Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

For the past 5 months our site has been receiving hits from these 4 sites below;

sheratonbd.com
newsheraton.com
newsheration.com
newsheratonltd.com

Typically the exact url they come from looks something like this;

http://www.newsheraton.com/ClickEarnArea.aspx?loginsession_expiredlogin=85

The spam bot goes to our homepage and stays there for about 1 min and then exist. Luckily we have some pretty beefy servers so it hasn't even come close to overloading our servers yet. Last month I started blocking the IP address's of the spam bots but they seem to keep getting new ones everyday. So far I have blocked over 200 IP address's, below are a few of the ones I have blocked. They all come from Bangladesh.

58.97.238.214
58.97.149.132
180.234.109.108
180.149.31.221
117.18.231.5
117.18.231.12

Since this has been going on for the past 5 months our real site traffic has started to drop, and everyday our orders get lower and lower. Also since these spam bots simply go to our homepage and then leave our bounce rate in analytics has sky rocketed.

My questions are;

Is it possible that these spam bots are affecting our SEO? 60% of our orders come from natural search, and since this whole thing has started orders have slowly been dropping.

What would be the reason someone would want to waste resources in doing this to our site? IP's aren't free and either are domain names, what would be the goal in doing this to us? We have google adwords but don't advertise on extended networks nor advertise in Bangladesh since we don't ship there so they are not making money on adsense.

Has anyone experienced anything similar to this? What did you do and what was the final out come?

share|improve this question
3  
Side note: Instead of banning IPs (which does not really makes impact since they use new one every time) better ban on more stable factor (based on your description). In your case -- referral. You can create simple rule using mod_rewrite to abort all requests that have those domain names in referrer request header. –  LazyOne Jun 12 '12 at 18:55
    
Thanks for the suggestion using mod_rewrite, I was looking into how to block the referring URL since they keep getting new IP's. And now I know, thanks again! –  akaDanPaul Jun 12 '12 at 19:04
add comment

4 Answers

up vote 12 down vote accepted

Funny this should come up, I was dealing with a similar problem at work today! @HeatherWalters has covered most of the good stuff, but there are a couple of things to add.

You can block referers by domain using the following htaccess code:-

RewriteEngine on
# Options +FollowSymlinks
RewriteCond %{HTTP_REFERER} spammer-one\.com [NC,OR]
RewriteCond %{HTTP_REFERER} spammer-two\.com
RewriteCond %{HTTP_REFERER} spammer-three\.com
RewriteRule .* - [F]

This redirects them to a 403 forbidden response, which I'm guessing is the most efficient way of dealing with the problem in terms of server load as its a fairly small header.

There are some interesting ideas floating around about keyword blocking via httpd or using mod_security, which might be worth investigating.

@LazyOne's response to my question about the most efficient way to do this indicates that httpd.conf would be a better option than .htaccess as it would be loaded prior to mod_rewrite (I will post code once I've had the time to test this).

Anecdotally it is causing problems in SERPs ranking, I've only seen two sites with a problem as serious as yours and both reported loss of organic search traffic, but I haven't found similar reports online or anything from Google that supports this notion.

@DisgruntledGoat indicates in his comment below that Bounce Rate in Google Analytics would not cause a loss of SERPs on it's own. But posting referrer logs might, as it would result in links to spam sites from your domain.

You can filter out the spam results from your analytics report, BusinessHut has a good tutorial which suggests using multiple versions of the following filter:-

Filter Type: Custom > EXCLUDE 

Filter Field: Campaign Source Filter

Pattern: golbnet 

Case Sensitive: No

This will eliminate any referrer with the text “golbnet” anywhere in the referring URL. To exclude other referrers, such as forexmarket, you could create another filter, OR you could simply add a “pipe” which acts as an “OR” operator. (eg. Filter Pattern: golbnet|forexmarket|anythingelse ) *You can get the pipe by pressing Shift and Backspace.

He also notes, as @Heather does that you should always maintain an unfiltered profile.

share|improve this answer
    
Sorry your going through the same thing and thanks for the htaccess code that you provided I am implementing it now. And I will just take both yours and @Heather advice with the google analytics. Thanks again! –  akaDanPaul Jun 12 '12 at 20:28
    
thanks, and +1 for the keyword blocking and mod_security links! Very informative stuff. –  huzzah Jun 12 '12 at 20:49
    
Blocked them with your suggestion above, now just have to hope that our natural search rankings start to go back up. Thanks for your insight! –  akaDanPaul Jun 13 '12 at 17:29
add comment

I've been trying to track this one down as well. Whatever they're doing, they seem to rotate domains every couple of weeks to a month. This can easily be seen in our analytics by filtering by traffic from Bangladesh (which we get very little legitimate traffic from.)

