Scams

The Latest: The most recent news from WordPress are posted here. If this subject is new to you, read what follows first.

*  *  *

This is an insider matter of no interest to those who don’t blog on WordPress, but it may be of interest to other WordPress bloggers. I’ve noticed an unusual increase in hits on this blog. WordPress helpfully provides addresses of “referrers” and the number of hits coming from each. Of late these have multiplied, but when I click through to see who might be sending referrals and in what context, I end up on sites that seem to have (1) zero relationship to subjects covered on LaMarotte and (2) do not show any kind of link either to LaMarotte or any of the posts on it. Indeed, clicking twice on the same address produces two different sites, each one advertising something else. If I went on clicking, no doubt other sites yet would show up.

This morning, for instance, I noticed 17 incoming hits from an address called malamkupertama.co.cc/blog.15-useful-wordpress-tips-to-make-your-theme-even-better.php. This address has taken me successively to a dieting site and then to Amazon.com. No entity called malamkupertama.co seems to exist on the web, not according to Google or Bing. There is a blog entry on 15-useful-wordpress-tips etc.—and it actually does presents tips. Eventually I discovered that the words malam ku pertama is Indonesian for the phrase “my first night.” The same referrer, by the way, also referred some 15 people to a post on my other WordPress site, Borderzone—which has a radically different scope. In both cases, of course, what actually came to the sites may not have been people at all, just little electronic bacteria doing their things. Somebody is messing around with the common good again!

Bloggers feel good when traffic suddenly picks up—but what if it is simply a scam to cause the blogger to click through to ads? The coherence of viewer statistics is thereby destroyed. These aren’t readers. These are algorithms designed to create phony hits, of no use anyone but producing phony emotions in those who get the seemingly real attention. I will attempt to notify WordPress of this and hope I manage to get through to someone human.

Anyone who knows something is welcome to comment—on this blog or by e-mail.

Added later: I discovered the way to report this sort of thing to WordPress. The link to their support site is here. They give you a form. Pick a topic from a list first. I chose the topic Traffic. Then answer their questions. If you want to report the same malefactor as I have, you can copy its long name from my site first.

Added January 31. The problem is morphing, and if WordPress has a fix to specific invaders, that fix is not generic. This morning’s invader on my site is jejakajambu.co.cc/blog.15-useful-wordpress-tips-to-make-your-theme-even-better.php. I’ve also learned that these referrer spams serve the interests of an outfit called adf-ly, an advertising server. A commenter to my follow-up posting, above, reports yet another version: kekasihgelapku .co.cc/blog.15-useful-wordpress-tips-to-make-your-theme-even-better.php.

Added February 1. Although yet another variant of the spam referrer surfaced today, as I’ve learned from comments, it did not show up on my site. The largest number of referrals on my site from a single source was 3.

Added February 2. Yesterday blogger joepzander reported another version, kakakphuru.co.cc and the all the rest of it. Today ranting rambler reports another one, adakukisah.co.cc etc.  That one showed up on my site too. I’ll notify WordPress, hoping that they’ll eventually put on the big boots to stomp these guys out.

I learned from TimeThief in a forum (her site is here) that WP staff advise the following: (1) If you get one of these spam referrers, DO NOT click on the link. The spammer wants you to click through, and if he/she/it fails to get hits, that’s good for us and bad for him/her/it. (2) If you mention the spammer in a blog or comment, DO NOT use its full address; follow the abbreviated reference as in the paragraph above. (3) Notify WP staff when new versions appear. And (4) WP staff is working on a solution. Thanks to all of you who’ve taken the time to notify WP.

Added February 3. This is getting tedious. The new one today is kenabanlagi.co.cc. WordPress staff notified me that they want to hear about these. They remove them, but evidently only after having heard of them. Time elapses. My spammer yesterday was there all day long although my notification to WP took place in the morning.

What WordPress ought to do—a major undertaking—is continuously to search for a pattern on all blogs, thus, in this case, on the 15-useful-wordpress-tips-to-make-your-theme-even-better phrase. As soon as this pattern is found, the incoming should be removed. This should be automated. The spammer will then change the phrase, and so it will go on. Spy vs. Spy, it seems to me. If the sender cannot be identified by its originating electronic address—and only by blog users’ own eyes—this will never end. WordPress will always be hours behind and hit counts will continue to be inflated.

Added February 4. The intruder has morphed, big-time this time. The leading phrase is now takbisakah.co.cc/blog/. This is then followed by a very long string of other words, no longer the 15-useful-wordpress-tips etc. Expected something like that—as I said in my comments yesterday. Wearily, I’m about to report this to WordPress again.

Added February 5. WordPress staff (Mark) sent a message to all those who reported on the successive referrer spams. Mark’s comments in part follow:

Hi,
I am sending this to quite a few people so I apologise for the lack of a personal reply.

First, thanks for reporting the full blog urls. These are blocked and you should not see them again.

This is a very hard problem to deal with and based on the last 5 years dealing with spam, here is what I think is happening:

1. A spammer finds a lax domain registrar or makes a deal with  a less than scrupulous one.
2. Spammer buys a large number of sites
3. They then fill those spam sites with ads or possibly malware
4. Spammer then spams thousands of websites.
- so far he will have bought the domains using a program and put all the ads on using a program so the effort involved is tiny.
5. Spammer hopes people follow those links back to his site.
- because his costs so far are small it only takes a few purchases through ads to make money. If the site is serving malware then payment per successful infection is made.
6. Spammer then gives the domains back to the registrar within the accepted time-limit and gets a full refund.
- if you buy a domain through wordpress.com you can cancel within 2 days. A dodgy registrar might allow longer but it’s still a short amount of time. That’s why they move fast.
So it’s all profit.

Mark comments that operations of this type are outside of WordPress’ control and simply stopping the process—that they cannot do. “But we can and do block every domain that gets reported, and again thanks for doing so because it helps everyone else too.” The emphasis is mine.

I appreciated getting this message. The spammers also disappeared from my site.

Update on Feburaryn 12. This update also appears as part of Scam Follow Up. I have not had any more referrer spams since and including February 6. One commenter to my follow-up post (helmiismail42) claims to be the spammer. I forwarded his/her/its message to WordPress technical staff too.

Added March 4. The menace is back, this time it is called cinabeng and it carries the phrase “justin-timberlake-car-accident” in the incoming address. I’ve notified Word Press again.

Advertisement