Forum Moderators: DixonJones

Message Too Old, No Replies

Anyone seeing searches for "query=Ron"?

big spike, no explaination

         

chewy

9:00 am on Aug 18, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



I just heard from a client about a spike from traffic searching for "ron".

And, just now, I find the same thing on my site.

Err, no, I don't have a "Ron" working for me who's googling themselves, nor does my client, and nor does the word "Ron" appear on any of our sites.

I was speculating that this was some sort of click fraud or referral spoofing.

Anyone seen anything like this recently?

The IP is irresolveable and the traffic comes in via a variety of hosts including cox, verizon, comcast, rr, bellsouth, aol, adelphia.

What evil lurks?

blend27

1:28 pm on Aug 19, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



chewy, does ther refferer URI has ttp://ipnumber...../admin/ron/ in it?

ronburk

4:48 pm on Aug 19, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I just heard from a client about a spike from traffic searching for "ron".

To which the next question should always be "what piece of software told you that?" and if the answer is not "grep applied to the raw search logs", then the next step is to look at a raw log entry and make sure the reporting software didn't claim that something is an SE hit when it clearly is unlikely to have come from any known search engine.

voltrader

3:33 am on Aug 20, 2005 (gmt 0)

10+ Year Member



I was just going to post about it!

One of my sites has alot of traffic from the referrng url

www.icannnews.com/cgi-bin/7upV2?query=ron

I don't think the url has anything to do with icann. It's probably some sort of spyware/adware and the traffic seems to be increasing.

Why are they coming to my obscure site?

ronburk

1:44 am on Aug 23, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Why are they coming to my obscure site?

10 minutes of looking turned up no clear answer, but clearly this referrer field has been sent to a variety of other sites as well, so you are not alone.

However, looking for the registrant of the domain produced a name, which Google was then able to use to locate a discussion about them being a maker of drive-by download spyware.

Best guess for me: it was a test or abandoned campaign to spam referrer fields to generate traffic for their spyware product. Maybe they got taken out in the meantime, or maybe they've come up with a more evil plan to pollute the world and are working on that now.