Success-seo.com Referral Spam
On Wednesday, July 1, success-seo.com
appeared in my Google Analytics referrer list.
Since discovering about Google Analyics semalt.com
is a well-known referral spam robot, I didn’t Google them and click on their site. For more information on Semalt,
see Semalt Hijacks Hundreds of Thousands of Computers to Launch a Referrer Spam
Campaign. I ran whois success-seo.com
and discovered that the domain was created on June 30, 2015 and that it was registered to
Whois Privacy Corp through a domain privacy service in the Ukraine used by videos-for-your-busines.com
and other semalt.com
domains. This is the same registrar as
100dollars-seo.com
.
curl success-seo.com
returns nothing, indicating that the site redirects to another domain. curl -L success-seo.com
returns a web page with references to semalt.com
.
Like 100dollars-seo.com
, success-seo.com
has identical HTML when compared to semalt.com
. To do this comparison, I used
curl -L success-seo.com > junk
curl -L semalt.com > junk1
diff junk1 junk
A domain lookup on Tcpiputils shows that the IP address is 217.23.7.144
, on a worldstream.nl
server in the Netherlands
An IP address lookup on Tcpiputils shows that this is the same server that hosts
- 100dollars-seo.com
- best-seo-offer.com
- buttons-for-your-website.dom
- website-errors-scanner.com
- best-seo-solution
I decided to block the site from my Google Analytics Referrer list.
Removing success-seo.com from Google Analytics
I added success-seo.com
to my Google Analytics filters as described in Removing Referral Spam from Google Analytics, the best article on the topic that I have found. There are a number of articles about adding redirects or allow/deny code to .htaccess
. These don’t necessarily work and can open some serious security holes if incorrectly implemented.
Trends
There is no way to really tell how many sites are getting hit by this referral spammer, but you can use Google Trends to get an understanding of how frequently web masters query Google looking for information on this site. The figures below show the relative frequency for searches on “referral spam” and “success-seo.com” respectively. At this writing, the second figure does not have enough data to be populated, but experience shows that about a week after this writing, Google will have enough queries to populate it.
Fixing the Problem
My first reaction in addressing referral spam was to add a line to .htaccess to block these spam referrals (see http://www.htaccess-guide.com/deny-visitors-by-referrer/ for a description of how to do this) but with more research, it turns out these referrals weren’t referrals to my site at all, but were insertions of fake referrals into my Google Analytics reports. As was the case with darodar.com
, the clear intent is to cause webmasters to go to an unfamiliar site when they see a reference in their Google Analytics reports. Whether the motivation is to generate traffic to their site or to cause webmasters to visit a site that will download malware is unknown.
Based upon the instructions in Removing Referral Spam from Google Analytics, I checked the hostname on the referrals, and all showed “(not set)”–a clear sign that no one ever touched my site and that these were inserted into Google Analytics to get me to click social-buttons.com
to generate traffic or download malware onto my computer.
Removing Referral Spam from Google Analytics provides a good description of the problem and some solutions. Understanding and eliminating referrer spam in Google Analytics gives another good description of referral spam and a programmatic solution that is appropriate for plug-in developers but not for administrators of WordPress, Joomla and other content management system (CMS) based sites.
An alternative is to switch to self-hosted Piwik for your web analytics; if you do this, it will be immediately clear that the vast majority of Google Analytics referral spam is of the spoofed variety rather than the crawler variety. Piwik does not have the advertising integration nor does it have the demographic information, but for many small-traffic sites it can provide much more information. See Using Piwik as an Alternative to Google Analytics on this web site for more information on why Piwik might work for you and how to implement it.
Useful Commands and Web Sites for Investigating Referrers
For investigating a referrer, here are some useful commands and web sites:
- TCPIPutils is a great site for looking up data on an domain or IP address
- For domain registrations, the command line
whois social-buttons.com
is very convenient as is https://www.whois.net/ - For IP lookups,
dig social-buttons.com
is convenient, as is http://ip-lookup.net/index.php - Better Business Bureau
- To view a site in character mode so that malware doesn’t get downloaded, use
curl
andcurl -L
. These are commonly installed on Linux machines, but will require additional software on Windows and OS X, as discussed below. - To look up a lot of information on an IP address in one place http://www.tcpiputils.com/browse/ip-address will give you a lot of information quickly.
Command Line Utilities
To use the whois
, dig
and curl
commands on Windows and OS X, you will need to install additional software:
- On Windows, install Cygwin and add the
curl
package. - On OS X, install MacPorts and add the
curl
package.
Cygwin and MacPorts have many additional command line and graphical utilities that make life easier in Windows and OS X.
More Information
For more information on referral spam, see
- Social-buttons.com Referral Spam
- Best-seo-solution.com Referral Spam
- justprofit.xyz Referral Spam
- Get-free-social-traffic.com Referral Spam
- Video--production.com Referral Spam
- Rankscanner.com Referral Spam
- Success-seo.com Referral Spam
- Videos-for-your_business.com Referral Spam
- Semaltmedia.com Referral Spam
- 100dollars-seo.com Referral Spam