A More Sophisticated Referral Spammer

2013 seems to be shaping up to be a spam heavy year and one that has been around hit my blog today. ontimemarketing . biz takes you to a Wordpress blog that at first glance appears to be legitimate. But spend more than a couple of seconds looking at it and you find that the posts are all taken from other sites to give the illusion that it is serious.

Well, it is serious about one thing and that’s generating online traffic to it in hopes you will click on the wall to wall ads and deals posted there. That is how the owner of the site makes money. I highly doubt Tiger Direct and The Huffington Post are contributing posters to the site given how amateurish the layout is. It is enough to fool spiders from registering it as a fake site, however.

Please do not click to go there. While I detected no malware, I was using Linux to visit the site, so be careful if you do.

Now back to working on real content for this site!

First Referral Spam of 2013

The new year has hardly begun and a new spammer has shown up: videoshub . needz . it. From the spelling, I can only surmise that it is a link to tawdry materials of a graphic nature. It is highly suggested you do not click on it if you find it in your Blogger stats.

Spam, Spam, Spam, Lovely Spam…

After the temporary stats outage at Blogger last Sunday, I had vague hope against hope that something was being done about the referral spam. Of course I knew better, but it was a nice dream. So a couple more referral spam links have shown up since then and racked up 37 hits between them.

itpaystoday . TextCashNetwork . com has been the most prevalent, not to mention most obvious. There must be a sucker born every other minute (birth rates are down, you know) in order for these operations to keep going. It boggles my mind that people fall for it. It is out of Russia like so many of the others.

The other spammer has trickip . net for an address. There is a faint possibility this is not referral spam, but there is no way I am clicking on anything that has a name like that. Not even sandboxing the browser is enough to convince me to do it.

More Russian Referral Spam

The latest round of spam showing up as blogger hits come from fr.netlog . com and appears to be actually a link from t . co instead. So far I have gotten sixteen “referrals” from there this week. While they show up on the Blogger dashboard’s stats, Google Analytics does not list the hits. Why Google does not filter them out for Blogger’s built in stats puzzles me.

So anyone getting hits from there, please do not clink on the links to investigate, that is what they want you to do. I would not be surprised if this is being done by the same people responsible for the aptratings spam.

UPDATED October 1, 2012

Yet another round of referral spam from Russia has been hitting my blog heavily. In this case adsresultpages . com links to a viagra ad. Out of curiosity, I looked up the website through whois and found out it gets about the same amount of visits I do a day. Not exactly a successful campaign, is it?

Funny thing is that referral spam has been around since at least 2002 when blogs started getting going in earnest and nobody can figure out how it can be profitable.

An Impressive Bit of Socially Engineered Blog Spam

Going through my email account revealed a comment waiting to be approved. While posted from that ever witty pseudo being, Anonymous, it looked legit at first before going off the rails:

Write more, thats all I have to say. Literally, it seems as though you relied on the video to make your point.
You definitely know what youre talking about, why
waste your intelligence on just posting videos to your weblog when
you could be giving us something enlightening to read?
Look at my homepage ... free porn

No video on the post is a wee bit of a giveaway even before the pornography offer (link deleted by me). Misspelling is no longer a surefire indicator that something is spam, so that can be forgiven. The idea of using constructive criticism as a form of social engineering in spam is a new one to me. I know it made me read the entire thing, so I bet this one is fairly effective.
Fiendishly clever is the phrase that applies, methinks.

UPDATED

Meanwhile, the Russian referral spam continues unabated. This time it is one from super-online-search . com that takes you to a site you do not want to visit.The Huns are at the gates, I tell you.

UPDATED 9-13-2012

A comment for another post is another clever variation of this that turned out to be a way to get clicks on a “survey” site as well as the video.

I'm having this exact problem with the video: http://www.youtube.com/(removed by me)  I've put one comment on the video site, but Youtube won't let me link your post as part of the explanation. So far, you are the only post that has tried to make sense of this stupid spam issue. Thanks for posting!

