Vireo AnalyticsGet it free
Menu

Referrer spam list

2,352 domains that show up as referrers without sending a single reader. Look one up to see why it's there and how to keep it out of your reports.

Well-known spam families

These are the campaigns that got written about, so they're the names people search for. Each links to the domains on the list that belong to it.

2016 fake SEO tool referrers

In spring 2016 a cluster of domains named like free SEO and site tools started appearing in referral reports: rank-checker.online in March, free-video-tool.com and keywords-monitoring-your-success.com in April, keywords-monitoring-success.com in May and fix-website-errors.com in June, going by the dates of reports to Matomo's list. Viget added several of them to its referral spam guide in a May 2016 update, and Carlos Escalera listed them under crawler spam. The sources report them together but don't confirm a shared operator.

7makemoneyonline.com

7makemoneyonline.com appeared in referral reports in 2015, often as make-money-online.7makemoneyonline.com. Carlos Escalera listed it under crawler spam.

best-seo-offer.com and best-seo-solution.com

Two SEO-offer domains that were common in referral reports in 2015. Matomo named best-seo-offer.com among well known spammers when it explained referrer spam in May 2015, IONOS used best-seo-solution.com as a filter example, and Carlos Escalera listed both under crawler spam.

bestwebsitesawards.com

bestwebsitesawards.com was added to Flocal's block list in February 2015, the latest addition to the darodar and ilovevitaly wave, and appears on other spam lists of that year.

blackhatworth.com

blackhatworth.com joined the darodar and ilovevitaly wave in early January 2015, when Flocal added it to its block list. SudoRank's readers reported it in the same period.

buttons-for-website.com

buttons-for-website.com and buttons-for-your-website.com were two of the most cited referrer spam domains of 2014 and 2015, named in Moz's guide, in SudoRank's how-to and in Matomo's own explainer on referrer spam. Carlos Escalera's spam guide lists both under crawler spam, so these were bots that loaded pages rather than ghost hits.

cenoval.ru

cenoval.ru showed up in January 2015 during the darodar and ilovevitaly wave. A Flocal reader logged every request to their server for a day and found that Google Analytics recorded cenoval.ru referrals that never reached the server, an early demonstration of ghost spam.

event-tracking.com

event-tracking.com was reported to Matomo's list in May 2015 by site owners who saw it on newly registered domains, and it kept showing up that summer.

Fake cookie law and compliance sites

In mid 2016 a wave of referrers posed as EU cookie law enforcement or compliance checkers, with names like cookie-law-enforcement-aa.xyz through cookie-law-enforcement-zz.xyz and compliance-[first name].xyz or .top. In June 2016 Matomo's list maintainers agreed to block all 26 letter pairs at once, after a contributor noted that only some had been registered so far. Carlos Escalera grouped the fake cookie compliance sites with ghost spam, which a valid-hostname filter removes.

Free share button look-alikes

From 2015 a long series of referrers named after free social sharing buttons appeared, each a small variation on the last: free-share-buttons.com, social-buttons.com, simple-share-buttons.com, then numbered and .xyz versions in 2016. Contributors to Matomo's list kept adding new variants as old ones were blocked, and one suggested banning any referrer with "buttons" in its name. The sources don't name a single operator for the whole set, though several button domains redirected to sharebutton.to.

gammatraffic.com and trafficbot.life

In early 2021 bot-traffic.xyz, bot-traffic.icu and trafficbot.life showed up in analytics reports, and people reporting them to Matomo's list found they redirected to gammatraffic.com. Analytics Toolkit described trafficbot.life as ghost spam sent through Google Analytics' Measurement Protocol, which started as referral spam and later appeared as fake landing pages, page titles and languages.

get-free-traffic-now.com

get-free-traffic-now.com appeared in referral reports in 2015, and a later Matomo report compared get-free-social-traffic.com to it.

google-liar.ru

google-liar.ru appeared in February 2017 as the page title on fake motherboard.vice.com referrals, a follow-up to the anti-Google language spam of late 2016. Carlos Escalera updated his filters to catch it.

guardlink.org and theguardlan.com

guardlink.org was a large source of referral spam in May 2015, reported to Matomo's list by a site owner who called it their second biggest. Readers of CGColors' spam list named it together with theguardlan.com.

howtostopreferralspam.eu

A referrer spam domain named as if it offered help against referrer spam. It was reported to Matomo's list in June 2015, where the maintainers noted the irony.

hulfingtonpost.com

hulfingtonpost.com, a misspelling of the Huffington Post's domain, appeared in referral reports in January 2015 during the darodar and ilovevitaly wave. IONOS still used it as a filter example in 2017.

humanorightswatch.org

humanorightswatch.org, a near copy of Human Rights Watch's domain, appeared in 2015 referral reports during the darodar and ilovevitaly wave.

kambasoft.com

kambasoft.com appeared on 2015 blocklists next to semalt.com and darodar.com, including the .htaccess rules Moz published. A Matomo contributor saw it as musicas.kambasoft.com.

Late 2016 .xyz referrers

Late 2016 brought a batch of short .xyz referrers such as alfabot.xyz, budilneg.xyz and abcdefh.xyz, reported to Matomo's list in November 2016. Carlos Escalera listed them in the same spam lists as the "Vote for Trump" language spam and the fake lifehacker.com referrals, and Kraftblick reported that the junk .xyz referrers of that wave were registered under Vitaly Popov's name.

o-o-6-o-o

o-o-6-o-o.com and o-o-6-o-o.ru appeared in referral reports in 2015, listed alongside the darodar and ilovevitaly domains. The name echoes o-o-8-o-o, the search shell Kraftblick tied to Vitaly Popov, but the sources here don't confirm a shared owner.

pornhub-forum and youporn-forum

Adult-themed fake forum referrers such as pornhub-forum.ga and youporn-forum.ga appeared in 2015, reported to Matomo's list from a freshly registered domain.

priceg.com

priceg.com arrived with blackhatworth.com in early January 2015, during the darodar and ilovevitaly wave, and went into the .htaccess block lists readers shared at the time.

