Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Get Rid of Rusexy(.)xyz Google Analytics Referral Spam

Referral spam has been causing quite the havoc during the holidays, according to security experts. Researchers claim that this may be due to the increased spending in online retailer stores primarily for winter presents. One particular referrer spam that redirects to a phishing website of the notorious AliExpress.com is called Rusexy(.)xyz and experts advise that it should be blocked, tutorial for which we have below, since it may damage Google Analytics data of your website and even affect some users or cause a legitimate site it is spamming to be flagged as unsafe.

Name Rusexy(.)xyz Referral Spam
Type Referral Spam
Short Description The domain may cause one or more malicious redirects to different websites.
Symptoms The user may witness primarily redirects to what may be a phishing wesbite of an online store as well as redirects to other online retailer suspicious websites that may aim for his/her information or money or to infect the user PC with malware.
Distribution Method Via Spam bots (Web Crawlers and Ghost Referrers)
Detection Tool Download Malware Removal Tool, to See If Your System Has Been Affected by Rusexy(.)xyz Referral Spam
User Experience Join our forum to discuss about Rusexy(.)xyz Referral Spam.

Untitled-1

Rusexy(.)xyz Referral Spam – How Is It Spread

Researchers have established two main methodss of such spam spreading:

Method 1: Ghost Referrer Spam

This type of spam is spread via special software that takes advantage of the HTTP data passing through. Researchers report that the spam is even able to be sent out while the bot itself is not even present on the website, making it more durable. However, it can still be blocked, but despite that there is no guarantee that it will be successful.

Method 2: Web Crawlers (Spiders)

Web Crawlers otherwise known as spiders are the less aggressive type of spam. They are named like this because this type of spam crawls the searching for various sites based on certain criteria. Crawler spam usually backs away immediately after it has been flagged. However it can be combined with Ghost Referrer spam if the spammer is experienced in coding such software.

Rusexy(.)xyz Referral Spam – More about It

Except the original domain which at the time of writing this might redirect to a phishing website, resembling Aliexpress, users may encounter other web-links such as Rusexy(.)xyz/2132d2323d2 or 0d20dh2d023rusexy(.)xyz in the spam messages that could lead to suspicious online locations.

As visible the only differences between the original Aliexpress and the phishing onemay be the longer web link and the different site content, such as deals and promotions which ran out and are not active in the original website. These are very difficult to notice by an inexperienced user and that is why it is very important to be on the lookout for such symptoms related to Rusexy(.)xyz redirect.

These are the dangers for the users, but what may happen for a website publisher? Very simple, in case you are such, you may notice a sudden spike in your GA data that may further devaluate it and make research based on it impossible. This is very bad when it comes to small start-up websites and underdeveloped ones because it may quickly corrupt their data and if not paid attention to may cause Google to ban such websites for having malicious links.

How to Get Rid of Rusexy(.)xyz Referral Spam

There are several methods to get rid of this referral spam from your website. We have suggested the main three methods to do it on your server(Apache), WordPress and GA plus more instructions for Google Analytics spam blocking in this article:

More Methods To Stop Spam Bots and Spiders In Google Analytics

In order to remove this referral spam completely, make sure to follow the after-mentioned instructions:

Method 1: Filtering Rusexy(.)xyz Referral Spam Spam in Google Analytics:

Step 1: Click on the ‘Admin’ tab on your GA web page.
Step 2: Choose which ‘View’ is to be filtered and then click the ‘Filters’ button.
Step 3: Click on ‘New Filter’.
Step 4: Write a name, such as ‘Spam Referrals’.
Step 5: On Filter Type choose Custom Filter –>Exclude Filter –> Field: Campaign Source–> Filter Pattern. Then on the Pattern, enter the domain name – Rusexy(.)xyz Referral Spam Step 6: Select Views to Apply Filter.
Step 7: Save the filter, by clicking on the ‘Save’ button.
You are done! Congratulations!

We have also researched the following methods to remove this spam:

Method 2: Block Rusexy(.)xyz Referral Spam from your server.

In case you have a server that is Apache HTTP Server, you may want to try the following commands to block Rusexy(.)xyz Referral Spam domains in the .htaccess file:

RewriteEngine on

RewriteCond %{HTTP_REFERER} ^http://.*Rusexy \.xyz/ [NC,OR]

RewriteCond %{HTTP_REFERER} ^http://.*Rusexy \-for\-website\.xyz/ [NC,OR]

RewriteRule ^(.*)$ – [F,L]

Also here is a web link to some spam URLs being blacklisted from other servers:

Ultimate Referrer Blacklist by Perishablepress.com

Disclaimer: This type of domain blocking in Apache servers has not yet been tested and it should be done by experienced professionals. Backup is always recommended.

Method 3 – Stop Rusexy(.)xyz Referral Spam Via WordPress

There is a method outlined by security researchers online that uses WordPress plugins to block referrer spams from sites. There are many plugins that help deal with referrer spam, simply do a google search. We have currently seen one particular plugin reported to work, called WP-Ban, but bear in mind that you may find an equally good or better. WP-Ban has the ability to block users based on their IP address and other information such as the URL, for example.

Also, in case you feel like you may have clicked and been redirected to one of the domains mentioned in the spam message, and you believe your system may be compromised, you should scan your computer with a particular anti-malware tool. Downloading such software will also make sure your computer is safe against any future intrusions as well.

donload_now_250
Spy Hunter scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the anti-malware tool.Find Out More About SpyHunter Anti-Malware Tool / How to Uninstall SpyHunter

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.