Stats Referer Spam Moderation, Like Blogger Comment Moderation, Is Collaborative

Some blog owners just do not understand the realities of referer spam moderation.

How can I set my dashboard, to not track pageviews from referring sites like "vampirestat . com"?

Not everybody understands that Stats was not designed for catering to individual preferences, in deciding what statistics should be displayed.

Stats spam moderation was not designed to allow for individuals to decide on what figures to display - or ignore. Like Blogger Comment moderation, Stats is collaborative, fuzzy, and heuristic.

Collaborative systems work best when everybody is subject to the same restrictions. Blogger / Google can best fight referer spam by monitoring all activity, against all blogs, uniformly.

Stats displays show the top 10 entries, in every list.

Some referer spam, like some genuine traffic, is not displayed, simply because at least 10 other traffic sources (bogus or genuine) are displayed.

Since newer blogs, with less established real traffic, are more vulnerable to referer spam, owners of newer blogs are more likely to demand individual filtering options. Owners of more mature blogs, who have devoted more time to publishing their blogs, don't see the spam, and don't worry about filtering it.

If individual blog owners were given the choice of what "traffic sources" should be filtered, for each different blog, they would waste more time examining their Stats displays, recording what sources appear spammy, and updating their filters. This would leave them less time for maintaining and publishing their blogs.

Given this possibility, referer spammers would be encouraged to tune their attacks, and to focus their attentions upon newer blogs, to encourage the newer owners to waste more time maintaining filters. In some cases, this could even enable referer spammers to conduct DOS attacks against blog owners who are naive enough to believe that they can effectively identify and filter referer spam.

With individual blog owners given the ability to individually filter Stats displays, referer spammers would be better able to conduct DOS attacks against innocent, third party blogs and websites.

Like every other righteously needed Blogger enhancement, adding individually maintained Stats filters would make Stats more complex. This would require Blogger Engineering to spend more time developing a feature demanded by a minority of blog owners - and spend less time developing and maintaining other, more essential features.

It does not require too much imagination to suspect the legitimacy of some of the unhappy blog owners.

Why does Blogger not give me the ability to decide, for myself, what traffic sources that I want to monitor?

Some of these might even be the referer spammers, forcing Blogger Engineering to develop features that, in the long run, would benefit the spammers as much as the blog owners.

>> Top

Anonymous Blog Ownership, And Hacked Account Detection

This week, we're seeing a number of reports from blog owners with Blogger accounts recently hacked.

I was asked to change my password, because of suspicious activity. Having done that, my blogs are now deleted!

With hacked Blogger / Google accounts, causing deleted blogs, there's not a lot of advice that we can provide.

As you just discovered, the account is recovered almost immediately. Blog recovery, unfortunately, takes longer - sometimes, 1 to 2 days. You'll have to wait, patiently, until your blogs are verified by Google Security staff.

We're also seeing the normal amount of reports of blogs deleted by Blogger, when detected for malware, porn, or spam. In some cases, blog review ends with the conclusion that the blog was not, in fact, deleted for a TOS violation. In these cases, the blog won't be restored by Blogger Support.

In some cases, blog review - which starts with a claim of spurious classification for malware, porn, or spam hosting - ends with advice to have the owning Blogger / Google account recovered.

The blog owner has to wait until the review process is complete, to learn where he should have started, days ago. As I've observed a few times in the past, anonymity - whether intention or accidental - can cause problems with blog ownership. If your Blogger / Google account is locked, but you don't get the required notification, you can waste valuable time with the blog offline.

Whether you intentionally anonymise yourself - or accidentally create a second (or third) Blogger account, you may not get essential email from Google, advising you to recover your account. When that happens, your blog will stay offline until it can be reviewed - and review starts only after you recover the account that was locked.

Now, you're going to have to open every possible email account, and carefully look for the overlooked email. If you never find the missing email message, you're going to have to login to Blogger, using every possible email address that you may have ever used, until you hit the locked Blogger account.

When you do identify the locked account, you'll get the advice to change your password, solve a CAPTCHA, and / or answer a number of secret questions, to prove that you are the account owner. Or, if you're lucky, you can await a phone call (digital or voice) with a special code, to unlock your account. Either way, you'll be unlocking the account while under stress, with the blog offline.

And after you get the account unlocked, you'll still have to wait until the blog(s) can be verified.

If you try to blame Google, for this disaster

Why was my blog deleted? I did not spam!

you will simply be wasting your time. This is yet one more story that starts with gratuitous and uncontrolled creation of multiple Blogger accounts and email addresses.

>> Top

Hacking Detection Is (Generally) Not The Fault Of The Blogger Account Owner

We've been helping Blogger blog owners deal with spurious fuzzy content classification, for many years.

We started out, long ago, with blogs deleted because of spam classification. Later, Blogger added malware classification - and most recently, porn classification ("adult content", with objectionable advertisements). These three classification categories involve fuzzy blog content analysis.

A fourth category, which similarly results in blog(s) being deleted, I describe as "hacking detection". This category complements the other three, because the primary symptom of all four are remarkably similar.

