Russian Federation floods the internet with fake traffic to sites to promote "Vote for Trump"
In a series of Russian hacks, disinformation and persuasion, this post details a method the Russians were using to promote Trump, creating fake traffic from crawling search engines emanating from Russia cleverly hijacked the language metadata setting with "Vote for Trump".
Specifically, a surge of traffic appeared during the election in month of November 2016 with language set to "Secret.google.com You are invited! Enter only with this tick URL. Vote for Trump!" known as ghost spam.
Technically, the request Accept-Language header is set in browser/crawler to indicate the language (aka country) of the source request. This is one field of many as defined in the request headers specification, which is a whole slew of identifying metadata that is logged by your site and search engines. The values are generally agreed upon standards and overloading these values is generally verboten, and is known a referrer spam or ghost spam.
A difference between crawler spam and ghost spam, ghost spam NEVER accesses your site. Ghost spam is fake data sent directly to Google Analytics servers. This type of spam only needs an existing tracking code number to hit, it doesn't matter if it is or not inserted on an active site.
The main reason of this spam is to get webmasters to perhaps goto Secret.ɢoogle.com for traffic hits and potentially malicious software. But it's a form a cheap advertising since, webmaster do read their Google Analytic reports and this showing up world-wide as "Vote for Trump".
This traffic was sent by Vitaly Popov a known GA spammer and had his account revoked and as "Revenge to Google," he wrote, Google won a lawsuit to block this site on February 16, 2016.
How to estimate that cost of this influence?
Well, given the numerous articles about this and quoting the keywords "Vote for Trump", it will have an effect on rankings for the keywords "Vote for Trump".
There are 39,200,000 sites containing Secret.ɢoogle.com "Trump" in Google search.There are 808,000 sites containing Secret.ɢoogle.com "Vote for Trump" in Google search.
Guesstimated influence anyone?
Update: Jan 26, 2018
Secret.ɢoogle.com and "Trump" 31,700
Secret.ɢoogle.com and "Vote for Trump" 29,900
Secret.Google.com and "Vote for Trump" 104,000
Secret.Google.com and "Trump" 19,900,000
Details
In the 1st screen shot below, is the traffic for a typical site I manage below. The traffic is tracked using Google Analytics (GA) portal and is set for a period of 1.5 months, starting Nov. 1st, 2016. It is the only period when this keyword manipulation occurred. Note;
In the 2nd Google Analytics screen shot is drill down in the Language called "Secret.google.com You are invited! Enter only with this tick URL. Vote for Trump!" for the same period. A surge of fake traffic appears.
The 3rd Google Analytics screen shot is a chart with Language "Secret.google.com You are invited! Enter only with this tick URL. Vote for Trump!" and Region.
Just for fun, the 4th screen shot is of Google Adwords KeyPlanner of a hypothetical campaign to promote "Trump" keywords or ad group on CNN.com for 1 day.
To secure 1st position in Google search results page for CNN.com would require and estimated $4,500 USD ($5, 980 CDN) a day.
In a series of Russian hacks, disinformation and persuasion, this post details a method the Russians were using to promote Trump, creating fake traffic from crawling search engines emanating from Russia cleverly hijacked the language metadata setting with "Vote for Trump".
Specifically, a surge of traffic appeared during the election in month of November 2016 with language set to "Secret.google.com You are invited! Enter only with this tick URL. Vote for Trump!" known as ghost spam.
Technically, the request Accept-Language header is set in browser/crawler to indicate the language (aka country) of the source request. This is one field of many as defined in the request headers specification, which is a whole slew of identifying metadata that is logged by your site and search engines. The values are generally agreed upon standards and overloading these values is generally verboten, and is known a referrer spam or ghost spam.
A difference between crawler spam and ghost spam, ghost spam NEVER accesses your site. Ghost spam is fake data sent directly to Google Analytics servers. This type of spam only needs an existing tracking code number to hit, it doesn't matter if it is or not inserted on an active site.
The main reason of this spam is to get webmasters to perhaps goto Secret.ɢoogle.com for traffic hits and potentially malicious software. But it's a form a cheap advertising since, webmaster do read their Google Analytic reports and this showing up world-wide as "Vote for Trump".
This traffic was sent by Vitaly Popov a known GA spammer and had his account revoked and as "Revenge to Google," he wrote, Google won a lawsuit to block this site on February 16, 2016.
Well, given the numerous articles about this and quoting the keywords "Vote for Trump", it will have an effect on rankings for the keywords "Vote for Trump".
There are 39,200,000 sites containing Secret.ɢoogle.com "Trump" in Google search.There are 808,000 sites containing Secret.ɢoogle.com "Vote for Trump" in Google search.
Guesstimated influence anyone?
Update: Jan 26, 2018
Secret.ɢoogle.com and "Trump" 31,700
Secret.ɢoogle.com and "Vote for Trump" 29,900
Secret.Google.com and "Vote for Trump" 104,000
Secret.Google.com and "Trump" 19,900,000
Details
In the 1st screen shot below, is the traffic for a typical site I manage below. The traffic is tracked using Google Analytics (GA) portal and is set for a period of 1.5 months, starting Nov. 1st, 2016. It is the only period when this keyword manipulation occurred. Note;
- Language 1 "... Vote for Trump!" suddenly appears during election time only.
- For the 1.5 month period spanning (Nov 1, 2016 - Dec 15, 2016) an increase in 34% traffic increase resulted. Be advised, that percentage is relative to amount of traffic a site gets. For small sites this is about double. For large site about 3% or less.
However, checking 5 sites I manage the average number of hits remained consistent with 110-120 fake hits per site with Language as "... Vote for Trump!".
Seems many sites worldwide has been hit with this referral spam.
Google Analytics Screen Shot #1 - 'Vote for Trump' dominates hits for this period
In the 2nd Google Analytics screen shot is drill down in the Language called "Secret.google.com You are invited! Enter only with this tick URL. Vote for Trump!" for the same period. A surge of fake traffic appears.
- For the period spanning (Nov 1, 2016 - Dec 15, 2016), a majority of this fake traffic peaked before Nov 28th, when Trump stated in an interview was election day.
Did the hackers not check their facts? Traffic would be most influential for a Nov. 28 election day.
Google Analytics Screen Shot #2 - 'Vote for Trump!' traffic appears only during election period
The 3rd Google Analytics screen shot is a chart with Language "Secret.google.com You are invited! Enter only with this tick URL. Vote for Trump!" and Region.
- All of this traffic comes from Russia. Naturally Saint Petersburg, is logical source of most of the traffic spike since Russia connects to the West through a cross-border terrestrial fiber-optical cables to Helsinki, Finland.
 |
| Google Analytics Screen Shot #3 - traffic confirmed from Russia |
Just for fun, the 4th screen shot is of Google Adwords KeyPlanner of a hypothetical campaign to promote "Trump" keywords or ad group on CNN.com for 1 day.
To secure 1st position in Google search results page for CNN.com would require and estimated $4,500 USD ($5, 980 CDN) a day.
 |
#4 Google Adwords Key Planner for "Trump" - Prices in CDN.
Have you checked your site traffic for 'Vote for Trump', please share in comments below.
|
No comments:
Post a Comment