is not only Google Analytics. I discovered the same with my Piwik installation.

taf22• 12 years ago

Any client side tracking solution is vulnerable or exposed is a better word to this. It's difficult for me to say it's a security issue because really by design everything about a javascript based tracker is public and really even server side trackers are not immune if someone decided to inflate your numbers or mess with referring traffic information it's all based on what the client sends you. I think in this case google maybe able to add some sort of machine learning to indicate in the result sets that certain links/visitors appear to be either bots or explicit spammers. Perhaps someone could even create a third party tool to do the analysis against a GA account using https://github.com/twitter/AnomalyDetection

binarymax• 12 years ago

Its not clear to me why spammers would do this, can someone please explain how a 3rd party benefits from incrementing hits on an unrelated site?

taf22• 12 years ago

they get their links in your google analytics reports... you'll likely check to see what the site is - causing you to visit the spammers site...

raziel2p• 12 years ago

The number of people in posession of a Google Analytics dashboard is way too low for spammers to generate significant click counts.

chii• 12 years ago

wow, that's quite a long winded way to get a site admin to visit a spam site - and plus it's very likely to be ad-blocked (savvy admins).

wlkr2• 12 years ago

According to this article when the site owner visits the spam link affiliate cookies are set.

http://www.wiyre.com/google-analytics-darodar-forum-spam-wha...

dazc2• 12 years ago

I think it's aimed at CMS platforms like Wordpress as some users have a list top referrers in their sidebar.

josteink2• 12 years ago

Lots of websites posts their visitor logs or stats on a special status-page (or at least used to do). If those links aren't rel=nofollow, then congratulations, your referer-spamming just gained yourself some SEO-bonus.

steventhedev• 12 years ago

For the server-side analytics, it's simple. Just use the GA Measurement Protocol, or a wrapper like staccato[1]. You can push the cid through ajax and javascript so you can even make proper reports, and just send everything from the JS to a dummy property.

[1] https://github.com/tpitale/staccato

jarcane2• 12 years ago

I've been noticing this for several years. A significant enough bulk of my logged traffic to my publishing label is this kind of spam that Ukraine shows up as my second largest source of traffic. My 9th most frequent referrer is, indeed, semalt.com, as mentioned in the article.

Generally, unless there's a major traffic spike from one source or another, I largely consider my traffic reports complete fiction because of this level of spam referrers.

gii• 12 years ago

You can create global filters in Google Analytics by going to Administration -> Global Filters

create a new custom filter for field Referrer and exclude the spammy site from there (do not forget to escape the dot \.)

Aardwolf• 12 years ago

Wouldn't the spammers constantly have random different referrers?

jarcane2• 12 years ago

Yes. The Ukrainian spam I get is almost entirely unique referrers each time, so individual results rarely show up enough times to even rank. Semalt.com and something called speedfox are the only ones that really show up consistently enough from the same source for host-by-host blocking to do any good. The others just rotate through different hosts on a routine enough basis that it'd be more work than it was worth blocking them one by one.

gk1• 12 years ago

Oh boy... Declaring a world-class analytics tool dead because you haven't figured out how to prevent script hijacking.

Just create a view filter that ignores traffic on any hostname other than yours. That's it.

pmelendez• 12 years ago

You still would like to know who is referring you. You can still filter those out one by one but it becomes a tedious war against spammers (very similar to the one on emails before the spam filters era)

corin_• 12 years ago

If those sites hijacking your code aren't actually linking to you, then the visits that show as referred by them are presumably visits staying on those spam sites. In which case by filtering out those visits, you'll also filter out the referral sources for those visits, no?

(It's been a while since Analytics was anywhere near my personal work, so could be wrong here.)

maemilius• 12 years ago

I'm not entirely sure how someone can prevent the publicly available Google Analytics code from getting hijacked. The author is claiming the sites responsible aren't even going to his site, just using, again, publicly available information (GA JS code and his very public API key).

Really, it sounds like the author is claiming that JavaScript only analytics solutions are the problem, not that GA is inherently bad (clickbait title aside).

Beyond that, as a few people have stated ITT, most of your GA reports are pure fiction already and it's worse the larger your site is. If a significant fraction of your total data is garbage, you aren't going to get much out of it, even if you can clean it up.

umurkontaci• 12 years ago

You know that by forging their own HTTP requests, they can send whatever hostname they would like.

artursapek• 12 years ago

Ah, so it's not just me. I guess I'll be putting more efforts into my server-side tracking/logging...

dazc2• 12 years ago

I have compiled a list of persistent offenders over the past 12 months and block them using SetEnvIfNoCase. It's a surprisingly short list with semalt being the winner by a long way.

zuck9• 12 years ago

This is not just with Google Analytics. I saw these same referrers in my WordPress.com Stats too.

