Referral Spam from News Greets Store (Poland): A Comprehensive Investigation

In recent discussions, led by Giulia D’Alfonso, users have shed light on a notable challenge involving referral spam from News Greets Store (Poland), causing disruptions in Google Analytics (GA4) data. The emergence of fictitious users from Poland in GA real-time reports has triggered concerns among website owners.

Identified Similar Domains: Several websites are grappling with analogous issues.

Community Insights: Contributions from users like Attila Bogozi, Usama Ahmed, User Brooks, Sergey_S, David Troup, and others reveal shared experiences and discussions on potential solutions. Conversations also delve into the implications for website analytics and engagement rates.

Domain Investigation: Syndu Web has provided domain registration details for news.grets.store:

• Domain Name: GRETS.STORE
• Registrar: RU-CENTER
• Registrar URL:RU-CENTER
• Registrant Organization: Privacy protection service – whoisproxy.ru

Addressing the Issue:

1. Blocking Unwanted Referrals:
   • Users have experimented with blocking suspicious activity through GA settings, yielding mixed results.
2. Engaging Registrar and Privacy Protection Service:
   • Direct outreach to RU-CENTER, utilizing their abuse contact.
   • Escalating the matter to ICANN if necessary.
3. Sharing Domain and Hosting Providers:
   • Encouraging users to disclose domain names and hosting providers to identify potential commonalities.

Common Fix:

Users have implemented a common fix by adding specific rules to their .htaccess file:

apache

# BEGIN Block Crawler Referral Spam
RewriteEngine on
  RewriteCond %{HTTP_REFERER} ^https?://([^.]+\.)*news\.grets\.store\.com/ [NC,OR]
  RewriteCond %{HTTP_REFERER} ^https?://([^.]+\.)*grets\.store\.com/ [NC,OR]
  RewriteCond %{HTTP_REFERER} ^https?://([^.]+\.)*news\.grets\.store/ [NC,OR]
  RewriteCond %{HTTP_REFERER} ^http://news\.grets\.store/ [NC,OR]
  RewriteCond %{HTTP_REFERER} ^http?://([^.]+\.)*news\.grets\.store/ [NC,OR]
  RewriteCond %{HTTP_REFERER} ^https?://(www\.)?news\.grets\.store\.com/ [NC,OR]
  RewriteCond %{HTTP_REFERER} ^https?://(www\.)?news\.grets\.store/ [NC,OR]
  RewriteCond %{HTTP_REFERER} ^https?://(www\.)?grets\.store\.com/ [NC]
RewriteRule .* - [F]
# END Block Crawler Referral Spam

Final Considerations: Report the issue directly to Google and adhere to best practices to prevent Personally Identifiable Information (PII) in GA reports.

This collective endeavor seeks to unravel and resolve the persistent challenge of referral spam affecting multiple users. Valuable insights and solutions are welcomed to enrich the ongoing community discussion.