Here’s a secret: ɢoogle.com is not google.com

international-domain-namesAnd now lifehacĸer.com is NOT lifehacker.com. Internet domain names have gone International!

Google Analytics has become a great target for spammers, where they leave fake traffic that draws unwary web site owners to investigate where it came from. This week one of those spammers left a ‘Vote for Trump‘ message in many people’s analytics reports. What most people didn’t notice was that the website it referenced looked like secret.Google.combut it wasn’t.


Instructions below show how to build a Filter to block this particular attack. To get historical spam out of your reports, use the Segment I posted to the Google Analytics Solution Gallery. Remember to change the Segment to use your website domain name in the first expression!

Read the whole story in the Definitive Guide to Removing All Google Analytics Spam — the authoritative reference on the topic, regularly updated since January 2015.


The Imitation G

In fact, the letter ‘G’ is a Latin Letter Small Capital, Unicode 0x0262.  Compared side by side with a real capital G, they would look like ‘ɢ G’ — see the difference? Notice how the ‘G’ in the image is the same size as the lowercase letter ‘o’? It’s not the G you thought it was. [This same technique was used to create lifehacĸer.com, with a Latin Small Letter Kra, Unicode 0x138 instead of a ‘k’]

fake-g-google

OK, so they faked a letter in the web address….so what?  Well, if you click that link, it takes you to ɢoogle.com, not google.com!!! You have just clicked into the spammer’s web site, where anything could happen!

[you actually end up redirected to: money.get.away.get.a.good.job.with.more.pay.and.you.are.okay.money.it.is.a.gas.grab.that.cash.with.both.hands.and.make.a.stash.new.car.caviar.four.star.daydream.think.i.ll.buy.me.a.football.team.money.get.back.i.am.alright.jack.ilovevitaly.com]

Again, more spam, so what’s the big deal?

The Danger

Well, someone, somewhere, gave out the domain ɢoogle.com to someone who was not representing google.com. what is stopping them from mimicking YOUR web site, or YOUR BANK’s website, and then leaving innocent-looking links for you to fall prey to? You would probably never realize what you did until it was tool late.

Internationalized Domain Names

Most people don’t realize it, but there were a lot of people working the past few years on getting international characters into domain names…and they are real today. They are supposed to allow people to create domains in their native language, like 日本語.jp. Seems at least one enterprising individual (in Russia) grabbed the opportunity recently to snap up ɢoogle.com.

Expect to see a sharp increase in phishing until the general public catches on.

Never trust a link provided by someone else…

 

Sources: Fake or Real?

When they create a fake visit to your website, they usually leave one of their own websites as a source, so you’ll go click on it to see who is linking to your site. In this case, since the ‘message’ is in the Language field, they have used a mix of spam and real domains for sources, changing them daily to get around Google Analytics spam filtering processes. They have even used abc.xyz (Google’s parent Alphabet company site) and thenextweb.com (a real website that ran a story about the spam yesterday). In all cases, using the classic approach of filtering on the Source field is a waste of time. More…

 

How to Filter It Out

CAUTION: things change daily, and this filter is only partially effective now (2016-11-30). For the latest in spam filtering techniques, see the Definitive Guide article linked below.

To prevent more of it from appearing in your Google Analytics accounts, create a new filter on the Admin panel. Note: do NOT waste your time filtering on Referral or Campaign Source – those values change daily.

Pick a new Filter Name
Filter Type: Custom
Choose: Exclude
Filter Field: Language Settings
Filter Pattern:  \.

CAUTION: the Filter pattern characters are backslash period. Save the new filter. It will take effect right away, but you may find that today’s data gets reprocessed in a few hours. To remove spam already in your account, you will need to use the Segment I posted to the Google Analytics Solution Gallery.

spam-language-filter

Read the whole story in the Definitive Guide to Removing All Google Analytics Spam — the authoritative reference on the topic.