This Russian Hacker Is Spamming Everyone's Google Analytics In Support Of Donald Trump

As early as November 2016 we,, started noticing a lot of traffic referrals on our Google Analytics dashboard from lifehacĸ and Secret.ɢ A bit of excitement brewed as for a few minutes I started thinking we had been featured and that our SEO was excellent as we were getting what looked like more than usual traffic from Google.

But, wait, look closely. lifehacĸ and Secret.ɢ are not the same as the well known and Sergey's and Larry's Upon a bit of investigation and tracking down, we came across the name Vitaly Popov via WHOIS. It turns out Popov went on to register websites that use the Cyrillic version of letters like C and K in, swapped out for с and к, and Cyrillic ɢ replaced the first G in which may appear the same, but instead are not and direct visitors elsewhere.

Google Analytics
Spam referral traffic from ɢ (not

In our case, Popov is using these domains to spam almost everyone's Google Analytics with "fake traffic" which appears legitimate, exploiting a "Language setting" variable on Google Analytics and including pro-Trump messages when you dig further on your Analytics dashboard. Although we noticed different spam messages (on Google Analytics) that came with the spam traffic, they all were pro-Donald Trump like this one that read "“Secret.ɢ You are invited! Enter only with this ticket URL. Copy it. Vote for Trump!,”"

At this point you might be asking, "What is the point of all this Google Analytics referral spam?"

It seems that Popov and others who create such referral spam and fake traffic hope that upon seeing their "fake" URLs in Google Analytics you will trace them back and in turn visit their websites trying to find where your website was linked to only to generate real traffic to his site with your visit, something which I did upon seeing the referral traffic. In turn, one can guess,improves Popov's sites PageRank, traffic etc.

This spam traffic can be filtered out, luckily, but it has me asking firstly "why hasn't Google stopped this?" and secondly, if it is possible for digital media websites to create a similar exploit to "spoof" traffic and boost their numbers to impress advertisers? 🤔