Author

Analytics is my profession

SEO my passion

User Experience my obsession

Follow me on
Difficulty |

How to prevent fake traffic like "Secret.ɢoogle.com-Trump"

Over the last couple of years, we’ve seen pretty weird things showing up in Analytics but nothing like this. Spammers are using now the language field, a fake Secret.ɢoogle.com domain and even a message supporting Trump! This is the complete message:

Secret.ɢoogle.com You are invited! Enter only with this ticket URL. Copy it. Vote for Trump!

Vitaly targeting legit sites
And if that is not enough, they have been targeting legit websites like TNW, Mashable, Mozabc.xyz, and many more.
What is "Secret.ɢoogle.com"?

What is "Secret.ɢoogle.com"?

Look carefully! What you are seeing is not google.com, but ɢoogle.com with a latin small capital ɢ letter, which makes it a totally different domain!

Secret.ɢoogle.com is a domain owned by Vitaly Popov, a well-known Analytics spammer. If you access that URL you will get to Vitaly's personal search engine, which is usually under the domain ilovevitaly.com. You may have seen it on your reports as well. The full URL used to redirect you to this long URL:

http://money.get.away.get.a.good.job.with.more.pay.and.you.are.okay.money.it.is.a.gas.grab.that.cash.with.both.hands.and.make.a.stash.new.car.caviar.four.star.daydream.think.i.ll.buy.me.a.football.team.money.get.back.i.am.alright.jack.ilovevitaly.com/#.keep.off.my.stack.money.it.is.a.hit.do.not.give.me.that.do.goody.good.bullshit.i.am.in.the.hi.fidelity.first.class.travelling.set.and.i.think.i.need.a.lear.jet.money.it.is.a.secret.%C9%A2oogle.com/#.share.it.fairly.but.dont.take.a.slice.of.my.pie.money.so.they.say.is.the.root.of.all.evil.today.but.if.you.ask.for.a.rise.it's.no.surprise.that.they.are.giving.none.and.secret.%C9%A2oogle .com

The text on it may look familiar because it is part of the lyrics of Money by Pink Floyd. (Note: The scammer may change the redirection path)

Just as you enter one of his sites, a similar message to the one in the fake language will pop up:

Secret.ɢoogle.com with choice, Lucky button, shops and torrents from Vitaly Popov from Russia with love and congratulations to all americans! Trump, you did it!

What is "Secret.ɢoogle.com"
Who is Vitaly Popov and What does He Have to Do with Your Analytics?

Who is Vitaly Popov and What does He Have to Do with Your Analytics?

Vitaly is a Pro-Trump Analytics expert known for being the first person to use Ghost Spam, a technique that is used to send fake traffic to thousands of Analytics properties through the Measurement Protocol.

You've probably seen fake traffic from him in many parts of your Analytics reports. Vitaly acknowledged publicly that he was behind some of these hits, stating that he is not breaking any law, but only using "creative marketing."

Vitaly Popov Author of the spam Secret.ɢoogle.com ... Vote for Trump
Vitaly Popov on blackmoreops.com

His main purpose is to promote his sites, but he also uses it to fool around with phrases that doesn't make much sense. In his most recent appearance, he even used it to show his preference on the 2016 elections in the USA, only this time using the fake language.

He is so proud of it, that he shares it on the title of his pages:

Secret.ɢoogle.com voted for Trump by all my scripts, every my byte, in tens of millions google analytics accounts

He probably refers to the automated scripts he uses to send fake traffic to "millions" of Google Analytics accounts. This new approach is making a lot of noise in the Analytics community.

However, independently of his purpose and who he supports, what really matters here is that your analytics are getting polluted by this fake traffic, so I will show you how to block not only this but all the junk in your Analytics.

How to Stop All Fake Traffic like Secret.ɢoogle.com in Analytics

The approach I suggest you is a little different from what is commonly shared. Instead of going after each spammer, I will help you stop all future attacks, no matter what name they use or if it shows up as a referral, keyword, page, language, etc, plus I will also show you how to clean it from your historical data.

If you don't want to deal with this, I can personally apply this to your Analytics to keep away all junk traffic, plus I can make sure everything is set up correctly (code, settings, filters...)

If you prefer you can apply these solutions yourself by following this comprehensive guide to cleaning and blocking Google Analytics Spam.

Characteristics of the fake traffic

Characteristics

These are some characteristics that the fake traffic from ilovevitaly.com shares. Metrics like Bounce Rate and Avg. Session time can be manipulated to look normal.

Hostname used: many fake hostnames, sometimes your domain Landing page: secret.google.com or the URL of the referral
Bounce Rate: close to 100% Page Title: it shows the name of the referral
Avg. Session time: close to 0 seconds Location/Country: Mainly Russia
Redirection to xn--oogle-wmc.com  

The URL ɢoogle.com can also be seen as secret.xn--oogle-wmc.com

Fake Hostnames and referrals used

Fake referrals used

Vitaly is also targeting legit websites like thenextweb.comabc.xyz, and techcrunch.com

Known sites targeted by Secret.ɢoogle.com

Other fake referrals used:

List of fake referrals and page titles
alfabot.xyz referral bukleteg.xyz  page title and referral bank-rot.xyz  page title and referral
arendovalka.xyz  page title and referral abcdefh.xyz  referral aptechko.xyz  referral
abcdefgi.xyz referral bezlimitko.xyz  page title and referral begalka.xyz  page title and referral
biteg.xyz  page title and referral boltalko.xyz  page title and referral webmasters.stackexchange.com
brateg.xyz  page title and referral budilneg.xyz  page title and referral buketeg.xyz  page title and referral
abc.xyz page title and referra    

Besides these two referrals, the scammer has been using the name of other well-known sites as a hostname.

List of fake hostnames used
domains.google analytics.google.com adwords.google.com
apple.com mail.google.com reddit.com
secret.google.com mashable.com moz.com
books.google.com www.telegraph.co.uk  

List of pages titles

  • Page title: Secret.ɢoogle.com
  • Page title: webmasters.stackexchange.com/questions/101473/message-secret-%C9%A2oogle-com-showing-in-google-analytics-language-column
Author

Analytics is my profession

SEO my passion

User Experience my obsession

Follow me on
Be the first to comment :)