Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Get Rid of Snip(.)to Referral Spam In Google Analytics

Snip(.)to is yet another referral spam that is reported to have a high impact on Google Analytics statistics. Security engineers recommend that website publishers immediately add a filter of Snip.to since the website being spammed all over the websites is reported to be malicious. Users who have visited the website should immediately scan their computers with an advanced anti-malware tool since their systems may have been already compromised by this vile threat.

NameSnip(.)to Referral Spam
TypeMalicious domain being spammed by Referrer Spams
Short DescriptionThe domain may do various dangerous or unhealthy deeds to the PC activities.
SymptomsThe user may witness fake Java Update downloads as well as redirects to other potentially harmful domains.
Distribution MethodVia clicking on any Snip.to links (For example snip(.)to/?hrefasdi9/). By being redirected to it via a PUP (Potentially Unwanted Progra) causing pop-ups and redirects on the PC.
Detection ToolDownload Malware Removal Tool, to See If Your System Has Been Affected by Snip(.)to Referral Spam
User ExperienceJoin our forum to discuss about Snip.to Referrer Spam.

Snip(.)to Referral Spam – What is it

Referral spam (or Referrer Spam) is a type of spamming attack that is conducted with different interests:

  • Bringing traffic to affiliates, vendors or other third-party sites.
  • Trying to infect as many as possible users while conducting the spam campaign.
  • Sent by a website of the competition with a purpose to devaluate the statistics of the site with spam.
  • Sent for other interests.

Mostly however, such referral spammers aim primarily to generate hoax traffic that is non-organic to third-party sites that most likely paid for the service. Security researchers warn that the Snip.to threat is real as the next malware that may infect a PC and measures against it should be immediately taken. The referral spam trend continues to grow and it is usually the most powerful during the start and the end of an year.

Experts outline two primary spamming methods used by spammers and spam bot software at this moment:

First Type: Crawlers’ Spam

This type of spam is conducted in waves which devaluate the data of small and developing websites very fast. This means that if the statistical data in Google Analytics is very low in numbers it can be changed quite fast by spam traffic and modified so that the bounce rate can increase very fast. Also the spam can cause rapid fluctuations in the traffic chart which further devaluates traffic data. This usually prevents the website vendor to analyse how to drive more traffic to his website. And If the spam is very massive and more than what the server that hosts the website can take, it may deny the website from loading, bringing it down. It is less likely to crash the website than to devaluate the statistics, making traffic-based research impossible.

Usually spammers using such methods are less aggressive and more aware which websites are warning them and trying to stop their spam. They may immediately stop spamming after being flagged.

However, there is an exclusion to every rule. There are those spammers who instead of stopping on the first warning may immediately continue to develop their spam. These are the ones who most often have to be flagged, reported and filtered in Analytics which may be a painful process.

Second Type: Ghost Referral Spam

This spam strategy is used on a massive scale because it has been reported to be more efficient. It may be the primary choice of Snip.to spammers as well. This very method has a goal to remain unnoticed and unfiltered for a long period of time on a website, just like a ghost.
An expert from viget.com who researches primarily spam, called Ben Travis indicates that this very spam is in fact not even present on the website it conducts its spam attacks on. There are even situations where the actual spammers have taken advantage or even created exploits in the free HTTP protocol info that passes by. This is a clear indication of the sophistication and skills that are being utilized in order to deal maximum spam for a maximum period of time in an effective and undetected manner. An experienced cyber crook may even have the ability to mask his whole http session as if his spam bots weren’t there.

Ghost referrer spamming software may also have the ability to send fraudulent http requests that are concentrated on different google analytics data, and allow itself even to not require special software to visit the targeted site. Researchers have also reported that this cyber threat can even fake how certain search results appear.

Snip(.)to referral spams can even change statistical data, traffic and duration times making the data utterly useless. This type of spam attacks are particularly dangerous for beginner websites mostly because they do not have that much traffic and their data can become non-relevant very quickly. The domains being spammed continue to increase by the numbers.

Snip(.)to – More Information About the Site

The website itself is a redirect and any user that is half competent with computers should stay away from its URLs.

