Web Analytics Referral Spam

Traffic2cash.xyz Google Analytics Referral Spam

On December 22, 2015 Google Analytics showed 22 referrals to my site from traffic2cash.xyz, which sounds like a referral spammer. Because this didn’t show up on my Piwik analytics, it is clearly spoofed referral spam where not even a crawler visited my site. In this type of referral spam, the attacker calls Google Analytics with spoofed IDs. If this appears on your site, it is not real traffic; it is a referral spam attack designed to get you to go to traffic2cash.xyz. Whether this is for commercial or malicious purposes is unknown.

TCPIPUtils shows that the site is registered on December 10, 2015 to Alex Zuev in St. Petersburg, Russia. The IP address shows as TCPIPUtils shows that this server also hosts cash4traffic.xyz and get-your-social-buttons.info among other sites. The server is flagged for hosting adult sites.

curl traffic2cash.xyz shows code with an input form that calls a PERL script on aweber.com. TCPIPUtils shows this to be registered to Aweber Systems at 1100 Manor Dr. in Chalfont, Pennsylvania, USA. The Better Business Bureau lists several possibilities, the most likely of which (A Weber Communications) gets an A- rating.

The traffic2cash.xyz site shows a copyright date of 2014, which seems unusual for a domain purchased in 2015. Cash4traffic.info redirects to traffic2cash.xyz.

Trends in Traffic2cash.xyz Referral Spam

There is no way to really tell how many sites are being attacked by a particular referral spammer, but Google Trends provides information on how many webmasters are searching for information on a particular domain name. Figure 1 shows Google queries for “traffic2cash.xyz”, “cash4traffic.xyz” and “referral spam” from December 22, 2015 through December 28, 2015, Figure 2 shows regional activity for the last seven days, while Figure 3 shows the same query from 2004 to current.

Figure 1. Google Trends for “traffic2cash.xyz”, “cash4traffic.xyz” and “referral spam” from December 22, 2015 through December 28, 2015.
Figure 2. Google Trends regional activity for “traffic2cash.xyz” and “referral spam”over previous seven days
Figure 2. Google Trends for “traffic2cash.xyz”, “cash4traffic.xyz” and “referral spam” from 2004.

Fixing the Problem

My first reaction in addressing referral spam was to add a line to .htaccess to block these spam referrals (see http://www.htaccess-guide.com/deny-visitors-by-referrer/ for a description of how to do this) but with more research, it turns out these referrals weren’t referrals to my site at all, but were insertions of fake referrals into my Google Analytics reports. As was the case with darodar.com, the clear intent is to cause webmasters to go to an unfamiliar site when they see a reference in their Google Analytics reports. Whether the motivation is to generate traffic to their site or to cause webmasters to visit a site that will download malware is unknown.

Based upon the instructions in Removing Referral Spam from Google Analytics, I checked the hostname on the referrals, and all showed “(not set)”–a clear sign that no one ever touched my site and that these were inserted into Google Analytics to get me to click social-buttons.com to generate traffic or download malware onto my computer.

Removing Referral Spam from Google Analytics provides a good description of the problem and some solutions. Understanding and eliminating referrer spam in Google Analytics gives another good description of referral spam and a programmatic solution that is appropriate for plug-in developers but not for administrators of WordPress, Joomla and other content management system (CMS) based sites.

An alternative is to switch to self-hosted Piwik for your web analytics; if you do this, it will be immediately clear that the vast majority of Google Analytics referral spam is of the spoofed variety rather than the crawler variety. Piwik does not have the advertising integration nor does it have the demographic information, but for many small-traffic sites it can provide much more information. See Using Piwik as an Alternative to Google Analytics on this web site for more information on why Piwik might work for you and how to implement it.

Useful Commands and Web Sites for Investigating Referrers

For investigating a referrer, here are some useful commands and web sites:

  • TCPIPutils is a great site for looking up data on an domain or IP address
  • For domain registrations, the command line whois social-buttons.com is very convenient as is https://www.whois.net/
  • For IP lookups, dig social-buttons.com is convenient, as is http://ip-lookup.net/index.php
  • Better Business Bureau
  • To view a site in character mode so that malware doesn’t get downloaded, use curl and curl -L. These are commonly installed on Linux machines, but will require additional software on Windows and OS X, as discussed below.
  • To look up a lot of information on an IP address in one place http://www.tcpiputils.com/browse/ip-address will give you a lot of information quickly.

Command Line Utilities

To use the whois, dig and curl commands on Windows and OS X, you will need to install additional software:

  • On Windows, install Cygwin and add the curl package.
  • On OS X, install MacPorts and add the curl package.

Cygwin and MacPorts have many additional command line and graphical utilities that make life easier in Windows and OS X.

More Information

For more information on referral spam, see

This web site uses cookies to provide user authentication and improve your user experience through the use of Google Analytics and Matomo Analytics. It also uses contact information for email and phone communcation. For details, see the Privacy Policy.