Author

Analytics Expert. Passionate about SEO and User Experience or what he calls UX-SEO

Follow me on

How to prevent spam like "Secret.ɢoogle.com-Trump" and "Vitaly rules google"

UPDATE (December 2): The spammer is sending fake referrals linking to posts talking about him. 

If you want a bit of background (what, who, why) keep reading, if you just want to get rid of it, you can jump directly to the solution.


Over the last couple of years, we’ve seen pretty weird things showing up in Analytics but nothing like the spam that is being used now. It's not only that this new spam is sent as a language, instead of the common referrer spam, but also it has a fake secret Google domain and even a message supporting trump for the past elections!

Secret.ɢoogle.com You are invited! Enter only with this ticket URL. Copy it. Vote for Trump!

Vitaly targeting legit sites
Besides that, the spammer has been adding messages in the language HTTP header to mock Google.

And if that is not enough, he has been targeting legit websites like blackhatworld.com, tnw, mashable, moz, and abc.xyz.

What is "Secret.ɢoogle.com"?

What is "Secret.ɢoogle.com"?

Look carefully! What you are seeing is not google.com, but ɢoogle.com with a latin small capital ɢ letter, which makes it a totally different domain!

Secret.ɢoogle.com is a domain owned by Vitaly Popov, a well-known Analytics spammer. If you access that URL you will get to Vitaly's personal search engine, which is usually under the domain ilovevitaly.com. You may have seen it on your reports as well. The full URL you get redirected to after accessing the site, looks like this:

http://money.get.away.get.a.good.job.with.more.pay.and.you.are.okay.money.it.is.a.gas.grab.that.cash.with.both.hands.and.make.a.stash.new.car.caviar.four.star.daydream.think.i.ll.buy.me.a.football.team.money.get.back.i.am.alright.jack.ilovevitaly.com/#.keep.off.my.stack.money.it.is.a.hit.do.not.give.me.that.do.goody.good.bullshit.i.am.in.the.hi.fidelity.first.class.travelling.set.and.i.think.i.need.a.lear.jet.money.it.is.a.secret.%C9%A2oogle.com/#.share.it.fairly.but.dont.take.a.slice.of.my.pie.money.so.they.say.is.the.root.of.all.evil.today.but.if.you.ask.for.a.rise.it's.no.surprise.that.they.are.giving.none.and.secret.%C9%A2oogle .com

The text on it may look familiar because it is part of the lyrics of Money by Pink Floyd. Just as you enter the spammer's site, a similar message to the one in the fake language will pop up:

Secret.ɢoogle.com with choice, Lucky button, shops and torrents from Vitaly Popov from Russia with love and congratulations to all americans! Trump, you did it!

What is "Secret.ɢoogle.com"
Who is Vitaly Popov and What does He Have to Do with Your Analytics?

Who is Vitaly Popov and What does He Have to Do with Your Analytics?

Vitaly was the first person to use Ghost Spam. This technique uses the Measurement Protocol to send fake traffic to thousands of Analytics properties. You've probably seen spam from him and other spammers using this method in many parts of your Analytics reports, whether it be a referral, keyword, landing page, and even as a page title.

A couple of years ago when all the spam madness started, Vitaly acknowledged publicly that he was behind some of these, stating that he is not breaking any law, but only using "creative marketing."

Vitaly Popov Author of the spam Secret.ɢoogle.com ... Vote for Trump
Vitaly Popov on blackmoreops.com

His main purpose is to promote his sites, but he also uses it to promote phrases that don't make much sense, like: "ghost spam is free from the politics." In his most recent appearance, he even used it to show his preference on the 2016 elections in the USA, only this time using the fake language you see. He is so proud of it, that he shares it on the title of his pages:

His main purpose is to promote his sites, but he also uses it to fool around with phrases that doesn't make much sense, like: "ghost spam is free from the politics." In his most recent appearance, he even used it to show his preference on the 2016 elections in the USA, only this time using the fake language.

He is so proud of it, that he shares it on the title of his pages:

Secret.ɢoogle.com voted for Trump by all my scripts, every my byte, in tens of millions google analytics accounts

He probably refers to the automated scripts he uses to send spam to "millions" of Google Analytics accounts. This new approach is making a lot of noise in the Analytics community.

However, independently of the purpose of the spammers and who he supports, what really matters here is that your analytics are getting polluted by this fake traffic, so I will show you how to block not only this but all the spam in your Analytics.

Beware Secret.ɢoogle.com is Not Google! Who is Behind It and How to Get Rid of It in Google AnalyticsClick To Tweet

How to stop Secret.ɢoogle.com and any other spam

Instead of playing whack-a-mole with the spammers, I will show you an efficient way of preventing fake traffic on Google Analytics. These combinations of filters will permanently block all ghost traffic, no matter what name it uses or if it shows up as a referral, keyword, page, language, etc.

Below you will find a free guide so you can apply this solution by yourself. If you don't have the time or the sufficient technical knowledge, I can personally set everything you need to keep away all ghost traffic from your Analytics. Contact me for more information!

Characteristics of the spam

Characteristics

These are some characteristics that the fake traffic from ilovevitaly.com shares. Metrics like Bounce Rate and Avg. Session time can be manipulated to look normal.

Hostname used: many fake hostnames, sometimes your domain Landing page: secret.google.com or the URL of the referral
Bounce Rate: close to 100% Page Title: it shows the name of the referral
Avg. Session time: close to 0 seconds Location/Country: Mainly Russia
Redirection to xn--oogle-wmc.com  

The URL ɢoogle.com can also be seen as secret.xn--oogle-wmc.com

Fake Hostnames and referrals used by the Spammer

Fake referrals used

The spammer is targeting also legit websites like thenextweb.comabc.xyz, and techcrunch.com

Known sites targeted by Secret.ɢoogle.com

Other fake referrals used:

List of fake referrals and page titles
alfabot.xyz referral bukleteg.xyz  page title and referral bank-rot.xyz  page title and referral
arendovalka.xyz  page title and referral abcdefh.xyz  referral aptechko.xyz  referral
abcdefgi.xyz referral bezlimitko.xyz  page title and referral begalka.xyz  page title and referral
biteg.xyz  page title and referral boltalko.xyz  page title and referral webmasters.stackexchange.com
brateg.xyz  page title and referral budilneg.xyz  page title and referral buketeg.xyz  page title and referral
abc.xyz page title and referra    

Besides these two referrals, the spammer has been using the name of other well-known sites as a hostname.

List of fake hostnames used
domains.google analytics.google.com adwords.google.com
apple.com mail.google.com reddit.com
secret.google.com mashable.com moz.com
books.google.com www.telegraph.co.uk  

List of pages titles used by the spammer

  • Page title: Secret.ɢoogle.com
  • Page title: webmasters.stackexchange.com/questions/101473/message-secret-%C9%A2oogle-com-showing-in-google-analytics-language-column
  • Page title: "Vitaly rules google"
Author

Analytics Expert. Passionate about SEO and User Experience or what he calls UX-SEO

Follow me on
Be the first to comment :)