The identity of the commenter was “Ron” but the link to his profile is the afore mentioned survey at sprezzaturarrd . blgospot . com. Interesting development because it looks like they are aware of people trying to spread the word. Notice how the video gets another hyperlink via the comment?

Sadly they did get a couple of clicks out of me verifying the profile, but somebody has to take a look to see what is going on to warn others.

New YouTube Based Blog Referral Spam

Well that is interesting. The Russian spammers have come up with a new one that delivers up a YouTube video of a Grand Theft Auto 4 sequence. Why would they do that? Well, the account holder gets money from the ads that run before it plays. This is why you see pretty girls doing reply videos to just about every subject out there – they make a lot of money from people clicking on them.

So if you see youtube.com in your referring sites, do not click and enrich the Russian mob.

Another Blogger Referral Spammer: Pnarp

Yep, another one that has been around for awhile but keeps changing servers and countries. If you see any referrals from pnarp . com please do not click on them, there have been some reports of malware being automatically downloaded. Flicker users have also had problems with it in the past and other social media sites (Digg, Twitter, other blog services) have seen this joker show up too.

UPDATE 8-26-2012: 

Found another spammer, pregolom . com out of Russia. It does not appear to be related to pnarp, but it seems like there is a big uptick in referral spam lately.  It along with filmhill . com have been showing up in large numbers the past week.

Blogger Referral Spam and Twitter

After digging into my monthly stats on Blogger, a pattern emerged of links to apparently legitimate sites that really were not genuine. Instead, they used Twitter’s URL shortening service, T.co, to disguise the page. It turns out that some hits that I thought were real from stumbleupon.com were actually the exact same kind of spam as I previously wrote about here and here. Another falsified website referral using t.co I found was for cultek.com which is a biomedical company.

I have never liked link abbreviating services due to the amount of malicious code, pages, and photos they have been used for. Twitter has launched lawsuits and claim to be filtering how t.co handles links, but so far I am not impressed. It seems like services are always falling behind the black hats in cyberspace, so the moral of the story is for people to be very careful about what they click. Examine the entire link and be reluctant to click on a shortened one.

UPDATE:

Oh the irony. From the time I started writing this post to actually publishing it, another site with referral spam hit me, but not using t.co. This one is ultrafiles . net and is again out of Russia. The title of their website is Linkbucks . com and is another make money off of links site.

UPDATE: A day later, another fake link using devscripts.net and t.co, so the beat goes on.

UPDATE: July 31st brought a new falsified link using the same method, this time posing as myhealthscore.com.

UPDATE: Another one supposedly from filmhill.com that links to a video of how to get “lucky” using a fish. The absurdity is amazing and I am glad I have a little used browser in a sandbox to check these things.

Link Referral Spam from aptratings

One of the banes of blogging is link referral spam that is only visible to the website’s administrator, or in this case, the owner of the blog. Much of it comes from Russia and I note the rare occasions when a legitimate search from there lands on my blog. 99% of hits on the blog from Russia are from spammers.

The latest to come out of there is falsified links from aptratings . com, which poses as apartmentratings.com which is a real site of questionable reliability, but no spammer. They do this by having a banner link to the real site on top, but the content is a come on to make money by clicking on links or pushing links on social media sites. I suspect the fake site content changes from time to time, but do not want to waste time finding out.

The only ones making money off this are the people running that site in Russia, so do not fall for it. I have seen novice bloggers online getting excited to get linked to without realizing what it is really about. Sorry to burst your bubbles, but they randomly scour blogger looking for people to sucker in.

Then there are the post spammers, which is why you need to enable reviewing post before they are put up. One got by me this week when I missed with the mouse cursor and had to go delete it. Forget idle hands, shaky hands are really the devil’s plaything.

You will not get a virus from clicking on the referral spam, but you most likely will get more of it showing up in your stats in the control panel.