Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Get Rid of Sharebutton(.)to Referral Spam from Google Analytics

sharebutton.to-relatedA new Referrer spam has become increasingly widespread over many URLs, such as the one going by the name of Get-Your-Social-Buttons(.)Info. The website itself posts a link with its domain redirecting the user who clicks on it on one of the several domains of sharebutton – .to .net and .org, all of which have different codes for share buttons embedded on a site. Although it is advertised as a free service, users are strongly advised not to use this suspicious bunch of code due to the fact that it may be harmful to the website in several different ways. Users are also advised to keep away from Get-Your-Social-Buttons(.)info links and to scan their computer with an anti-malware program if they have visited third-party websites via this domain. In case you have seen referrer spam linking to sharebutton.to, make sure to follow the instructions after this article to remove it.

Threat Summary

NameSharebutton(.)to Referral Spam
TypeReferral Spam
Short DescriptionThe web page has been seen on many referral spams on predominantly medium sized and smaller blogs in traffic.
SymptomsThe user may witnes the spam on various places of the website that is being targeted, leading to Copyrightclaims.org which then redirects to a phishing website.
Distribution MethodMost often via spammed URL’s. Bundling or unwanted software as well as spammed advertisements also a scenario. Even possible via malware.
Detection Tool See If Your System Has Been Affected by Sharebutton(.)to Referral Spam

Download

Malware Removal Tool

User ExperienceJoin Our Forum to Discuss Sharebutton(.)to Referral Spam.

Sharebutton(.)to Blocking In Google Analytics Instructions Video

Sharebutton(.)to Referral Spam – What Does it Do?

This particular type of referrer spam may be two types:

#1 – Web Crawler Spam

Web crawler spam, also known as spider, is named this way because the spam bot essentially ‘crawls’ the web looking for opportunities in the face of underdeveloped or small websites. It is not very persistent since the spam bot is usually programmed in a massive scale to stop spamming the same website after being deleted or flagged, however there may be advanced spammers that could develop such software into being a pain in the neck.

#2 – Ghost Referrer Spam

This particular type of spam is very sophisticated because it uses the free hype text protocol (HTTP) in order to take advantage of it and remain hidden and in some cases not even logically present in the website it spams. Ben Davis at vidget.com claims that such spam is not even present on the website it is spamming. What is more the spam may target different parts of the website.

Either way, referrer spam aims to drive hoax traffic to third-party websites and most spammers do not really mind what type of sites they advertise this way. It may be sites like the suspicious sharebutton(.)to. However, it may also be more dangerous web links that may either be phishing sites that aim to steal info, scamming sites or simply malicious URLs that may infect your PC.

Sharebutton Domains – More About Them

The Sharebutton network itself is potentially harmful and it has been advertised via other spam domains as well, such as buttons-for-website(.)com which advertises its .net domain. The website itself has been reported to be with an overall poor reputation with potential containing of malware in it by Scamanalyze.com researchers. According to Alexa around 30% of the visitors of the website are from India. However, there are also visitors from other countries such as Brasil, Turkey and Spain and also the US.

When entered, the website itself displays the following code to copy and each one of its domains contains different HTML based script:

sharebutton.to-malicious-script

This code links to its .org location and to the “cdn.script(.)to/share6(.)js” java script posted online, featuring a social map to the most widely used social networks such as Facebook, LinkedIn, Vkontakte, Tumblr and others. It has not been confirmed whether or not this script is dangerous for the user, however security experts strongly advise users to change their passwords in case they have used this share button.

Getting Rid of Sharebutton Domains Referrer Spam

Back to referrer spam, it primarily aims to drive traffic to third-party websites. However it should be noted that it may be dangerous in several different ways:

  • Devaluating website statistics.
  • Overcrowding the webiste with spam comments, causing Google to flag it from it search results.

This is why referral spam should not be underestimated. In order to remove sharebutton(.)to referral spam, it is highly advisable to try the following methods:

1: Filtering Sharebutton(.)to Referral Spam in Google Analytics
2: Block Sharebutton(.)to Referral Spam from Your Server.
3: Stop Sharebutton(.)to Referral Spam via WordPress.

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

  • The site you mentioned” persihablepress” has got huge list of spamming website. Thanks for sharing.

  • Linda Means-Kassis

    Thank you for such an informative article. What is the web address to the whois site you mention in the video, please?

  • Linda Means-Kassis

    Also, how do these get into my website?

    • they use a sophisticated software that allows them to connect to your website without having to visit it. This means that they use the information and the security settings on your website against you. This means that you should increase the security, apply captcha and other measures as well as other services that conceal as much information from your website as possible.

    • they have found your website via a special tactic spammers use about which I will not type in detail, but it is basically taking advantage of google via specific codes during searching that allow it to display certain websites based on their interests

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.