TOPSITES Referrer Spam up my nerves
I’m a webmaster and have been working online since 1998. In my 12 years of experience, I have seen and dealt with different types of spam. When we talk about spam, the first thing that comes to our mind is “email spam” which is the most common type of spam that we have been dealing with since years. But I’m not sure, how many people have heard about referrer spam which is not really new to the eworld but it is certainly on the high. That is something I have been experiencing and dealing with since last couple of years. Since there is control over other kinds of spam and webmasters are taking precautionary measures, spammers have come up with a new kind of spam called referrer spam which is definitely on the high these days. So, what is referrer spam?
In this competitive online world, webmasters have implemented all sorts of tracking to track website visitors and customers. I am using two different tracking engines: the ole popular Statcounter and the new champ Clicktale web analytics. I’m very careful about what sort of visitors spend time on my website. I use Statcounter for basic tracking. But, if I find anything suspicious, I dig it with the Clicktale web analytics and find out if certain visitor activity on my site indicates spam, I BLOCK it immediately.
Lately, I found some specific type of referrer spam on my website. There may be many who already know what I’m talking about, but for those who are still in the blues, when I say referrer spam, it means that when I check my web traffic, I see the referring URL of the website from where a visitor landed on my site. Lately, I have noticed an increasing trend of referring URLs that have nothing to do with my website. Also, when I visit these referring URL/pages, I don’t see anything that points or links to my website. So, I believe, spammers are using some software to pretend that someone visited my website from a link on their website. Generally, I see this type of referrer spam from these websites:
besome1.info/TOPSITES
buyaccupril.info/TOPSITES
blackhatbootcamp.com/blog/TOPSITES
blackhatbootcamp.com/blog/scTOPSITES
www.fileradar.net/users/edit/41720
And the defaulting IP addresses of these spammers are:
60.217.248.153
125.60.243.52
202.108.50.69
123.125.156.135
125.60.243.52
123.125.156.143
123.125.156.131
123.125.156.142
202.108.50.75
200.25.218.249
64.186.132.32
202.108.50.71
Needless to say, all of them are blocked through my .htaccess file. THEY ARE BANNED and THEY ARE BLACKLISTED!
Most of these spammers are from China and Philippines. Sometimes I feel like blocking ranges of IP addresses from China and Philippines, however, I believe that’s a little too harsh for those who are on the good side of the picture. So, for now, I have these IP addresses on the block list so that when they try to do something stupid like referrer spoofing or gain unauthorized access to my website, they are shown the exit door. There you go, away from my website!
So, the question comes to my mind, what are these spammers doing on my website? Why are they sending so much referrer spam to my website? As far as these questions are concerned, the answer comes from my Clicktale logs. The logs show the time duration these spammers (or the spamming software) spent on my website. Also, the logs clearly show a bot activity that is coming from China. All this indicates that someone may be trying to get unauthorized access to my website. So this referrer spam is nothing but referrer spoofing, an attempt to get access to my website.
So there goes a question that I did like to ask who ever reads this article: How do you control this referrer spam? My traffic is going down since the time I have noticed this referrer spam on my website. Are you experiencing this too? One way to block referrer spam is by using the “allow, deny” feature in .htaccess file. Is there any other way to block referrer spam? Please discuss what do you do to kick off referrer spammers off your blog/website.
UPDATE: Update on this article. Author Dave owner of Blograte Directory busted this referrer spammer in this article: BlackHatBootCamp.com Busted Referrer Spamming DP Members. Good job Dave for busting the culprit.
UPDATE: As per John B’s comment, More information about this spammer can be found at the Code4gold forums where members have collected good information on this referrer spammer.
Processing your request, Please wait....
admin
sharecommon
sharecommons
andy
daveklien
January 30th, 2010 on 6:54 pm
Hmm thats interesting. I saw some referrer spam on my website too. I use Clicktale analytics too. So we have more than one thing in common lol. Thanks for listing the IP addresses of the spammers. This is what I did in my .htaccess file:
order allow,deny
deny from buyaccupril.info
deny from blackhatbootcamp.com
deny from besome1.info
deny from 60.217.248.153
deny from 125.60.243.52
deny from 202.108.50.69
deny from 123.125.156.135
deny from 125.60.243.52
deny from 123.125.156.143
deny from 123.125.156.131
deny from 123.125.156.142
deny from 202.108.50.75
deny from 200.25.218.249
deny from 64.186.132.32
allow from all
So, that ensures all the bastards are blocked from accessing my website. Two words for all those spammers out there: YOU SUCK!
February 1st, 2010 on 6:08 pm
Appreciate the info! Thanks!
February 2nd, 2010 on 10:24 pm
Good info, I’m getting lots of referrer spam from this idiot. I have a few blogs and I’m a member at DP. I guess, Dave’s article says it all, they are targeting DP members. Hell, I thought they were picking up websites randomly. ok, they are blocked from my sites too.
