Tuesday, February 26, 2013

Another Day, Another Referral Spammer

If you notice another Blogger site by the name of www . kmzackblogger . com in your referrals, know that it is a blog setup to get you to pay for better YouTube video placement. It showed up on the blog I just started for my grandmother's diaries, so I was curious enough to check it out.

Don't click on it.

UPDATED April 28, 2013

Once again KMZack Blogger left a comment, this time with an embedded link to a link exchange. Text follows:

Hey if you still get a referrer as my web (link removed) please aware that it is a kind of system that my competitor did to visual my web as spamming. then if you would like to exchange link with my website please proceed to here..
(link removed)
Since he's hoping to get his links up, the comment is not being put up.

A screen capture of his website (picture is safe to click):

Nothing shady about that, right? A competitor trying to make him look like a spammer isn't very plausible.  I'm surprised he isn't offering the Brooklyn Bridge for cheap.
UPDATE:

It is very interesting that as soon as I post about one of these spammers, more referral spam shows up. It makes me suspect they are all connected somehow.

In this case three different ones:

www . bthemes . info
This looks somewhat legitimate in that it has themes for Blogger. But the fact they use referral spam makes them look quite shady. I don't advise using them for that alone.

vampirestat and zombiestat:

vampirestatThese are run by the same people using the same templates with different graphics and purport to show the monetary worth of websites. I have to wonder how legitimate the Facebook likes and G+ numbers are. Do not go there since there are all sorts of things asking to be installed.

UPDATED:

Yet another referral spammer on Blogger showed up with 11 page views on February 28.

make-money-with-your-blog . review-blogspot . com is another get rich quick scheme making the rounds. "Mary" even has a short bit on the page about people reporting her blog is a scam and that she has "the approval of Blogger." Of course there is only the one post containing a shortened link.

Avoid at all costs.

82 comments:

Gopal said...

Great! I clicked on this link once.. Does that mean I am in trouble? Thanx for the post though. At least now i know..

Patrick D. Boone said...

That depends on if the visit left a cookie, I suspect. I have Noscript enabled which protects against Javascript based attacks to some degree, but I didn't see any malware insertion attempts.

They will have a record of your visiting containing your IP and referral though, so odds are you will see more referral spam in the future. But it isn't like we can escape that anyway!

JuanVegetarian said...

These sites also appear on my blog's traffic sources statistics. Do you have any suggestion how to get rid of it?

Patrick D. Boone said...

Sadly there is nothing that can be done to remove them from your Blogger statistics. Complaints can be made to Google about it, but it doesn't seem to change things.

However, if you get a free Google Analytics account setup with your blog, those stats will not show the spammers. They are also much more detailed and accurate about visits to your blog, so I recommend using that service.

JuanVegetarian said...

Thanks, Patrick. As long as it doesn't do "harm", then ignoring it might be the only option.

I have a Google Analytics account set up already. Thanks again.

KMZackblogger said...

I am not doing any harm to you blog and i guess people come to your blog after click your link from my blog

Patrick D. Boone said...

Not all traffic is good traffic and likewise not all linking is good linking. So please cease introducing referral spam into the system.

Introducing false linking lowers the target blog in Google's indexing, so isn't true that all is good. For those interested, look up the words "panda" and "penguin" while including "Google SERP" in your search. Trashy linkbacks have been used by shady types to take rival websites down in the rankings.

Anonymous said...

I've been getting hits from cartoonmeme.com. I'm sure it's referral spam, but when I've tried to look it up, nothing suspicious pops up. However, when I cut and paste the link and opened it elsewhere, I got a page for Bad Luck Brian and absolutely no reference to my website.

Patrick D. Boone said...

That's how the fake out is done to get you to go there.

While I don't understand the details, there are spiders that crawl the Web to harvest website locations for spammers. People wanting to increase traffic to make money or plant malware pay hacker types to insert faked referrals into Blogger's stats without ever creating a real link. It's all automated with scripts to hit a lot of sites at once.

I've checked the recorded traffic for some of these using whois and other tools. Some of them get less traffic than the trickle I have here, so I can't believe it is a sure fire money maker for the sites spamming.

