GamblingPuma.com related sites

[CCJ]

Hi All,

Is anyone experiencing an abnormal amount of hits from "GamblingPuma.com" related sites like debtpuma.com, datingpuma.com, eyepuma.com (along with 100 more)? They started for us two days ago. They all seem to be very similar looking video sites.

Here is a full list:

topcasino10.com
bestmusclerelaxer.com
myenlarge.com
topauto10.com
hotsearchpro.com
linepad.com
newshovel.com
searchspice.com
bestdietpillstore.com
datingpuma.com
debtpuma.com
digbone.com
eyepuma.com
mysleepingpill.com
searchpuma.com
topadult10.com
yesbear.com
artkitty.com
ecomint.com
toptravel10.com
cigarpuma.com
worldsfinance.com
arclane.com
searchpace.com
smspuma.com
hotlean.com
iphonepuma.com
freeshovel.com
gamblingpuma.com
liquorpuma.com
bigtimeoff.com
stopsmokingpuma.com
gourmetpuma.com
rosecrane.com
yourspade.com
bignotebook.com
smokepuma.com
finderpuma.com
topmeds10.com
mobilepuma.com
agonyrelief.com

[universal4]

Do you know what the user agent is?

Rick
Universal4

[JackTenSuited]

Probably just referer spam
http://en.wikipedia.org/wiki/Referer_spam

[CCJ]

Hi Rick - no, we're not sure who the user agent is but we have started to block the traffic from these sites. They're coming in like you would not believe! It's throwing our stats completely off.

Hi deanimus - thanks for the link and we're sending it off to our tech.

[universal4]

I randomly tried a handful of those domains and none of the ones I tried even have an index page up.

If in fact it is referral spam, I can't see what page or pages is referring the traffic since none of the pages exist.

It also could be that the server was hijacked and the host had to turn off the sites or take down the server.

Rick
Universal4

[universal4]

CCJ,

Can you determine the ip?

It could be that whatever is hammering your site is faking the referrer also.

Rick
Universal4

[universal4]

I did a ping on gamblingpuma and the ip that answers is 46.229.165.85.

Any ip other than that is likely a case of fake referrer spam, but still a problem nonetheless.

Rick
Universal4

[CCJ]

Hi Rick, Thanks for your help. I just did the same thing at whois.sc and all the ones ending in "puma.com" have the same IP that you mentioned. At least we can knock-out these ones. I don't think they can hurt us as our tech support said they just see a spike in traffic and nothing else, at this point.

[CCJ]

I've found others experiencing the same issue at http://remove-free.com/how-remove-fo...cts-fre?page=2

[universal4]

A browser or search hijacker is MUCH different then referrer spam or a possible script or hack on the puma related server that is hammering your site.

If you have real hits coming to your server whether by real visitors or by a program or script that might be scraping your sites, then that actually might have NOTHING to do with any kind o search stealer.

At one point yesterday I wondered if the puma server had their dns poisioned, but I performed some NSLookup's, directly on the puma dns server and all ip's returned appeared correct.

If in fact this traffic that you are seeing would be because of a hack on your system, then it would be YOUR ip (at home or office) that would show as the source for the hit....

My guess is that there is a scraper on the server that has the puma sites on it, and it is rotating between the domains on that server as it scrapes.

I have noticed today that some of the sites now have an index page that come up in the browser, however any with the puma name in that I have tried so far did not.

Rick
Universal4

[CCJ]

Hi Rick,

Thanks for looking into it - you've mentioned some interesting points to think about. Our server tech (which is co-located and managed) is telling us that they cannot see these hits coming through, nor is it affecting our bandwidth. But... we are seeing it on Google Analytics. Rick, there never seems to be a dull moment in this business!! When we originally saw these hits coming in, we were so happy but then we realized they were not the good kind of hits.

We also had an SEO tech that we use for advice, look at it (which we are still going back and forth). This is what they said:

That's interesting, so some malware search thing is redirecting traffic to these puma sites, which in turn must have links to your site in some place, or a search feature where you're ranking in some way.

Blocking those sites by IP won't likely work, their search engine or whatever isn't likely using the same IP's, and it might be hard to figure out what IP they use. You can't block the users that have the malware as they probably have no signature.

1 - Are the visitors all hitting the same page from these puma sites? (they're hitting all sorts of various pages)

2 - I don't really think this will hurt much as only Google Analytics can see the visits I believe. If the visits aren't coming from Google Search, the bounce "shouldn't" be an issue.

3 - You might be able to do a redirect in your htaccess file that says if http_referer contains "puma", redirect to a 404 page or other URL that has no Google Analytics code in it so your stats don't get messed up.

[universal4]

That's interesting, so some malware search thing is redirecting traffic to these puma sites, which in turn must have links to your site in some place, or a search feature where you're ranking in some way.

But this wopuld mean it was visitors, performing a search, being redirected to a puma site then in turn following a link to you....and I can't see that happening from sites that are down.

Although this could be a portion coming from Google's cached pages, but the part that doesn't fit is that google "should" still show as the referrer.

Rick
Universal4

[CCJ]

Hi Rick,

I didn't check all of the sites, but all the puma sites do all appear to be up. I don't really understand what these sites are trying to do as they all appear to be very, very similar in terms of content.

As of yesterday, they stopped coming in. Hopefully that's the end of them.

Thanks for all your input.

[universal4]

I just tried 6 or 7 puma sites and none of them come up for me and never have....some of the others do, but none of the ones I tried with the term "puma" in them has answered for me....

Rick
Universal4

[CCJ]

Perhaps it's blocking your location/country?

[universal4]

You know I was kinda wondering that myself....

Glad your issue has subsided though....

Rick
Universal4

[CCJ]

Us too Rick!!!