Is ilovevitaly.co referrer spam?

What it is

Moz traced darodar.com, econom.co and the ilovevitaly domains to one registrant, Vitaly Popov, through WHOIS, and described the network as a way to send affiliate traffic to shops such as AliExpress and eBay. The wave hit analytics reports around December 2014, often as forum.darodar.com referrals that redirected to shopping sites. Kraftblick later tied Popov, based in Samara, Russia, to the late 2016 language spam that read "Secret.ɢoogle.com You are invited! Enter only with this ticket URL. Copy it. Vote for Trump!", whose link pointed to his o-o-8-o-o search shell project. Kraftblick calls him a ghost spammer, meaning the hits were sent straight to Google Analytics.

ilovevitaly.co is listed in Matomo's referrer spam list, a public-domain list of domains reported for showing up in referrer reports without sending real readers. A referrer from it, or from any subdomain of it, isn't a site that linked to you.

Why it appears in your analytics

Ghost spam never loads your site. The spammer sends hits straight to the analytics service, which for Google Analytics means its Measurement Protocol, using tracking IDs scraped from pages or simply guessed, so the fake referrer shows up in reports while your server logs stay clean. Server-side blocks such as .htaccess rules can't stop it, because no request ever reaches your server.

Crawler spam comes from bots that really do request your pages, with the spammer's domain set in the HTTP Referer header. Because the visit is real, it lands in server logs and in any analytics that counts server-side or runs JavaScript, and it carries your own hostname, which makes it harder to filter than ghost hits. Either way the goal is the same: get a curious site owner to visit the referring domain, or, where referrer logs are public, pick up a link from them.

How to keep it out of your reports

Don't open the domain to see what it is. Getting you to visit is the point of the spam.

Tools that read the Matomo list already leave it out. In other tools, exclude the domain from referrer reports with a filter or segment. Blocking it at the server or firewall only stops spam that actually requests your pages. Ghost spam never touches your site, so only a filter in the analytics tool removes it.

How Vireo handles it

Vireo Analytics 0.14.0 and later ship with this list and match the domain and every subdomain of it. Hits with this referrer are kept out of your totals, counted under "Referrer spam" in the bot panel, and hidden from referrer reports, including rows recorded before the list caught up. You don't need to set anything up.

A spam domain that isn't on the list yet can go under Blocked referrers in Vireo's settings, one host per line. Vireo also tags referrers whose visits show no engagement at all as suspected junk, with a "Block this referrer" link, and leaves them out of What changed. See Excluding traffic and Bot filtering.

Sources

I found that Mr. Popov’s spam network includes these domains: darodar.com (and various subdomains) econom.co ilovevitaly.co (and other TLD variations)

How to Stop Spam Bots From Ruining Your Analytics Referral Data (Moz)

This network appears to exist for the purpose of directing affiliate traffic to shopping sites such as AliExpress.com and eBay.com.

How to Stop Spam Bots From Ruining Your Analytics Referral Data (Moz)

He became the first known ghost spammer who was also in charge of darodar.com spam flooding.

How Referral Spam like Lifehacкer.com Gets into Google Analytics Reports (Kraftblick)

Secret.ɢoogle.com You are invited! Enter only with this ticket URL. Copy it. Vote for Trump!

How to Efficiently Block and Remove the Spam from Your Google Analytics (Carlos Escalera, ohow.co, archived)

o-o-8-o-o.com search shell is much better than google!

How to Easily Get Rid of All Language Spam in Your Google Analytics (Carlos Escalera, ohow.co, archived)

Blocking ilovevitaly.com, darodar.com, econom.co, priceg.com, blackhatworth.com Referer Spam (Flocal, archived)

Quick Note: “forum.Darodar” and “Ilovevitaly” are the same type of referral spam.

Google Analytics Darodar Forum Spam: What is it? (Wiyre, archived)

How To Block Darodar Referral Spam To Your Website (SudoRank, archived)

matomo-org/referrer-spam-list, spammers.txt at eaaa5eaa6990

Unlike crawler spam, Ghost spam does its job without interacting with the target site.

Referral spam: attack patterns and countermeasures (IONOS Digital Guide)

Ghost referral traffic, arguably the greater of the two referral spam evils, never actually visits a website.

Removing Referral Spam from Google Analytics (Viget, archived)

The main characteristic of ghost spam is that it never visits your site.

How to Efficiently Block and Remove the Spam from Your Google Analytics (Carlos Escalera, ohow.co, archived)

Crawler spam is harder to detect since it uses a valid hostname

How to Efficiently Block and Remove the Spam from Your Google Analytics (Carlos Escalera, ohow.co, archived)

Unlike regular bot spam, ghost traffic appears only in your GA reports and would not be visible in server logs.

trafficbot.life traffic in Google Analytics (Analytics Toolkit, archived)

A spammer bot makes repeated web site requests using a fake referrer URL to the site the spammer wishes to advertise.

Stopping Referrer Spam (Matomo blog)