Vladimir KovalSky said...

Thank you! I recognized that kmzackblogger.blogspot.com also appeared as a referral in blogspot statistic of my blog 8916898.blogspot.com

Anyway, in this particular moment Google says that it's been deleted.

Music by Thisbrucesmith said...

Another trick spammers like is to shorten their links using any of several services. I've used longurl.org to expand the links. Longurl shows information about the true originator without you having to actually click through. In hindsight though, if the referrer isn't a major search engine or a known good referrer, it's most likely spam.

Patrick D. Boone said...

There is also an add-on for Firefox called Long URL Please that can expand shortened links. There seems to be another round of spam using Twitters t.co linking showing up this past week.

Molly said...

Unfortunately, KMzackblogger is still doing the rounds. I set up a blog yesterday and it's showing as a referral link already.

Our of curiosity I clicked the link to find a site selling youtube views, so how can he possibly argue that he/she is linking back to my blog?

I hate spammers with a passion - is there anything at all we can do to get rid of clowns like this?

Patrick D. Boone said...

Molly - There isn't a heck of a lot we can do about it except get the word out. That's why I write these posts since there isn't a lot of info on the Net.

The spam wars have heated up considerably and show no signs of going away. Do a search on "Spamhaus" to find out just how ugly the battle has gotten. That anti-spam organization was the subject of one of the biggest denial of service attacks in Internet history last month.

Bert Brijs said...

I also got the http://kmzackblogger.blogspot.be/ as a referral and to add isult to injury these fatfighters(flf-course.com) also link to my blog about Business Analysis for Busienss Intelligence. If I might add, Business Intelligence can make an organisation lean :-)

Matt Grobis said...

I've noticed this type of spam on my blog too. Thanks for the post!

vartinnaa said...

Saw them today on my blog. I use my usual "in doubt don't click" trick. I did a search and end up here confirming what I thought it was. There is so many referral spammers on blogger....

Donna said...

I saw this name as a referral in my stats. You never know, huh?

Circuitous Road said...

When I clicked on it yesterday with "blogspot.com" at the end of the linkadress it said the blod was gone - thats good. Saw today same name but with only ".com" in the end and when I push it I ended up at Googles mainpage. Then I desided to google it and came here. Am I in trouble?

Patrick D. Boone said...

Jennie J - While I didn't run into anything, I suggest clearing your browsing history and deleting your cookies just to be safe. Make sure you know all your passwords that you log into Web sites with first before doing this!

Also, it would be wise to scan the computer you used for viruses and malware. Free scanners for this include Avast, MalwareBytes, and Spybot-S&D.

Aspen said...

Bert Brijs - I also got views from flf-course.com on my book blog, as well as kmzackblogger.blogspot.com

Does anyone know if the two are related, or are they just spam? Actually, what even is referral spam? (Blogging newbie over here!)

Patrick D. Boone said...

Charlotte - As far as I can tell the two are not related. There is a possibility they used the same "kit" or service to generate the false hits on blogs.

The "referral spam" is false hits inserted into the stats generated by Blogspot and the visits or views don't actually happen. They are inserted into Blogger's stats so that we'll click on them so that they get ad revenue from page views or spread malware or even get you to buy something. Money making is always the motive.

Unknown said...

I clicked on this link too - today(!), cause is showed on my source of traffic-list.. but it just directed me to Google? What does that mean? I read the comments, but they stated this blog was deleted, is it up again? (I'm clearly a newbie too)

Patrick D. Boone said...

Julia - I tested the link out and it goes to google.com for me too.

I'm thinking the site was taken down and a redirect was put in place by someone. Either GoDaddy or the original creator of the site did this.

Aspen said...

Patrick - Thanks for that. I've got one off blogsrating.pw today; presumably more of the same because I clicked on an earlier link? I've cleared all of my data/browsing history from my laptop as well in the hope that'll get rid of anything they may have stored on the system.

Patrick D. Boone said...

