Is 100dollars-seo.com referrer spam?

What it is

Semalt sold SEO analytics and was described in 2014 as a Ukrainian startup. Its crawler visited sites at scale: Incapsula reported that it ran on a botnet spread through malware hidden in a utility called Soundfrost, and that the bot could run JavaScript and hold cookies, so Google Analytics counted its visits as human. Moz found it crawling with analytics tracking left on and kept crawling after a removal request. Several domains reported to Matomo's list later turned out to redirect to semalt.com or semaltmedia.com.

A 2015 reporter called it "aka semalt".

100dollars-seo.com is listed in Matomo's referrer spam list, a public-domain list of domains reported for showing up in referrer reports without sending real readers. A referrer from it, or from any subdomain of it, isn't a site that linked to you.

Why it appears in your analytics

Ghost spam never loads your site. The spammer sends hits straight to the analytics service, which for Google Analytics means its Measurement Protocol, using tracking IDs scraped from pages or simply guessed, so the fake referrer shows up in reports while your server logs stay clean. Server-side blocks such as .htaccess rules can't stop it, because no request ever reaches your server.

Crawler spam comes from bots that really do request your pages, with the spammer's domain set in the HTTP Referer header. Because the visit is real, it lands in server logs and in any analytics that counts server-side or runs JavaScript, and it carries your own hostname, which makes it harder to filter than ghost hits. Either way the goal is the same: get a curious site owner to visit the referring domain, or, where referrer logs are public, pick up a link from them.

How to keep it out of your reports

Don't open the domain to see what it is. Getting you to visit is the point of the spam.

Tools that read the Matomo list already leave it out. In other tools, exclude the domain from referrer reports with a filter or segment. Blocking it at the server or firewall only stops spam that actually requests your pages. Ghost spam never touches your site, so only a filter in the analytics tool removes it.

How Vireo handles it

Vireo Analytics 0.14.0 and later ship with this list and match the domain and every subdomain of it. Hits with this referrer are kept out of your totals, counted under "Referrer spam" in the bot panel, and hidden from referrer reports, including rows recorded before the list caught up. You don't need to set anything up.

A spam domain that isn't on the list yet can go under Blocked referrers in Vireo's settings, one host per line. Vireo also tags referrers whose visits show no engagement at all as suspected junk, with a "Block this referrer" link, and leaves them out of What changed. See Excluding traffic and Bot filtering.

Sources

a sneaky botnet deployed by a Ukrainian SEO startup, Semalt

Incapsula Blocks Semalt, A Referrer Spam Botnet (Information Security Buzz, archived)

The Semalt bot can execute JavaScript and hold cookies, bypassing bot-filtering methods.

Incapsula Blocks Semalt, A Referrer Spam Botnet (Information Security Buzz, archived)

Because of an unusual ability to execute JavaScript, Semalt activity actually appears in Google Analytics reports as being 'human' traffic.

Semalt Hijacks Hundreds of Thousands of PCs for Massive Botnet (Infosecurity Magazine)

Semalt uses a bot to crawl the web and index webpage data, but they don’t disable analytics tracking like most respectable bots do.

How to Stop Spam Bots From Ruining Your Analytics Referral Data (Moz)

Removing Referral Spam from Google Analytics (Viget, archived)

Stopping Referrer Spam (Matomo blog)

Got 100dollars-seo.com (aka semalt) as Referrer-Spam since a few weeks..

Matomo referrer-spam-list #34: 100dollars-seo.com

matomo-org/referrer-spam-list, spammers.txt at eaaa5eaa6990

Unlike crawler spam, Ghost spam does its job without interacting with the target site.

Referral spam: attack patterns and countermeasures (IONOS Digital Guide)

Ghost referral traffic, arguably the greater of the two referral spam evils, never actually visits a website.

Removing Referral Spam from Google Analytics (Viget, archived)

The main characteristic of ghost spam is that it never visits your site.

How to Efficiently Block and Remove the Spam from Your Google Analytics (Carlos Escalera, ohow.co, archived)

Crawler spam is harder to detect since it uses a valid hostname

How to Efficiently Block and Remove the Spam from Your Google Analytics (Carlos Escalera, ohow.co, archived)

Unlike regular bot spam, ghost traffic appears only in your GA reports and would not be visible in server logs.

trafficbot.life traffic in Google Analytics (Analytics Toolkit, archived)

A spammer bot makes repeated web site requests using a fake referrer URL to the site the spammer wishes to advertise.

Stopping Referrer Spam (Matomo blog)