Showing posts with label spam alert. Show all posts
Showing posts with label spam alert. Show all posts

Tuesday, January 10, 2012

Domar.ru - its a referrar spam not actual traffic

Domar.ru is a domain name frequently shows up in the blogger stats pages as a referrer. A referrer is usually a website that the visitor comes from. But in this case there is no actual visitor, just a request for a visit. In short, a referral spam.

Referral spam is a method to get traffic to a domain by deception. I will try to explain with the help of an analogy.

A man goes to the coffee shop and orders a coffee but leaves the place before the order is served. Now his entry will be included in the orders list but wont make it to the bills. Referral spam is something like this. A website (like Domar.ru) will request your blog/ website but won't actually be there for receiving the page (the connection is terminated).

This request will be present in your server log files but it actually is no good to you as the page is not loaded. But the visit won't be logged in the stats of a third party traffic monitor ( like Google analytics, statcounter) as  their monitoring scripts will be executed only when the page is loaded. So there will always be a difference between the server logs and the traffic monitor logs.

I checked back the domar.ru URL and found the following things

1. The website is privately registered so details of ownership are hidden from public.

2. The website first get forwarded to a clickbank hop link ( which is a legitimate online marketing company and then to some video advertisement site about money making.

How does the referrer spamming work for the spammer?

They work in three ways

1. The web masters who check their server log files might click on the link to know how their sites are linked. And usually the spam URL that shows up in the server log files can be traced back to some advertising and the spammer gets free traffic from your clicks.

2. If you do any purchase from the referred site, the referrer ( spammer) gets the commission.

3. Search engines that crawl your site and might index the log file and by this the spammer get a free indexing at your cost (a link from you to a spam site is a bad thing in the eyes of search engine).

What should we do ?

1 What ever you do NEVER EVER click the link from your logs. The blogger referral links that might appear on their site actually has a number representing your blogger blog ( Though the blogs have names, they have numbers designated by BlogID. You can see that in the address bar when you access the blogger).

2 If you are admin of a self hosted website/blog, you can move the server log to a private location ( By default the file might be placed in a folder where search engine eyes have a reach). Alternatively you can edit your robots.txt file to exclude the server logs from getting crawled.

3 Use a third party traffic monitor like statcounter or google analytics - If you are a blogger user adding a google analytics script is easy. you just need to know the analytics site number.


Friday, April 29, 2011

Bieberwow.info is a spam/scam

This is an alert blog post. If you encounter any link containing bieberwow.info please don't click it. It is a scam/spam. Details are below.

Site of activity: Facebook.

Mode of Action : Likejacking ( making you 'like' a page without your direct consent).

Description : Posts a fake video in the news feed of the victim with a caption 'OMG - I can't believe Justin Bieber did this to a girl'. If you are a friend of the victim it will appear in your feed too. If any one clicks to view this video they will be redirected to a fake 'Security check' page which is specially designed as a look alike of Facebook for like-jacking.
The security check asks you to add up 2 and 3 and enter the result in an answer box. If you click on the answer box while being logged in to Facebook, congrats, you are clickjacked. A new news feed item will be posted in facebook on behalf of you with the same fake video and fake links.
So far there are no news of any private information being stolen by this spam.
Here is a screen-shot of the page  at bieberwow.info

You can see that the buttons look just as in Facebook.
What to do if you are like-jacked:  Just remove the post from your news feed. This way you will be rendered non-contagious.

Prevention : The spam can work only if you click the fake page while being logged into facebook. If you have already logged out, you are safe. Do not click any link that shows bieberwow.info in the target. Also turning off the javascript might help. Sorry that I am not a techie to say the last one for sure.

History: This is the rebirth of a previous click-jacking attempt using Justin Bieber's name. The first attempt was titled 'I can't believe a girl did this to Justin Bieber'. It affected about 20000 facebook users before being contained by facebook staff. I am not sure about the involvement of bieberwow.info site in the previous attack. But I think the redirect was to a different site.