Get Rid of .ga Referral Spam In Google Analytics

Referral spam redirecting to Heavengifts(.)com by a web link, called Quit-smoking(.)ga has been reported to increase rapidly. The referral spam is believed to spread via a combination of Web Crawlers as well as Ghost Referral spam bots. It is highly recommended for all affected users who have visited the website Quit-Smoking(.)ga to take actions against it and its spam on their sites.

Name.ga Referrer Domains
TypeReferral Spam
Short DescriptionThe domain may cause one or more malicious redirects to different websites.
SymptomsThe user may witness primarily redirects to Heavengifts(.)com as well as redirects to other online retailer phishing websites that aim for his/her information or money.
Distribution MethodVia Spam bots (Web Crawlers and Ghost Referrers)
Detection ToolDownload Malware Removal Tool, to See If Your System Has Been Affected by .ga Referrer Domains
User ExperienceJoin our forum to discuss about .ga Referrer Spam Domains.

.Ga Referral Spam – How Is It Spread

Similar to other referral spams, Quit-Smoking(.)ga referral spam and other links redirecting to Heavengifts(.)com are spread via two main spamming technologies:

Web Crawlers Spam

This particular type of spam is called spiders or crawlers because it essentially crawls through the Web looking for websites based on a preset criteria. This type of spam is not aggressive, and it usually backs away after being flagged as spam once. However, there may be some advanced spammers that may configure it to become more persistent, so beware.

Ghost Referral Spam

This is the most widely chosen type of spam, research by ohow.com suggests. Also, according to Ben Travis at viget.com, this type of spam may use different technologies to target Google Analytics and hence devaluate the statistical data. In case you notice sudden spikes in your data, you may be almost certain that some of it might be by Ghost Referral spam. What is more, the spam uses different technologies such as taking advantage of the HTTP pass-through connection. Furthermore, Ghost Referral spam in most cases contains features that enable it to spam while not even directly present on the victim website. This makes it impossible to block the spam by blocking the domain name to access it. However, there are other methods to deal with it, outlined after this article.

Heavengifts(.)com In Detail

Usually referrer spam such as Quit-Smoking(.)ga and Cyber-Monday(.)ga may be created with a purpose to generate web traffic to the website via spam and hence make money from the products being sold on the online retailer site. Here you may find more information and instructions to block referral spam by Cyber-Monday(.)ga.The websites both may redirect to Heavengifts(.)com.

heaven-gifts-spam

Furthermore, the website itself features some interesting privacy policy claims, especially concerning users` information:

pii-sharing-heavengifts.com

Also, when the goods of the website were checked, it was visible that it offered some products at a higher price. The domains Cyber-Monday(.)ga and Quit-Smoking(.)ga may redirect to different parts of this website, more specifically to the parts on the same theme (smoking or tech products). However their redirects seem to change constantly, this is why users should beware of any spam messages featuring similar web links since they might cause more than one redirects and end up infecting users who visit them.

Also, .ga domain spam has been reported to link to other phishing websites, such as fake AliExpress sites as well as phishing Alibaba domains.
As far as security researchers are concerned this may or may not be a legitimate website looking forward to boosting its traffic via referral spam. However, you should beware of websites such as Quit-Smoking(.)ga and Cyber-Monday(.)ga, and any similar .ga domain spam messages because you might end up with malware on your computer. However, the reality may be completely different – the site may be phishing for the user`s information and gaining profit from it and also may serve other interests, that may not be morally acceptable. This is why its blocking is advisable.

Block Spam by Suspicious .ga Domains

There are many methods to block both types of spam from entering your website, and we have managed to research some of them. Below you can find the three main methods to deal with Web Crawlers as well as Ghost Referral spam as well as a hotlink to five more methods. We recommend applying all methods in combination to get rid of this spam fully.

In order to remove this referral spam completely, make sure to follow the after-mentioned instructions:

Method 1: Filtering .ga Referrer Domains Spam in Google Analytics:

Step 1: Click on the ‘Admin’ tab on your GA web page.
Step 2: Choose which ‘View’ is to be filtered and then click the ‘Filters’ button.
Step 3: Click on ‘New Filter’.
Step 4: Write a name, such as ‘Spam Referrals’.
Step 5: On Filter Type choose Custom Filter –>Exclude Filter –> Field: Campaign Source–> Filter Pattern. Then on the Pattern, enter the domain name – .ga Referrer Domains Step 6: Select Views to Apply Filter.
Step 7: Save the filter, by clicking on the ‘Save’ button.
You are done! Congratulations!

Also, make sure you check out these several methods to help you further block out this referrer spam from Google Analytics:

More Methods To Stop Spam Bots and Spiders In Google Analytics

We have also researched the following methods to remove this spam:

Method 2: Block .ga Referrer Domains from your server.

In case you have a server that is Apache HTTP Server, you may want to try the following commands to block .ga Referrer Domains domains in the .htaccess file:

RewriteEngine on

RewriteCond %{HTTP_REFERER} ^http://.*Heavengifts \.com/ [NC,OR]

RewriteCond %{HTTP_REFERER} ^http://.*Quit-Smoking \.ga/ [NC,OR]

RewriteCond %{HTTP_REFERER} ^http://.*Cyber-Monday \.ga/ [NC,OR]

RewriteCond %{HTTP_REFERER} ^http://.*Quit-Smoking \-for\-website\.ga/ [NC,OR]

RewriteCond %{HTTP_REFERER} ^http://.*Cyber-Monday \-for\-website\.ga/ [NC,OR]

RewriteCond %{HTTP_REFERER} ^http://.*Heavengifts \-for\-website\.com/ [NC,OR]

RewriteRule ^(.*)$ – [F,L]

Also here is a web link to some spam URLs being blacklisted from other servers:

Ultimate Referrer Blacklist by Perishablepress.com

Disclaimer: This type of domain blocking in Apache servers has not yet been tested and it should be done by experienced professionals. Backup is always recommended.

Method 3 – Stop .ga Referrer Domains Via WordPress

There is a method outlined by security researchers online that uses WordPress plugins to block referrer spams from sites. There are many plugins that help deal with referrer spam, simply do a google search. We have currently seen one particular plugin reported to work, called WP-Ban, but bear in mind that you may find an equally good or better. WP-Ban has the ability to block users based on their IP address and other information such as the URL, for example.

Also, in case you feel like you may have clicked and been redirected to one of the domains mentioned in the spam message, and you believe your system may be compromised, you should scan your computer with a particular anti-malware tool. Downloading such software will also make sure your computer is safe against any future intrusions as well.

donload_now_250
Spy Hunter scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the anti-malware tool.Find Out More About SpyHunter Anti-Malware Tool / How to Uninstall SpyHunter

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.