In our case, the traffic isn't affecting sales but is a couple of orders of magnitude more than the OP is seeing.

A bit of research turned up http://robotlancer.com/, which bills itself as "a software that helps Dolancer/ Skylancer/ Newsheraton/ Googleaddclick/ Visionaddworld/ Makegem subscribers to click their ads automatically." One of the screenshots shows a script that is loading and clicking on ads. From our analytics, it seems to use a random user agent and OS for each load which makes it look like human traffic.

This whole thing definitely smells like some sort of pay to click scam, but I can't figure out what they're doing since there's no way they could benefit from clicking on our ads!

share|improve this answer
add comment

You characterize this as a "spam bot" but the symptoms look to me more like human users clicking links to your site on one of the "sheraton" sites you list. Apparently you're getting repeated hits from each IP. Why would the human do this? Probably the site promotes the idea that the user can earn money by doing so (whether they actually earn money or not).

Why would a site like this link to your site? It might be a mistake, but consider if such a site has a bad reputation to search engines. Then your position on search result pages might be negatively affected, lowering your position of appearance and so your organic search hits. A reason a link-click site might link to you is to gain a payment for this effect from someone who wants it, e.g. a competitor.

share|improve this answer
    
    
Referrer spam seems easy to prevent, or at least make ineffective. Having search engines scan your logs seems like a very good thing to avoid for this and other reasons. –  mgkrebbs Jun 12 '12 at 23:30
    
+1 for a key point that bots almost never run Javascript like GA. –  DisgruntledGoat Jun 13 '12 at 9:31
    
I considered the thought that it might be human traffic that was tricked into coming to our site. However when it first started we were receiving all of these hits from only 10-15 different IP address. Once I blocked those a new 10-15 IP address's appeared but where in the same block. IE; 58.97.238.39 - 58.97.149.253. I don't know that much about ISP's and how they assign users their IP address's but I do know every time I buy an IP address from my Hosting provider its always super close to the current IP's I already have with them. So I just assumed it was coming from their data center. –  akaDanPaul Jun 13 '12 at 17:28
add comment

Have you considered the possibility that they are visiting your site, hoping you will research who they are, by following the link (so that you end up visiting their spammy sites.........the blackest of blackhat SEO)? Have you accessed this information on website hits purely through GA or have you looked at your website's traffic logs? Maybe they aren't visiting your site at all but plugging into your google analytics account and injecting their own 'hits' with special spamming software, in the hopes that you will take a look at their links (and the side effect is that all the skyrocketeing bounce rate is affecting your search engine ranking and therefore your real traffic). Please take a look at this link: google analytics referrer spam and be sure to read through the comments section.

You can filter the results of these out of your analytics reports by creating a duplicate profile and then adding a filter to it but I am unsure as to whether google still 'sees' them as hits. Supposedly, referrer spam doesn't affect SEO but I personally doubt that, if it is causing your bounce rate to go through the roof.

share|improve this answer
    
Thanks for informative response, I will look into the google analytics referrer spam link you provided. I have visited their sites and they are essentially just a 5 page website written in another language with no adsense. So not sure why they would want me to visit the site. And yes I have looked at this in GA and on our server logs, so they are definitely hitting the site on a daily basis. I am just hopping they stop soon and our SEO can start to climb back up again. –  akaDanPaul Jun 12 '12 at 18:44
    
Hmm, I actually rooted around a bit on the link you provided for their site and it looks indeed like they are running some 'get paid to click' scheme that you sign up for on their website. So they are 1)using the crappiest of spam bot techniques to get traffic to their site and 2)trying to get you to engage in the crappiest way to 'make money from home' by getting to 'invest' in their extremely crappy link clicking service. Perhaps all the hits per day are actually causing a DOS for real users...they want to go to your site but there are too many server requests at the time. –  huzzah Jun 12 '12 at 19:32
1  
oh those spammers will try and do anything to make a buck. Well hopefully they realize they aren't making any money off of it. I called our google adwords rep and she took down their domain name information. –  akaDanPaul Jun 12 '12 at 20:30
1  
Quick correction: your analytics has zero effect of search engine rankings. Visiting one site from another then 'bouncing' cannot possibly affect SEO. –  DisgruntledGoat Jun 13 '12 at 9:29
2  
@toomany those are usually the result of sites posting referer logs, resulting in them inadvertently linking to spammy sites. –  DisgruntledGoat Jun 14 '12 at 21:43
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.