Help me! Blogger has deleted my blog!!

This is a frequent complaint, seen in Blogger Help Forum: Something Is Broken.

One problem with using the term "hacking" is that some account owners take this diagnosis personally.

Why do you mention hacking? I am not a hacker!

And in almost all cases, the owners are correct.

Blogs are deleted by Blogger, currently, because of several different reasons.

1. DMCA Violation.
2. Hacking detection.
3. Malware detection.
4. Porn detection.
5. Spam detection.

I list the different categories, collectively, because they are frequently reported, using the common symptom.

My blog was deleted, and I did not do it!

DMCA, malware, porn, and spam are generally based on what the blog owner did (though in many cases, what the owner "did" was simply to publish a blog). Hacking, on the other hand, is generally based on action by someone other than the blog owner.

DMCA, malware, porn, and spam classifications are based on content analysis (automated), or complaint (manual) - and these classifications can be somewhat avoided by the blog owner. Don't steal content or publish a blog containing malware, porn, or spam, to reduce your chance of having the blog classified.

Hacking detection, on the other hand, is based on analysis of Blogger account traffic - and this classification can not be avoided, as easily, by the blog owner. Hacking generally involves use of a cloud of computers, to systematically break into a Blogger account owned by the victim.

Though frequently, a hacking attack starts with unintentional disclosure of personal information by the victim, actual hacking activity is typically not initiated by the victim.

Detection of hacking attacks is best conducted by Google, because they can look for repetitive activity against multiple Blogger / Google accounts, from multiple computers located worldwide.

• Most account owners can login to their accounts in one or two tries.
• Very few account owners will, intentionally, attempt to login to their accounts, concurrently, from computers in Argentina, USA, and Zaire.
• Very few computers will be used to access Blogger accounts owned by people in Brazil today, in China tomorrow, and in Denmark next week.

Recovery from hacking detection requires willful action by the victim - though Blogger makes the required action so simple, its purpose becomes transparent. The victim, or account owner, is simply required to change the account password, solve a CAPTCHA, and / or verify account ownership by providing various personal details.

Having initiated hacking recovery, the account owner is able to login to Blogger - but is greeted by an empty dashboard.

You are not yet the owner of any blogs. Create a blog, and get started!

This is where the confusion starts.

Not all Blogger account owners personally publish a blog. Some people setup Blogger accounts simply to comment on, and / or Follow blogs published by other people - and won't, necessarily, publish a blog using the account in question.

Blogger accounts with no owned blogs may still be under attack by hackers - and are subject to hacking detection. This makes the primary symptom so confusing.

You are not yet the owner of any blogs. Create a blog, and get started!

People who don't own any blogs (under this Blogger account) may, or may not, see this as a problem.

In cases where the initial symptom is a deleted blog, the blog owner must recover the hacked (locked) account, before the blog can be recovered. This is one more scenario where unplanned, anonymous blog ownership, just causes more confusion.

Having initiated hacking recovery, a blog owner is simply expected to wait patiently, until the blogs owned by the account are verified as free of content added by the hacker. Unfortunately, we sometimes see the blog owner, impatiently reporting in Blogger Help Forum: Something Is Broken.

I had to change my password, and having done that, Blogger deleted my blog!

Sometimes, hacking detection starts with the Blogger account owner, repetitively trying to recover access to the account, by sequentially trying every possible password (sometimes trying the same password, repeatedly).

I know it's one of these! But which one? Did I maybe type the one, incorrectly??

This repetitive action looks the same as any malicious hacking attack - and that is why hacking detection is so hard to canonically diagnose.

Please, consider these details, the next time you post your problem report.

Help me! Blogger has deleted my blog!!

In some cases, I may respond with a mention of hacking detection. If I do that, please don't take my response as a personal attack upon you.

Why do you mention hacking? I am not a hacker!

Even though being the victim of a hacking attack is not the fault of the account / blog owner, that person may still have to bear some of the responsibility. In general, blog owners have to support themselves - learn how to protect themselves, and use 2-step verification.

>> Top

"Adult Content" Blogs, And New Blogger Monetisation Restrictions

This week, we're seeing some reports from a few blog owners who recently received a disturbing email message, mentioning their blogs and adult advertisements.

I received an email stating I have adult content on my blog, and that a new policy will cause certain blogs to be deleted. Is my blog vulnerable to deletion, under this new policy?

Like many spammers, these blog owners may be asking for a whitelisting of their blog - which is something that Blogger just won't provide.

The legendary email, recently received, is somewhat ambiguous in wording.

You are receiving this message because you are the admin of a blog hosted on Blogger which is identified to have Adult content.

Please be advised that on June 30th 2013, we will be updating our Content Policy to strictly prohibit the monetization of Adult content on Blogger. After June 30th 2013, we will be enforcing this policy and will remove blogs which are adult in nature and are displaying advertisements to adult websites.

If your adult blog currently has advertisements which are adult in nature, you should remove them as soon as possible as to avoid any potential Terms of Service violation and/or content removals.

