goo.gl referral spam

When testing sites I always check the Hostname report in Google Analytics, to make sure I’m not accidentally including local or staging traffic in my clean profile.

Lately there has been traffic from www.goo.gl/Qv87. On every site I check.

Rather than visit the actual site, which is what they actually want, I googled the actual link and found a thread at http://productforums.google.com/forum/#!msg/webmasters/EHQ2LuT_X-A/zViZzOOEQlcJ

Basically some guy is using the free Google URL shortener (goo.gl) to trick people into visiting his site. People look at the url, assume it’s some kind of authentic Google site, and click on it. It redirects to an affiliate link which will place a cookie on your computer, so if you ever buy from the site in the future, he will receive a commission.

But how does he get his URL to appear in your analytics?

Google Analytics isn’t fussy. If a website has your analytics account number UA-xxxxxxx-xx on it, it will send traffic to your analytics account.
There’s nothing stopping people from writing a script that cycles through every UA number from 0 to 99999, and sends pageviews to that account.

He’s relying on the fact that people will investigate the link.

Ingenious, really. But it does mean that I no longer trust goo.gl shorteners. The damage to Google’s (and other URL shorteners) reputation is a sad side effect of spammers.