Saturday, May 18, 2013

Topblogstories Referral Spam

Another round of spam has hit the blog stats page and this time it is a link to a purported hookup service for the sexually desperate. Okay, it doesn’t say that, but that’s how I view it.

topblogstories . com / led me to this page:

Link to NSFW screen capture, but not pornographic image.

topblogstories . com / 18331&c=3 led to virtually the same page:

Link to NSFW screen capture, but not pornographic image.

Notice the javascript coding picks up where your IP is from. I suspect false advertising given the number of breasts promised.

As usual, do not click on the referrals! I hope your mother warned you about these kinds of girls…

…and hopefully you will warn others about these kinds of spam.

UPDATE: The first link now leads to a topless photo. It may be that they rotate them, but be warned it is now very NSFW!

UPDATE 2: Seeing another round of it with a small variance. Persistent, aren’t they?

topblogstories . com / 7293&c=6

UPDATE 3: Thanks to the efforts of commenter Edgar Bangkok there are more details on the spammers, both methods and probable location in Ukraine. He’s posted detailed analysis at his blog in two posts:

The first one shows how javascript is used on the webpage.

The second post drops shows the topblogstories spammers are now targeting Google Analytics and shows sublinks going to AdultFriendFinder and Damned Love.

If you don’t read Italian, you’ll need to use a translation service such as Google Translate to read his posts.

19 comments:

Anonymous said...

Thanks Patrick. My Mum told me never to speak to strangers but I'll make an exception as this saved me potential embarrassment. Regards, Tim

IndrÄ— said...

What to do if i clicked?? I didn't knew from the name it's porn page. Will I get them come back again??? :( contact me I you have any solution.

Anonymous said...

I didn't click on the link in my stats but I did Google it and that brought me to this post.
I am wondering if there is anyway of blocking that referring site?
Regards.
:D

Anonymous said...

Unfortunately, I wasn't that lucky :). Yes, I took a chance and went to the link, damn I was at library. Do you have any idea how to stop it from happening? Thanks

Patrick D. Boone said...

If you clicked link, the best thing you can do is delete your cookies and browsing history in the web browser you used. Depending on the browser you can even choose to delete recent browsing history by hours, days, etc.

In Firefox, go to Tools - Options - Privacy then click on clear your recent history.

In Internet Explorer go to Tools - Delete Browsing History

In Opera go to the Opera button at the top left, choose Settings - Delete Private Data

In Safari choose the Gear icon, Preferences - Privacy then click on Remove All Website data

WARNING: Some of these options will delete your passwords and login information for websites and forums. Make sure you know your passwords before doing this!

Patrick D. Boone said...

Indre - The spammers will come back to your blog no matter what you did (or didn't) do. The software they are using is automated and even hits brand new blogs nobody has ever visited.

There is not much you can do about blocking these sites, they often pop up quickly and are gone again in a matter of a few months. Others do manage to stick around.

All we can do is complain to Google to filter out the false results on our Blogspot stats page. The best way to avoid them is to use another free service such as Google Analytics or Statcounter to track visits to your blog. Their filtering is vastly better!

Anonymous said...

Thanks for the info. Unfortunately, I had clicked on the "topblogstories" in my stats without giving it a thought. I won't do that again! I've now deleted the cookies and browsing history on the 2 browsers I use. Hopefully, that will help with any further issues.

Victoria said...

Hi, I clicked on the link as I'm new to blogging and didn't think about things like that, is it some kind of virus? Mine went to a weight loss website? Thanks!

Patrick D. Boone said...

Victoria - I checked the site out again and it is the same one, though they now have a nude up making it very NSFW. Might you have clicked on the current . com spam instead?

As far as I can tell there is no virus embedded in the page, by the way. Since I'm not willing to explore further, I can't say if deeper links in the site contain malware.

Unknown said...

I have my blog stats spammed with links referer at Topblogstories I write little analysis about this spam at http://edetools.blogspot.com/2013/05/sito-con-particolari-pagine-di-referer.html
Text is italian , i am italian live Bangkok, but is possible translate with Google
Regards
Edgar

Patrick D. Boone said...

Edgar - Thank you, I found your post most interesting. Have you thought about posting an English version?

One has to wonder if there is enough profit in hitting Blogspot's stats to generate hits. There may be something to using Google's own services to increase rankings in Google's search engine that may benefit the spammer more than it appears. "Black hat" SEO optimization is something I barely understand in concept.

Salty Pumpkin Studio said...

Good post, Thank you

Never click on the links in your stats.
If you want to know about the links, then do a Google search. Careful what you click on.

Michael Mitchell said...

You said we could complain to Google. Do you know the process for doing that?

Patrick D. Boone said...

Michael - The closest thing I could find in Google's Blogger tech support is the report abuses page:
https://support.google.com/blogger/?hl=en

You can try reporting using the sub page for phishing, which this spam is somewhat like:
https://support.google.com/blogger/answer/42577?hl=en&ref_topic=3030094

Edgar Bangkok said...

Update 27 may
Now spammers Topblogstories hit Google Analytics

http://edetools.blogspot.com/2013/05/particolari-pagine-web-di-referer_27.html

Regards

Egar

Patrick D. Boone said...

Edgar - Thank you for taking a deeper look into the coding used by the spammers. Their switching things to Google Analytics is a surprise to me and demonstrates just how aggressive this campaign is.

I'll update the post to reflect your findings.

Unknown said...

Got this as well, never knew this was even a form spam could come in. Thanks for the post.

Lulle said...

Got it too, really annoying.
Thanks for the post, was really helpul :-)

Kofi Oppong Kyekyeku said...

Thank you