Ranksonic

Ranksonic domains (.info, .net and .org) turned up in analytics reports from late 2015, including on a site that had no tracking code installed, which points to ghost hits. In mid 2016 site-auditor.online appeared and was reported as pointing to ranksonic.com. Carlos Escalera's spam filters include both names.

sanjosestartups.com

sanjosestartups.com was reported to Matomo's list in May 2015. It pointed to an Alibaba site, and the reporter found its WHOIS record listed a Russian registrant.

savetubevideo

savetubevideo.com, named like a YouTube downloader, appeared on 2015 blocklists, including Moz's .htaccess rules. It also showed up as youtube-downloader.savetubevideo.com.

Semalt

Semalt sold SEO analytics and was described in 2014 as a Ukrainian startup. Its crawler visited sites at scale: Incapsula reported that it ran on a botnet spread through malware hidden in a utility called Soundfrost, and that the bot could run JavaScript and hold cookies, so Google Analytics counted its visits as human. Moz found it crawling with analytics tracking left on and kept crawling after a removal request. Several domains reported to Matomo's list later turned out to redirect to semalt.com or semaltmedia.com.

sharebutton.to

sharebutton.to sat behind a run of share-button themed spam domains from 2015 onward. People reporting to Matomo's list found subdomains of floating-share-buttons.com, plus free-floating-buttons.com and get-free-social-traffic.com, redirecting to it. By late 2016 Carlos Escalera's guide listed sharebutton.to in ghost spam, as fake keyword and page entries ending in the domain.

sitevaluation.org

sitevaluation.org was reported to Matomo's list in August 2015 and listed by Carlos Escalera under crawler spam.

trafficmonetize.org and traffic2money.com

Traffic-selling domains reported to Matomo's list in June and July 2015. Contributors saw hits with very high bounce rates that came from Russian cities, while the domains were registered to an address in Queensland, Australia. trafficmonetize.org redirected through traffic-paradise.org to adzos.com.

Vitaly Popov network (darodar, ilovevitaly, o-o-8-o-o)

Moz traced darodar.com, econom.co and the ilovevitaly domains to one registrant, Vitaly Popov, through WHOIS, and described the network as a way to send affiliate traffic to shops such as AliExpress and eBay. The wave hit analytics reports around December 2014, often as forum.darodar.com referrals that redirected to shopping sites. Kraftblick later tied Popov, based in Samara, Russia, to the late 2016 language spam that read "Secret.ɢoogle.com You are invited! Enter only with this ticket URL. Copy it. Vote for Trump!", whose link pointed to his o-o-8-o-o search shell project. Kraftblick calls him a ghost spammer, meaning the hits were sent straight to Google Analytics.

All 2,352 domains

Why referrer spam exists

Ghost spam never loads your site. The spammer sends hits straight to the analytics service, which for Google Analytics means its Measurement Protocol, using tracking IDs scraped from pages or simply guessed, so the fake referrer shows up in reports while your server logs stay clean. Server-side blocks such as .htaccess rules can't stop it, because no request ever reaches your server.

Crawler spam comes from bots that really do request your pages, with the spammer's domain set in the HTTP Referer header. Because the visit is real, it lands in server logs and in any analytics that counts server-side or runs JavaScript, and it carries your own hostname, which makes it harder to filter than ghost hits. Either way the goal is the same: get a curious site owner to visit the referring domain, or, where referrer logs are public, pick up a link from them.

Unlike crawler spam, Ghost spam does its job without interacting with the target site.

Referral spam: attack patterns and countermeasures (IONOS Digital Guide)

Ghost referral traffic, arguably the greater of the two referral spam evils, never actually visits a website.

Removing Referral Spam from Google Analytics (Viget, archived)

The main characteristic of ghost spam is that it never visits your site.

How to Efficiently Block and Remove the Spam from Your Google Analytics (Carlos Escalera, ohow.co, archived)

Crawler spam is harder to detect since it uses a valid hostname

How to Efficiently Block and Remove the Spam from Your Google Analytics (Carlos Escalera, ohow.co, archived)

Unlike regular bot spam, ghost traffic appears only in your GA reports and would not be visible in server logs.

trafficbot.life traffic in Google Analytics (Analytics Toolkit, archived)

A spammer bot makes repeated web site requests using a fake referrer URL to the site the spammer wishes to advertise.

Stopping Referrer Spam (Matomo blog)

How Vireo handles it

Vireo Analytics 0.14.0 and later bundle this list. Hits from these domains and their subdomains are kept out of your totals, counted under "Referrer spam" in the bot panel, and hidden from referrer reports. Hosts you add under Blocked referrers in the settings get the same treatment. See Excluding traffic, the bot directory and the bot checker.

About this list

The domains come from Matomo's referrer spam list, which is public domain and maintained by its users (commit eaaa5eaa6990). It's the same list the plugin ships, checked against the plugin's copy at build time.

Every domain has a page, but only 135 are offered to search engines: those in a spam family with at least two published sources that name it, such as news coverage or analytics vendors' write-ups. The rest are short-lived domains nobody wrote about, so their pages would be identical apart from the name. They stay reachable from this list, marked noindex and left out of the sitemap.