Lately one of my GA4 properties started receiving huge spikes in traffic. Af first I thought success, but after checking channels I noticed they are all spam referrals coming from these sites:
- grets.store
- seders.website
- razas.site
- fertuk.site
- mantero.online
- bartikus.site
- dertus.site
- icopy.site
- rida.tokyo
These are the main domains and they actually use many subdomains of these sites.
What is the purpose of GA4 Spam campaign?
Main purpose is to push you to visit one of these sites. When you visit, they'll serve malware to your browser.
I did a quick check of few of them, and at first they seam like traffic is from Poland. But deeper search discovers that they belong to some Russian hacking group, since all of their backlinks are from RU.
Virus Total and few other companies marked these domains as malware:
How to they send traffic to your property?
I am using few other anlytics solutions like Plausible and they did not detect this traffic.
This means this malicious actors are directly posting data to the Google Analytics property without visiting the site.
After checking server logs and Cloudflare logs, I am positive that they directly triggered GA4 property and sent unwanted referrals to it.
Blocked referrals on Cloudflare
I wanted to be 100% sure so I created a WAF rule on Cloudflare to block these referrals. After 24 hours from deploying that rule, there were 0 tirggers.
And 0 triggers so far:
How to remove spam GA4 referrals
Visit Admin section of your GA4 property, open Data Streams:
From the Data Streams pages choose the Web property you use, and scroll down to Configure tag settings.
Expand list of tag settings and choose List unwanted referrals.
Inside add list of main domains to block, like this:
And Save.
This won't affect past referrals, but will block any future referrals.
Results after adding ignore referrals list
So far I am not seeing any new spikes in traffic.
GA4 traffic is back to normal.
Conclusion
There will be more of these GA4 spam campaigns and just when Google finds out a way how to block them hackers will create new attacks.
The most important thing is not to visit any link that is coming from the outside. This attack is no different than sending spam links in the email, it's just that hackers changed the delivery channel.
If you're really curious about the visit, first to a Google search, then search on Virus Total and other popular searches.
I personally never visit these sites, sometimes I send a 3rd party service to scan and screenshot the site.