Looks like spammers are deploying spiders browsing the internet with fake spam referrers.

aselzer2• 12 years ago

It seems like they are targeting smaller sites desperate for traffic. They are trying to make the owners monitoring (Google) analytics look at their own site offering "SEO", "marketing", "social optimizations" and similar services that are probably as shady as their way of "contacting" the owners of low-traffic sites.

I have a site with less than 200 "visits" per month. 20% of traffic apparently comes from the site semalt.semalt.com. 10% comes from this site: buttons-for-website.com. Another 6% is from this one: make-money-online.7makemoneyonline.com

Menge• 12 years ago

I don't think they are targeting anyone, I have always seen a few hundred a month on company websites. Some small sites simply aren't found yet by these spiders.

If you are seriously using analytics then you aren't really working in absolute numbers and the only problem is sporadic noise.

aselzer2• 12 years ago

The target audience for these sites are obviously people who want more traffic and want to make money with their sites.

Bigger sites couldn't be targeted cost-effectively because they would have to make a lot more noise for themselves to even show up in the analytics reports. Also, the people reading the reports are more likely professional and aware of those techniques.

Their algorithm is probably not so advanced, so they just shoot lots of requests to any site they can find. Luckily for them, most sites are small and unsuccessful.

stevekemp• 12 years ago

I've had the same bogus traffic, and referrers, exactly the same. I wrote about this here:

http://blog.steve.org.uk/paying_attention_to_webserver_logs....

Then put together a simple tool to filter out bogus IPs based on their requests, so that I can firewall them:

https://github.com/skx/webserver-attacks

kevin_thibedeau2• 12 years ago

I have some low activity Google code sites with analytics enabled. 50% of the referrals now come from a Russian SEO site starting a few months ago. They're generating unique bogus subdomains such as forum.topic52148208.darodar DOT com for each tracker ID they target.

Can't Google just blacklist these sites and make them disappear?

shadylane2• 12 years ago

I can confirm this. Got a site with very low traffic and one with 138K sessions a month. These russian spam referral sites are all over the low traffic site but they barely appear on the high traffic one. Not sure why Google hasn't blocked these yet. The same domains (ilovevitaly.com, darodar.com, pricer.com etc.) have been referral spamming since at least mid December. In fact the range of domains doing this was so limited it was relatively easy to set up exclusion rules in GA. The only annoying thing is that the exclusions aren't retroactive.

shadylane2• 12 years ago

Actually, was referring to small, desperate sites rather than the SEO motivation. Being spam, makes sense to target less popular sites. I'm not going to investigate every referrer on a busy site, but if I've only got a dozen referrers then I might check out one site sending me 50 visits.

kmfrk• 12 years ago

Reminds me of this video [https://www.youtube.com/watch?v=oVfHeWTKjag] on the bogus Facebook engagement you pay for: https://www.youtube.com/watch?v=oVfHeWTKjag.

elberto34• 12 years ago

maybe this can be fixed by requiring some mouse over action before the hit is registered

gingerlime3• 12 years ago

those spammers don't need to visit your site to send bogus analytics data. All they need is your unique GA tracking id, and they can fire data straight into google.

schoash• 12 years ago

that might be a problem for mobile devices.

orenbarzilai• 12 years ago

this is something google should take care of, not the site owners that use GA.

andrewstuart22• 12 years ago

For the record, blurring (even when applied appropriately) is still a pretty bad idea for hiding information [1]. I know this has been on HN a few times.

I'm not sure what you can do with the GA key or if it's even private, but just adjusting levels in gimp shows the numbers.

[1] http://dheera.net/projects/blur

athenot• 12 years ago

I was going to make the same comment and then I realized blurring it is pretty useless: that info is in the JS snippet for GA on that site (and yes the key is the same).

andrewstuart22• 12 years ago

That's what I figured, but since the author still blurred it I figured it was still worth mentioning.

josteink2• 12 years ago

I don't think the spammers are targeting Google Analytics specificaly as much as they are trying to get links for their domains on to the internet.

charlieirish• 12 years ago

Google have responded to this (in the past) by implementing an automated spam/bot/spider filtering service:

https://plus.google.com/+GoogleAnalytics/posts/2tJ79CkfnZk

If you're seeing nefarious traffic/referrers you may want to tick this box which I believe is unticked by default.

gingerlime3• 12 years ago

That's interesting, but judging by the description, it's based on User-Agent header matching. Sounds trivial to circumvent...

