Wednesday, January 11, 2017

Russian search engines floods internet traffic with Vote for Trump keywords during election, proof in Google Analytics

Russian Federation floods the internet with fake traffic to sites to promote "Vote for Trump

In a series of Russian hacks, disinformation and persuasion, this post details a method the Russians were using to promote Trump, creating fake traffic from crawling search engines emanating from Russia cleverly hijacked the language metadata setting with "Vote for Trump".

Specifically, a surge of traffic appeared during the election in month of November 2016 with language set to "Secret.google.com You are invited! Enter only with this tick URL. Vote for Trump!" known as ghost spam. 

Technically, the request Accept-Language header is set in browser/crawler to indicate the language (aka country) of the source request. This is one field of many as defined in the request headers specification, which is a whole slew of identifying metadata that is logged by your site and search engines. The values are generally agreed upon standards and overloading these values is generally verboten, and is known a referrer spam or ghost spam.

A difference between crawler spam and ghost spam, ghost spam NEVER accesses your site. Ghost spam is fake data sent directly to Google Analytics servers. This type of spam only needs an existing tracking code number to hit, it doesn't matter if it is or not inserted on an active site. 

The main reason of this spam is to get webmasters to perhaps goto Secret.ɢoogle.com for traffic hits and potentially malicious software. But it's a form a cheap advertising since, webmaster do read their Google Analytic reports and this showing up world-wide as "Vote for Trump".

This traffic was sent by Vitaly Popov a known GA spammer and had his account revoked and as "Revenge to Google," he wrote,  Google won a lawsuit to block this site on February 16, 2016. 

How to estimate that cost of this influence?

Well, given the numerous articles about this and quoting the keywords 
"Vote for Trump", it will have an effect on rankings for the keywords "Vote for Trump".

There are  39,200,000 sites containing Secret.ɢoogle.com and "Trump" in Google search.There are       808,000 sites containing Secret.ɢoogle.com and "Vote for Trump" in Google search.

Guesstimated influence anyone? 

Details

In the 1st screen shot below, is the traffic for a typical site I manage below. The traffic is tracked using Google Analytics (GA) portal and is set for a period of 1.5 months, starting Nov. 1st, 2016. It is the only period when this keyword manipulation occurred. Note;  

  1. Language 1 "... Vote for Trump!" suddenly appears during election time only.
  2. For the 1.5 month period spanning (Nov 1, 2016 - Dec 15, 2016) an increase in 34% traffic increase resulted. Be advised, that percentage is relative to amount of traffic a site gets. For small sites this is about double. For large site about 3% or less.

    However, checking 5 sites I manage the average number of hits remained consistent with 110-120 fake hits per site with Language as "... Vote for Trump!".

    Seems many sites worldwide has been hit with this referral spam.

    Google Analytics Screen Shot #1 - 'Vote for Trump' dominates hits for this period















































In the 2nd Google Analytics screen shot is drill down in the Language called "Secret.google.com You are invited! Enter only with this tick URL. Vote for Trump!" for the same period. A surge of fake traffic appears. 
  • For the period spanning (Nov 1, 2016 - Dec 15, 2016), a majority of this fake traffic peaked before Nov 28th, when Trump stated in an interview was election day. 

    Did the hackers not check their facts? Traffic would be most influential for a Nov. 28 election day.

    Google Analytics Screen Shot #2 - 'Vote for Trump!' traffic appears only during election period

The 3rd Google Analytics screen shot is a chart with Language "Secret.google.com You are invited! Enter only with this tick URL. Vote for Trump!" and Region. 

  • All of this traffic comes from Russia. Naturally Saint Petersburg, is logical source of most of the traffic spike since Russia connects to the West through a cross-border terrestrial fiber-optical cables to Helsinki, Finland. 

Google Analytics Screen Shot #3 - traffic confirmed from Russia 

Just for fun, the 4th screen shot is of Google Adwords KeyPlanner of a hypothetical campaign to promote "Trump" keywords or ad group on CNN.com for 1 day.
To secure 1st position in Google search results page for CNN.com would require and estimated 
$4,500 USD ($5, 980 CDN) a day.
#4 Google Adwords Key Planner for "Trump" - Prices in CDN.








 Have you checked your site traffic for 'Vote for Trump', please share in comments below.



No comments:

Post a Comment