Charlotte - The spammers find you even if you don't click on the link. The website addresses are traded around and a brand new blog that has never been visited can be hit by them. I suspect somebody has a "spider" collating new blog addresses as soon as they go up.

InsoManiac said...

Thank you for your article. I recently found that blog among the source of traffic for my blog.
What's the point of these spammers? Except from visiting, I haven't found spam comments or links...just curious.

Patrick D. Boone said...

InsoManiac - It is all about money.

In the case of this particular spammer he was selling automated hits on YouTube videos. If a video gets popular enough, the person who put it up can rake in a lot of money from the ads run before it. That's why you see attractive gals putting up video responses to what's hot on the service since they get a lot of clicks from guys seeing it on the sidebar. So it might be worth it to invest in a massive amount of clicks up front.

Other spammers get money from ads on their site for each visit and some hope that a percentage of visitors will buy whatever they are selling.

I don't see how they can make enough off of suckering Blogger users who look at their stats, but email spam is supposed to be profitable despite all the filtering.

InsoManiac said...

Thank you for the answer! I wonder if they actually make good money or if they fail at it and just end up annoying everyone else.
Would get rid of it on my stats page if I could, now that I know what it is.

Unknown said...

Thanks! You really helped a sister out!

Javier Toro Caviedes said...

Hello Patrick, my blog-site is from Spain. Like Romy Sollorano this site kmzackblogger.blogspot.com.es also appear on my blog's traffic sources statistics.

Patrick D. Boone said...

Christiana -- Glad to be of service!

Francisco - Thank you for visiting, one of the joys of blogging is having visitors from around the world. Unfortunately, this spam has generated searches from more countries than I can list.

Bene Scimus said...

It showed up in my stats as well at benescimus.blogspot.com. When I clicked on it though, it said the page no longer existed.
Maybe the problem has been fixed?

Unknown said...

I agree with mr.bruce smith :)

Cathrine said...

:-) hi - I get daily visits from that url but they never leave a comment. What would be the point of that? Pluss blogger says that url is now deleted ? And yet daily visits.

Patrick D. Boone said...

Bene & Catherine - Whatever service the guy used is still pumping out the spam despite the page no longer being up.

Tora - Yep, Bruce's advice is good. People just need to think before clicking on links.

Aspen said...

Hi Patrick. I've been getting referral off ohbelog.com - I looked it up on Google and it turned out to be porn (!) Just wanted to give you a heads-up about that.

Patrick D. Boone said...

Charlotte -- Thanks for the info, that's one I haven't seen yet.

W. Keith Sewell said...

Patrick - how do I setup that analysis tool to block spammer/ robot stats from my blog - Is it in blogger settings?

Patrick D. Boone said...

W. Keith - It isn't a filter on the Blogger stats page, but enabling different tracking through Google Analytics or StatCounter.

For Google Analytics: Sign up at http://www.google.com/analytics/ and then get your "analytics web property ID" and paste it into the box at the bottom of your Blogger 'settings - other' page. There are also instructions at Analytics if that doesn't work.

For StatCounter: Sign up at http://statcounter.com/ then look for the "Guided Installation" section on the main page. The first guide happens to be for Blogger!

I use both.

Keys to the Closet said...

Thank you for the warning. I have passed it. on.

Unknown said...

This completely sucks -.- I just saw this come through today and thankfully I didn't click (I've already learned my lesson with vampirestat and blogratings -.-)

I've started feeling proud of my blog's views but now I realize half of them come from spam.

Patrick D. Boone said...

Scarlette - I know how you feel, but keep plugging away and you'll eventually get more traffic.

I'm still dealing with the extreme irony of most of my traffic coming from posting about spammers.

Unknown said...

Good information for new bloggers (like myself). I just checked the referral statistics and found the main link in this post mentioned too, haven't received any comments on any of my posts so far however though.

Katie said...

I don't know if anyone told you this, but I was stupid enough to click on it (it showed up as a blogspot address, and I thought a new blogger had found me) and it installed a metric TON of malware and adware onto my computer. I ended up having to run Malware Bites three times (twice in administrative), Spybot twice, and a new program, SUPERAntiSpyware, to rid myself of it all.