The backend will exclude hits matching the User Agents named in the list as though they were subject to a profile filter

joyofdata• 12 years ago

thanks for the hint - no more blackhats and vitaly shown in the sources - seems to work

angry-hacker• 12 years ago

This doesn't work in this case.

I have 100 of clients whose analytics are useless, I can't block them on server side since they never visit the sites.

It's impossible to keep up creating filters to filter them out also on Google Analytics.

This technique is a new, has been going on for a month or so.

sounds• 12 years ago

Google is definitely aware of this kind of abuse, and it's not too small to notice, too far into the long tail, etc.

The real problem here is that Analytics has that real-time view. If a spammer creates a test account and then tries to spam it, they can get real-time feedback on what works / what doesn't.

The solution is straightforward but not "easy": put the analytics frontend[1] on the same host that serves the rest of the application; use the same session auth and spam filtering that is already there.

[1] By "frontend" I mean the first step of the analytics data-gathering pipeline. And this part could be as simple as a new logging module that consumes log data in realtime, anonymizing it and aggregating it, then uploading it to one or more analytics services of your choice.

This solution sacrifices the ease-of-use that analytics currently enjoys. No more "just drop in this <script> tag."

adarshr• 12 years ago

I have that setting turned ever since I started tracking my website's traffic. But I am sorry to say, it doesn't work reliably. I still see traffic from sites such as semalt.com and a few others as you can see here.

http://i.imgur.com/XGRvLKa.png

arb99• 12 years ago

referrer spam is something that has been happening to years, and GA is actually quite good at filtering it comapred to a lot of other stats programs out there. This is really not an issue.

cornewut• 12 years ago

Adding to this - most privacy/adblock plugins also block analytics. So I really have to doubt that Google Analytics is of much value.

13• 12 years ago

Almost no mobile users do.

gingerlime3• 12 years ago

I'm not sure what level of sophistication goes into GA's anomaly detection, but if those spammy domains show up, then I'm guessing it's not that difficult to cause much more damage using similar techniques.

Scenario:

I want to annoy / confuse / distract my competitor by making their analytics data less-effective (potentially totally unusable). I grab their tracking ID and send tons of fake events / requests / page views. Now my competitor can't really figure out what actual traffic they're getting and what's real and what's fake... Plus they spend time trying to figure out what's going on, clean up their data etc.

It can go way beyond referring domains - think custom events, ecommerce tracking, site speed... anything that analytics tracks can be faked.

countryqt30• 12 years ago

So 300 "spammers" are visiting your site regularly. Why are they doing that? Only that you visit _their_ website which is usually offline or doesn't offer anything?

I don't get the point of this spam.

blfr• 12 years ago

I don't get the point of this spam either but they don't actually visit your site. They never connect to your server. They only send an event to Google Analytics using your (and probably any other) ID.

notlisted2• 12 years ago

I think there's more to it than referrer spam: unscrupulous SEO/SEM people artificially pumping up their performance to justify their rates.

A friend's analytics showed an amazing number of visits for a tiny site. While traffic was up, it did not lead to new clients. She fired the company she'd engaged for SEO/SEM because they kept raising their rates as traffic milestones were reached (hundreds of dollars a month).

Immediately after terminating that relationship, she noticed a 95% drop in traffic and panicked (see http://i.imgur.com/WwJ0vYo.png ). I was asked to fix it for her. One look in the referrers showed that this 95% all originated from China (ads.acesse.com) and was useless/fake (very few page views, very short durations). While we have no proof to support a lawsuit, the timing was too much of a coincidence to ignore.

eterm• 12 years ago

The moral of the story is that all targets will be gamed, so only ever target against revenue or something incredibly close to it.

sukilot• 12 years ago

Revenue is the most famous of the easily gamed. Target free cash flow.

Scoundreller• 12 years ago

Are the relative rankings in search results (e.g. moving from 25th to 15th or 2nd to 1st) for a set of pre-defined searches considered poor metrics?

Sure it will be hard to determine if the improvements are due to the cause of SEO or some other update, but using revenue as a metric has the same issue.

(Ideally one would use a "difference in differences"[1] approach, but it could be difficult without good comparators).

[1] https://en.wikipedia.org/wiki/Difference_in_differences

jusben1369• 12 years ago

Except my job is to get you traffic. I don't control how good or crappy your product is. So the biz can think of it in terms of rev but not fair to pay the SEO person on it

dohertyjf2• 12 years ago

Hence why business owners need to be educated that "all the traffic" is worthless if it's not making you money. Vanity metrics are called thus for a reason.