At the moment of writing it currently redirects to an advertising website, called Propeller Ads Media.

Propeller-ads-referral-spam

This website may or may not be related or a part of an affiliate marketing scheme to advertise various websites or even malicious links using various methods.

When it comes to the advertisements distribution, some blackhat advertisers may choose to use Unwanted programs that are ad-supported and come bundled and unnoticed on user PCs only to display pop-ups, ad-supported search results and other forms of advertisements.

The website even states what benefits and features it has to future customers, using Skype and other third-party services to sign users:

advertiser-boostage

What is more the website may even collect and share certain user statistics with third-parties:

snip.to-information-disclosure

Just like other websites, such as the notorious erot(.)co domain, this website has been heavily reported for malicious redirects, phishing and other activities that are unhealthy for user PCs.

Snip(.)to Referral Spam – How To Protect Yourself

In case you have detected referral spam messages linking to snip.to it is a sign that you should act now to detect and block out this particular spam and the website it redirects to in you GA.
Security researchers like Carlos Escalera from ohow.com suggest to users to guide themselves by the following instructions in order to remove referral spam by Snip.to:

Method 1: Filtering Snip(.)to Spam in Google Analytics:

Step 1: Click on the ‘Admin’ tab on your GA web page.
Step 2: Choose which ‘View’ is to be filtered and then click the ‘Filters’ button.
Step 3: Click on ‘New Filter’.
Step 4: Write a name, such as ‘Spam Referrals’.
Step 5: On Filter Type choose Custom Filter –>Exclude Filter –> Field: Campaign Source–> Filter Pattern. Then on the Pattern, enter the domain name – Snip(.)to
Step 6: Select Views to Apply Filter.
Step 7: Save the filter, by clicking on the ‘Save’ button.
You are done! Congratulations!

Also, make sure you check out these several methods to help you further block out this referrer spam from google analytics:

https://sensorstechforum.com/exclude-all-hits-from-known-bots-and-spiders-in-google-analytics/

We have also researched the following methods to remove this spam:

Method 2: Block it from your server.

In case you have a server that is Apache HTTP Server, you may want to try the following commands to block Snip(.)to domains in the .htaccess file:
RewriteEngine on
RewriteCond %{HTTP_REFERER} ^http://.*snip\.com/ [NC,OR]

RewriteCond %{HTTP_REFERER} ^http://.*snip.\.ru/ [NC,OR]

RewriteCond %{HTTP_REFERER} ^http://.*snip \.org/ [NC,OR]

RewriteCond %{HTTP_REFERER} ^http://.*snip \.info/ [NC,OR]

RewriteCond %{HTTP_REFERER} ^http://.* snip \.co/ [NC,OR]

RewriteCond %{HTTP_REFERER} ^http://.* snip \.to/ [NC,OR]

RewriteCond %{HTTP_REFERER} ^http://.* snip \-for\-website\.to/ [NC,OR] RewriteRule ^(.*)$ – [F,L]

Also here is a web link to some spam URLs being blacklisted from other servers:

https://perishablepress.com/blacklist/ultimate-referrer-blacklist.txt

Disclaimer: This type of domain blocking in Apache servers has not yet been tested and it should be done by experienced professionals. Backup is always recommended.

Method 3 – Via WordPress

There is a method outlined by security researchers online that uses WordPress plugins to block referrer spams from sites. There are many plugins that help deal with referrer spam, simply do a google search. We have currently seen one particular plugin reported to work, called WP-Ban, but bear in mind that you may find an equally good or better. WP-Ban has the ability to block users based on their IP address and other information such as the URL, for example.

If you are a user and you continue to be redirected by to this annoying website or keep seeing advertisements, by Propeller Ads Media on your PC, it is highly recommended to use an advanced anti-malware program to see if your computer hasn’t been infected with malware or other threats related to Snip.to. By doing so you also make sure you are protected by any future intrusions on your machine.

donload_now_250
Spy Hunter scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the anti-malware tool.Find Out More About SpyHunter Anti-Malware Tool / How to Uninstall SpyHunter

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.