So DO NOT CLICK PEOPLE.

Patrick D. Boone said...

Louise - Glad to help, happy blogging!

Katie - I'm sorry you found out the hard way. It has gotten hard to trust most things on the Net thanks to spammers like him.

Aspen said...

Patrick - I've had another today from blogs.needz.it (presumably more of the same). Just a heads-up again.

Unknown said...

Thank you so much. I just started my blog so I shouldn't have any traffic. It surprised me to see another blogger had already visited your site. I couldn't follow the link so I did a google search and found your article. I cleared my browsing history and cookies just to make certain. Thanks again

Patrick D. Boone said...

Charlotte - Thanks for the alert. Vampirestats has been showing up lately too. It seems that it goes in cycles.

D.L.F. - Glad to of service.

Aspen said...

Patrick - filmhill.com came up today

Hazel_Myope said...

When I clicked on one of the referral links to have a look Blogger stopped my and when I googled it you were the first link to come up.

Your website is awesome and I'm temped to link it and talk about it just as a 'sucks to you' to kmzackblogger. :-)

Aspen said...

Patrick - awsurveys.com

Patrick D. Boone said...

Hazel - Thanks for the compliment. It is one of my small comforts in life that I'm not kmzackblogger.

Patrick D. Boone said...

Charlotte - I haven't gotten that one, but I'll check it out.

Sab said...

thanks for the advise. I've found it this morning in my page of D-visitors (sorry but I don't know this word in English, I think it's the good one?) and I searched some informations concerning this page which has been deleted so quickly ;)...
Have a good day! Hope that sun is shining too.

Patrick D. Boone said...

Sab X - You are welcome!

The English version of Blogger calls that "traffic sources" if that helps.

Yes, the sun is shining here today and it will be 35.5 C but feel hotter. Hope it is cooler there.

Anonymous said...

Thank You. Pretty new to blogging but found this little so called "blogger" visiting my new blog. So checked out Google and found your article. It also made me check out a few other links that are in my logs. I'm giving you a shout out on my blog. Many Thanks.

Aspen said...

Patrick - I had thetaoofbadass.pw come up today. I Googled "thetaoofbadass spam" and nothing came up to say that it is spam, so I thought I'd check it out. Turns out to be some video that claims to be up for 24 hours only (how lucky that I stumbled upon the right day!) and gives men advice on how to pick up "literally hundreds of chicks". I watched the video for a bit to see if it seemed like any of the sites you've visited above but it doesn't seem to want anything, only to give advice on dating. Is this spam, or something completely untoward that I'm just a bit paranoid about? I've cleared my browser history, cookies etc for the day so hopefully my laptop won't be infected with anything.

Patrick D. Boone said...

Whovian - Thanks!

Charlotte - That site is looking for hits and there are more details here:
http://from-the-sidelines.blogspot.com/2013/07/a-tricky-bit-of-spam.html

If you haven't already, you should scan for viruses and malware. One theory has been floated that videos might be a distraction while something is installed in the background. Better to be safe than sorry.

jp said...

I quite enjoy the company when my pageviews suddenly go up 50% in one leap, but I know not to click on things, I learnt that a long time ago.

Unknown said...

Thanks Patrick for this informative post. I have recently launched a blog and writing a post everyday diligently. Of course the blog does not have a huge following and I was surprised to find 300 page visits in just last night. I am glad I did not click on referring sites and checked it on google instead. Thank you for guiding new bloggers like me :)

Patrick D. Boone said...

jp - Yep, you have to watch what you click everywhere on the Internet, but some people haven't been taught that. Hopefully posts like this one will educate a few before they learn the hard way.

Nishra - You are welcome!

It sounds like you have the right approach and if you can keep that pace up real people will show up eventually. Remember that blogging is about writing first and building your audience second with everything else after that.

I'm not one to do self promotion so it's gratifying to have people like you and the others show up and post.

Unknown said...