Disclosure: professional marketer and former FT SEO who is tired of people getting fed snake oil.

janesvilleseo• 12 years ago

I have been doing Internet marketing a long time. Optimizing for rankings/position is a waste of everyone's resources for a number of reasons.

1. The keywords you want may be worthless 2. Google/Bing/Yahoo stopped sending the keyword data about a year ago (so you have almost no insight into what keywords did what

What is important is driving meaningful traffic. This usually means increasing visits that increase revenue.

Here is the hard part, besides ecommerce sites, most businesses do NOT track at the level needed to know.

Even if you educate people, there is a tiny set that actually care to track and an even smaller set that actually put in the effort to do so.

A lot of people still care about the vanity side. "I am #1 for <keyword>"

Pay for Perforamce marketing only works if you close the loop. And even then it's a hard to do and may not be best for everyone

To me, it does sound like your friend was a victim of fraud.

lifeisstillgood3• 12 years ago

So, what levels do you need to track at?

Let's say I am selling a saas service, Facebook for dogs. I advertise on keywords like "share my puppy pics". Each keyword hits a different landing page. I track users with a cookie

Is there any more or less to do?

notlisted2• 12 years ago

Missed your response, yes she was. She was told that she would get better positioning (which she didn't) and receive loads of extra traffic (which she did), but none of that traffic was qualified traffic (that converts).

By the way, she does not sell a product, she sells a service (herself) and that's a little more difficult to track.

BMorearty• 12 years ago

I've been wondering since like forever why hackers hadn't figured this out yet.

jerrac• 12 years ago

Heh... I have an old Analytics site that hasn't had live code available on the web for years, and it got 4 hits last month. Are they randomly generating the ids?

rikkipitt• 12 years ago

Yes, it seems like they are to me. I created a test analytics account that has a fake URL and is not on the web but it has now accrued over 35 "hits" from forum.topic5768xxxx.darodar.com where 5768xxxx = the GA tracking code ID that is private and not exposed on the internet. Very annoying.

Kiro• 12 years ago

Can't Google just check on their end that the key was called from the website of the GA account?

grigio• 12 years ago

I would just add that it is done from Russia and often that links redirect to Amazon referral ids,..

dohertyjf2• 12 years ago

"A person who went through the trouble of setting up analytics tracking is probably a person with just enough vanity to immediately check up who's referring to their site."

Wait, what? I'm pretty sure if you go to the majority of sites on the Internet you will find some sort of analytics tracking code, whether it's Omniture, GA, or another. They don't do this out of vanity - they do it because they want to know where traffic is coming from so that they can monetize it.

BTW, you have GA implemented on your site as well. Does that make you vain, or simply smarter than the average bear?

zer0defex• 12 years ago

Data cleanliness is never a solved problem, it's just a fact. Depending on how severe the problem is, a simple way to combat this is by adding a custom key/value pair to all client-side GA requests (custom dimensions are great for this) and then adding a filter to your profile within the Google Analytics admin to exclude all requests without the appropriate key value. Change the value on a recurring basis, how often is your preference. Though always be sure you have at least 2 profiles for any GA property, one filtered (Production) and one unfiltered as the C.Y.A. profile so that should anything go wrong, you can still get to all data.

bhouston• 12 years ago

Just this week we started to get stupid priceg.com and blackhatworth.com hits from nowhere. Good to know I'm not the only one with this issue.

simbolo2• 12 years ago

Spammers likely use the public API to send the fake traffic (https://developers.google.com/analytics/devguides/collection...). The issue Google has is they need to provide a way to authentiate the data rather than rely on the public tracker id, then at least the data could be relayed server side after the server has already filtererd out spam; it would also be less trivial to generate fake traffic reports too.

One tip is to set the main view to filter only to include your actual domain name. I notice a lot of the fake traffic is for traffic on other domains. I don't think these spammers are crafting fake data specific for your website. Much like comment spam, the same HTTP GET is executed millions of times against a list of defined tracking ids they have obtained.

joshschreuder• 12 years ago

I had the Darodar variety of this barely 2 days after setting up my new blog. Turns out when you visit the link in Analytics it redirects to Amazon and sets the affiliate cookie meaning they get money when you buy something.

A similar money making venture was done on Pinterest a couple of years ago with affiliate cookies.

Magicstatic• 12 years ago

This website actually sums it up pretty well as to WHY these websites are doing this: http://www.wiyre.com/google-analytics-darodar-forum-spam-wha...

Google Analytics, Casualty of Spam

Related Stories