How to prevent fake traffic like "Secret.ɢoogle.com-Trump"
Over the last couple of years, we’ve seen pretty weird things showing up in Analytics but nothing like this. Spammers are using now the language field, a fake Secret.ɢoogle.com domain and even a message supporting Trump! This is the complete message:
Secret.ɢoogle.com You are invited! Enter only with this ticket URL. Copy it. Vote for Trump!
And if that is not enough, they have been targeting legit websites like TNW, Mashable, Moz, abc.xyz, and many more.
What is "Secret.ɢoogle.com"?
Look carefully! What you are seeing is not google.com, but ɢoogle.com with a latin small capital ɢ letter, which makes it a totally different domain!
Secret.ɢoogle.com is a domain owned by Vitaly Popov, a well-known Analytics spammer. If you access that URL you will get to Vitaly's personal search engine, which is usually under the domain ilovevitaly.com. You may have seen it on your reports as well. The full URL used to redirect you to this long URL:
The text on it may look familiar because it is part of the lyrics of Money by Pink Floyd. (Note: The scammer may change the redirection path)
Just as you enter one of his sites, a similar message to the one in the fake language will pop up:
Secret.ɢoogle.com with choice, Lucky button, shops and torrents from Vitaly Popov from Russia with love and congratulations to all americans! Trump, you did it!
Who is Vitaly Popov and What does He Have to Do with Your Analytics?
Vitaly is a Pro-Trump Analytics expert known for being the first person to use Ghost Spam, a technique that is used to send fake traffic to thousands of Analytics properties through the Measurement Protocol.
You've probably seen fake traffic from him in many parts of your Analytics reports. Vitaly acknowledged publicly that he was behind some of these hits, stating that he is not breaking any law, but only using "creative marketing."
His main purpose is to promote his sites, but he also uses it to fool around with phrases that doesn't make much sense. In his most recent appearance, he even used it to show his preference on the 2016 elections in the USA, only this time using the fake language.
He is so proud of it, that he shares it on the title of his pages:
Secret.ɢoogle.com voted for Trump by all my scripts, every my byte, in tens of millions google analytics accounts
He probably refers to the automated scripts he uses to send fake traffic to "millions" of Google Analytics accounts. This new approach is making a lot of noise in the Analytics community.
However, independently of his purpose and who he supports, what really matters here is that your analytics are getting polluted by this fake traffic, so I will show you how to block not only this but all the junk in your Analytics.
How to Stop All Fake Traffic like Secret.ɢoogle.com in Analytics
My approach to dealing with the spam in Analytics is a little different and far more efficient from what is commonly shared. Instead of going after each spammer, I will show you how to stop all future ghost attacks, no matter what name they use or how it shows (referral, keyword, page...). Plus I will also show you how to clean it from your historical data.
To help you implement these solution, I prepared this step by step guide to prevent spam in Google Analytics.
If you don't have the time to deal with this, I can personally review and configure everything your Analytics needs to protect your data from spam and other junk traffic.
These are some characteristics that the fake traffic from ilovevitaly.com shares. Metrics like Bounce Rate and Avg. Session time can be manipulated to look normal.
|Hostname used: many fake hostnames, sometimes your domain||Landing page: secret.google.com or the URL of the referral|
|Bounce Rate: close to 100%||Page Title: it shows the name of the referral|
|Avg. Session time: close to 0 seconds||Location/Country: Mainly Russia|
|Redirection to xn--oogle-wmc.com|
The URL ɢoogle.com can also be seen as secret.xn--oogle-wmc.com
List of fake referrals by this spammer
- Vitaly rules google ☆*:｡゜ﾟ･*ヽ(^ᴗ^)ﾉ*･゜ﾟ｡:*☆ ¯\_(ツ)_/¯(ಠ益ಠ)(ಥ‿ಥ)(ʘ‿ʘ)ლ(ಠ_ಠლ)( ͡° ͜ʖ ͡°)ヽ(ﾟДﾟ)ﾉʕ•̫͡•ʔᶘ ᵒᴥᵒᶅ(=^ ^=)oO
Vitaly is also targeting legit websites like thenextweb.com, abc.xyz, and techcrunch.com
Other fake referrals used:
|List of fake referrals and page titles|
|alfabot.xyz referral||bukleteg.xyz page title and referral||bank-rot.xyz page title and referral|
|arendovalka.xyz page title and referral||abcdefh.xyz referral||aptechko.xyz referral|
|abcdefgi.xyz referral||bezlimitko.xyz page title and referral||begalka.xyz page title and referral|
|biteg.xyz page title and referral||boltalko.xyz page title and referral||webmasters.stackexchange.com|
|brateg.xyz page title and referral||budilneg.xyz page title and referral||buketeg.xyz page title and referral|
|abc.xyz page title and referral||%E1%B8%B7.com||xn--mhg.com|
Besides these two referrals, the scammer has been using the name of other well-known sites as a hostname.
|List of fake hostnames used|
List of pages titles
- Page title: Secret.ɢoogle.com
- Page title: webmasters.stackexchange.com/questions/101473/message-secret-%C9%A2oogle-com-showing-in-google-analytics-language-column