Like other bloggers I have found sources that seem sketchy. I really don't want to ignore a comment, but I'd rather be safe than sorry. I also had a comment from thetaoofbadass. I chose to ignore it. I wish there was a reliable list, but I'm sure spammers work 24/7 on new names. Thanks for the help.

Unknown said...

One of my referring sites this morning was kmzackblogger.com so it is still about. Googled it and found you thanks for the post.

Lindsay said...

I've recently been getting traffic from kmzackblogger. I hadn't seen this referral spam site before. Ugh, it's so frustrating!

Patrick D. Boone said...

It's amazing how once something is in the system it stays there. I'm beginning to wonder if we'll be seeing this spam through the rest of the year.

Aspen said...

Patrick - I've had a couple more sites come up; this time they seem to be a series of numbers
0288c729.qqc.co (yes, .co and not .com)

ceae2122.dyo.gs

Something new?

Patrick D. Boone said...

Charlotte - I checked out the second one in the following post:
http://from-the-sidelines.blogspot.com/2013/07/a-failure-to-load-spam-site.html

I don't recognize the first one, but I'll check it out along with two other new ones that hit a couple of days ago.

Sab said...

Hi!
As far as I'm concerned I've seen it twice last week. I've scanned it with evul.com but it didn't recognize anything malicious (http://evuln.com/tools/malware-scanner/ceae2122.dyo.gs/) if it can help...
Have a nice sonny day (the contrary there - North France ;))
Bye xxx

Patrick D. Boone said...

Sab X - They keep promising sunny days this week, but Sol plays hide and seek instead.

Thanks for checking to see if that site has anything malicious. I'm not acquainted with evul.com.

Sab said...

Hi!

evul.com makes a good job but not always 100% trustly... for example in case of external pages of primar site. I don't know if it's the good translation: I want to mean that the site didn't recognise something is malicious if, for example, the link send the internaut out of the page to an other page external of the site... is that clear in English??? I give an example. The primar site is: www.aaa.com but when we click to the link, we arrive to the site: www.aab.com.

Bye x
Sab

Jo Tizen said...

Yes it show in my statistics... kinda annoying... hope google will block this spammers

Ecchi Manga Blog said...

Very useful post. Thank you very much for the information, it is a pity we have to deal with those spamming bots and black hat practices while still trying to have fun blogging.

Lilis Kitchen said...

thanks so much for this post it has provided me with some useful information

Malay Muslim Apostate said...

Thanks for the post. I search on Google for http://kmzackblogger.blogspot.com/ spam and ended up at your blog. The so called spammer was created by Josh Peterson @ Joshua Peterson http://blog.noaesthetic.com/. I also get most visits from http://www.vampirestat.com http://www.adsensewatchdog.com Nothing much I can do but just clear the browsing history as you have suggested. I read the comments and find it helpful. Thanks again. I am from Malaysia.

Sarma said...

Umm, in the first 4 days after I set up my blog, vampire was the only one "kind" enough to pay a visit (apart from the Google of course.)Now that real, at least what I assume is real, traffic has gone up a little, I ignore the vampires & co. Thanks for information on KMZack. As you rightly pointed out we must make a list of baddies & circulate it. Here are three from side.
b4c9d0e9.dyo.gs
kallery.net
ohbelog.com

Patrick D. Boone said...

Malay and Sarma - Thank you for the additional spammer addresses. I'll look into the ones I haven't covered in other posts.

Weary Traveler said...

I have clicked on some of the referral sites listed in my blog traffic. I didn't realize anything bad can happen :(

I have an iPad. Can malware still be put on an iPad? How would I find it and get it off?

Patrick D. Boone said...

Weary - There isn't a lot of malware targeting iOS, so odds are you are okay. I suggest clearing out the cookies on your web browser just in case.

Christopher M. Miller said...

Thanks for writing about the spam from places like vampirestat. I wish I would have found your website sooner.

I posted a warning in my blog about vampirestat and now my blog getting overwhelmed with traffic from that domain.

Patrick D. Boone said...

Christopher - You're welcome!

roselle said...

Thanks, Patrick, for devoting so much time to helping us all. Just learned a bit from you and your commenters.