February 2nd, 2010 on 11:22 pm
He is referrer spamming my blog too. Such an asshole!
Found some useful info at Code4gold forums too where people are discussing this stupid spammer.
February 14th, 2010 on 7:29 pm
Hey, I’m getting that referral stuff too from china and the “buy accupril”, I wasn’t sure why, but after reading your post, I see that it is some kind of weird spam junk. I just wanted to add a note to your info. I’m getting this referral from sunshinealley.info/ ALSO! They have some kind of frame that lists random sites gathered from alexa…. the main part of the page offers you A TIME FOR A CHANGE, then serves up some half dressed hoze. I’m not smart enough to do the htaccess thing, let alone create an even better way to deal with them. I would appreciate it if you would send me a little snippet of text to put in the htaccess and tell me where to list it. Thank you so much!
February 14th, 2010 on 7:44 pm
Hi Joygoround,
I know there are many webmasters doing this stupid stuff thinking they can get some quality traffic by referrer spamming other’s sites. Anyway, they are idiots who do all this sort of referrer spam.
This is what you need to do ..
If you have a .htaccess file on the “root” of your website, then edit it. Otherwise, create a text file on your computer, upload it to your server and then rename it .htaccess.
Now that we know that you have a .htaccess file, look for the line that says:
order allow,deny
If you see it, then simply copy and paste what Michael Velch posted in his comment, below the order allow, deny line.
If you don’t see any order allow, deny in your .htaccess file, then simply go to the end of the file and paste this ..
order allow,deny
deny from buyaccupril.info
deny from blackhatbootcamp.com
deny from besome1.info
deny from unshinealley.info
deny from 60.217.248.153
deny from 125.60.243.52
deny from 202.108.50.69
deny from 123.125.156.135
deny from 125.60.243.52
deny from 123.125.156.143
deny from 123.125.156.131
deny from 123.125.156.142
deny from 202.108.50.75
deny from 200.25.218.249
deny from 64.186.132.32
allow from all
Save it and upload it to your server. Job done!
February 21st, 2010 on 11:28 am
[...] posted a solution (and explination) of this on Webmasters Share Commons. He says: Most of these spammers are from China and Philippines. Sometimes I feel like blocking [...]
February 24th, 2010 on 3:46 am
I’m not a member of Digital Point, so its not just their members that they are targetting.
February 24th, 2010 on 3:55 am
Hi B Walker,
Don’t think it is only DP members they are targeting. The noob spammer is targeting 3 of my blogs. I see their referrer spam every day. The idiot doesn’t have anything better to do so doing all this stupid stuff. This idiot spammer must be some lowlife newbie who wishes to get rich quickly. So the sucker is desperate to earn by any means.
If the spammer is reading this, hay “KISS MY ASS” .. You ain’t going to earn shit out of me!
March 7th, 2010 on 8:36 am
These Chinese bastards are sending these spams to our site too…. what ever they want, but we don’t want any traffic from china…..huh .
Thanks guys for providing ips, i am going to block them all…. nice sharing
April 19th, 2010 on 6:14 am
There is a new idiot spammer who is spamming my blogs/websites.
The referrer spam is coming from this page: http :// www. qq829.com/web_stat.asp?dn=www.mywebsite.com
The whois shows …
Domain Name………. qq829.com
Creation Date…….. 2009-08-29 14:55:49
Registration Date…. 2009-08-29 14:55:49
Expiry Date………. 2010-08-29 14:55:49
Organisation Name…. jia hai feng
Organisation Address. cangzhouhejian
Organisation Address.
Organisation Address. cangzhou
Organisation Address. 454950
Organisation Address. HE
Organisation Address. CN
Admin Name……….. jiahaifeng
Admin Address…….. wuzhixiandahongqiao
Admin Address……..
Admin Address…….. jiaozuo
Admin Address…….. 454950
Admin Address…….. HA
Admin Address…….. CN
Admin Email………. jiahaifeng.love@163.com
Admin Phone………. +86.3917413968
Admin Fax………… +86.3917413968
Tech Name………… Li hengao
Tech Address……… zhengzhou
Tech Address………
Tech Address……… Zhengzhou
Tech Address……… 450000
Tech Address……… HA
Tech Address……… CN
Tech Email……….. agent14719@agent.dns.com.cn
Tech Phone……….. +86.37163659520
Tech Fax…………. +86.37163659519
Bill Name………… Li hengao
Bill Address……… zhengzhou
Bill Address………
Bill Address……… Zhengzhou
Bill Address……… 450000
Bill Address……… HA
Bill Address……… CN
Bill Email……….. zhl_987@163.com
Bill Phone……….. +86.37163659520
Bill Fax…………. +86.37163659519
Name Server………. ns2.dns.com.cn
Name Server………. ns1.dns.com.cn
This bastard is referrer spamming through qq829.com and found him visiting my sites regularly. But as I visit his/her website, I don’t see any links that point to my websites. Another LOSER on the block.