The policy discouraging monetised "adult content" blogs is not new - we have actually been warning people about this for years, in the Malware / Spam Appeal Guidelines. We cite the Guidelines a dozen or so times daily, in various malware and spam review discussions in Blogger Help Forum: Something Is Broken.

Blogger / Google has repeatedly stated that some blog content is not acceptable, because it constitutes or encourages abusive activity, such as hacking, porn, and spam, in the Blogger Internet space.

Here is the current list of examples, developed by Blogger / Google, and the Top Contributors of Blogger Help Forum.

• Affiliate marketing (Please, don't confuse this with "affiliate networking"!).
• Automated traffic redirection, to another Blogger blog, or to non Google hosted content.
• Commercially funded adult content.
• Content created with scripts and programs, rather than by hand.
• Content or links which reference account hacking / password distribution / password sharing.
• Content or links which reference code deconstruction / reverse engineering, to bypass normal use of proprietary
• software.
• Content or links which reference referral-based activities such as GPT ("Get Paid To"), MLM ("Multi-Level Marketing"), MMF ("Make Money Fast"), MMH ("Make Money from Home"), PTC ("Pay To Click"), or PTS ("Pay To Surf").
• Content scraped from other blogs / websites.
• Copyright Infringement.
• Large blogs with multiple, unfocused / unrelated subjects.
• Links to Illegal Downloads / Streaming / Torrents.
• Monetizing of adult content, aka porn spam.

The specific blogs, targeted by the email, are not difficult to identify. "Adult Content" blogs will generally bear an interstitial "Content Warning", awarded either voluntarily or involuntarily.

In odd cases, people may receive the email, but may not have any blogs affected by the policy - and in this case, they will simply have to ignore the email. Blogger Support can only review blogs, when they are actually deleted or locked.

In other cases, people may not receive the email. Just as with malware and spam classifications, all blog owners won't be contactable by email.

If the adult content classifier is designed similar to the malware and spam classifiers, it will use a fuzzy detection process to identify the undesirable "adult content" advertisements.

Since fuzzy malware / spam classification does not support whitelisting, porn classification won't either. Blog owners asking "Is my blog safe?" are unlikely to get any useful answers.

My suspicion is that owners of the most popular and productive "adult content" blogs will move to alternate hosting. Some of them may relocate to WordPress - until WordPress, similarly, rejects them.

Some owners, choosing to remain in Blogger, will take the warning seriously, and remove any ads.

If your adult blog currently has advertisements which are adult in nature, you should remove them as soon as possible as to avoid any potential Terms of Service violation and/or content removals.

Various possible "adult content" blogs, with and without "adult advertisements", remaining in Blogger hosting, will be classified and deleted, and will result in more reports in Blogger Help Forum: Something Is Broken.

Why was my blog deleted?

We'll simply end up with more discussions with requests for review and reinstatement - and more uncertainty. Some blogs will be restored promptly, with others requiring careful deliberation. And some blog owners will simply be told

Sorry, your blog cannot be restored. It was recently confirmed as a adult content host, with unacceptable advertisements.

>> Top

Empty Or New Blogs Can Be Classified As Possible Spam Hosts

We're seeing a few recent reports, in Blogger Help Forum: Something Is Broken, from owners of empty and / or new blogs, about spurious spam classification.

Very few owners of empty or new Blogger blogs understand why their blogs should be classified as possible spam hosts, by the Blogger anti-spam processes. Most blog owners seem to think that only blog content is considered, in spam classification.

Spam classification considers many characteristics of a Blogger blog, in classifying any blog as a possible spam host.

Blog content is an obvious - but not the only - factor in spam classification. Given previously observed behaviour of spammers, many characteristics of blogs, besides simply the extracted and analysed content, are used in classifying possible spam blogs. Using fuzzy spam classification techniques, one might also consider

• Overall behaviour in Google, by the owner.
• Past posting habits of the owner.
• Previous classification of similar blogs.

Some spammers are active in multiple Google activities and features. It's possible that some spammers even try to make their spam in Blogger harder to detect, by spreading their activity across other Google functions. Some spammers may not realise that spammy activity in other Google areas can be tracked, and included by Blogger spam classifications processes.

Blog owners who use one or more techniques involved in setting up and maintaining spam blog farms may be classified as spammers - and their blogs then classified as possible spam hosts. The term "blog owner" must itself be considered fuzzily, as some spam blog farms contain blogs owned by multiple Blogger accounts and profiles. Some Blogger accounts, similar to known spammer accounts - even with no blogs owned, or with empty blogs published - may then appear as possible spam hosts.

Empty blogs, that appear similar to blogs in known spam farms, may themselves appear as possible spam hosts. Various details such as blog name, blog design, and use of various blog accessories and features, can make a blog appear similar to known spam blogs - with no other content.

Given the need for Google to reduce the volume of spam blogs, fuzzy spam classification might use any of the above details, in classifying any empty or new blog as a possible spam blog. This will, unfortunately, lead to spurious spam blog detection. Given the ability of spammers to publish multiple blogs in the Blogger name space, classifying empty and new blogs is necessary, in making it possible for Google to keep up with spammy activity.

>> Top