buttons-for-website.com

I guess the connection with Juiz Social Post Sharer was wrong from the beginning.

Whether buttons-for-website.com (and sharebutton.net behind it) is reliable or not, I have removed the sharebutton-script from all of my sites. It does connect to Twitter, Facebook and so on indeed but it is unclear what it does more with spamming as possible consequence?

I feel responsible for my visitors so as long as it is not proven reliable these buttons are banned from my site.

Perhaps somebody has an opinion about (the reliability of) sharebutton,net?

I sense some disingenuous disclaimers above ….
the fact is that spam referrals generate artificial traffic for the referral website which in this case was buttons-for-website.com
To insinuate there is no complicity on the part of buttons-for-website.com is naive to say the least.
There are many companies that provide share button mechanisms that don’t use spam to build their business.
All my sites (dozens) were not WP but were ordinary landing pages. I track them using statcounter.com which is how I picked up on what was happening.
Spam itself is normally not malicious but extremely annoying as well as time consuming which equates to losing money aka damaging

@coralights

Talking for myself, I didn’t mean to insinuate whatsoever. What I want is to be very certain that using links on my site does not have nasty consequences. It is very well possible that in this case it doesn’t.

But I want to be sure that it does not indeed. Some discussions gave me an unpleasant feeling and so I decided to remove the script.

If you are concerned, go in or have your host deny their ip address.
Website: buttons-for-website.com buttons-for-website.com
Site geolocation: Netherlands [NL]
IP address: 217.23.8.124 (Sites on IP)
Host name: customer.worldstream.nl
DNS servers: ns1jlp.name.com (184.172.59.31), ns2nsw.name.com (98.124.246.1), ns3fqs.name.com (98.124.246.2), ns4fmx.name.com (98.124.216.41)
Server type: nginx/1.6.1
CMS, scripts… : LI Stats
Registration date: 27-10-2014 (10 days ago)
Expiration date: 27-10-2015 (354 days left)

Mo ?? https://proapc.com

You can probably do that using Wordfence but I honestly dont think its dangerous.

Netherlands, my own country!
But that fact is not enough to reassure me… ??

The site(name) is new. I guess we will hear more about it.

Regards to all!

I also started getting these referrals yesterday. I just got rid of semalt, and here we go again.

These referers are independent of WordPress or the Juiz Social Post Sharer plug as they are also seen on sites without any of these.

It looks to me like referer spam by some criminals. Why?
1. The requests come from various countries, so they seem to use a bot net.
2. The domain holder does not disclose his identity.

I guess they want you to visit their web site, not for legal commercial reasons, but to hack into your computer if your system has security holes in outdated software.

I recommend to ban them from your websites if you can, by a WP plugin or on Apache servers in .htaccess:

# block referer spam
RewriteEngine On
RewriteCond %{HTTP_REFERER} buttons\-for\-website\.com
RewriteRule ^.* - [F,L]

I registered at wp because I saw this topic – I have the same thing, weird referrals from here.

Personally I think it maybe related to semalt: I just got rid of them through some .htaccess stuff. They used to visit me from Brazil.

Now I notice that the pattern for this buttons stuff is: referrer visit from there (Brazil IP), then visit (Brazil IP).

Seems to me that this maybe something to get bypass htaccess things which look for and block an empty referrer string (often used by China bots, so blocked out with .htaccess on smart sites)

Anyhow the other thing to remember is that when you successfully block out sites like semalt they want some other way to get into and look at your site, ie a method like this.

Anyhow think I’ll block it. With 0 time spent on the site it’s a useless referral anyway.

^^ Good thread, handy find. Thx for the UK!!

@puda : I have the some thing and I never installed the “juiz social post sharer“, i scan with Wordfence and nothing found ??

Referrer spam is a nuisance – it skews your website stats so that you can no longer see accurate useful information such as how many people are visiting your site, where your visitors are located, how long they have spent on a particular page and what technology they are using. It also has the potential to harm your rankings in Google’s search engine results pages (SERPs).

I see that buttons-for-website.com and Semalt.com hit my website for car rental (and others) in the some time!!! so it’s a spam referrers.

The Mywot community described it as “Persistant crawler referral spammer” :
https://www.mywot.com/en/scorecard/buttons-for-website.com?utm_source=addon&utm_content=popup-donuts

And the some things with Semalt, every one have a probleme with it (https://twitter.com/hashtag/semalt)

How to block it in WordPress:
Download the Semalt Blocker

We all know how annoying it is when we see Semalt mess up our analytics data. This plugin helps you stop that from happening by referring Semalt’

Hi everyone,
we already use rewrite rules in our servers’ main config for exactly that reason. Initially I just wanted to add the line, sankari posted, but I noticed, it differs from mine.

@sankari: I noticed, you’re using shorter regexes than me. Would you elaborate, why your’s might be better suited for this? I’d be willing to post my list afterwards – then using the better syntax ??

Your suggestion:
RewriteCond %{HTTP_REFERER} buttons\-for\-website\.com
My (proposed) line:
RewriteCond %{HTTP_REFERER} ^https://.*buttons\-for\-website\.com

Best regards
Floutsch

Hi Floutsch,
Thanks for your post. In my view, both solutions should do the job. The first one requires a little less typing, so it suits lazy people ?? However, that’s the only advantage I see.

Hi and thanks @sakari,
as promised I will post my block list here:

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_REFERER} ^https://.*backgroundpictures\.net/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*embedle\.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*extener\.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*fbfreegifts\.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*feedouble\.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*feedouble\.net/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*joinandplay\.me/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*joingames\.org/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*kambasoft\.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*musicprojectfoundation\.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*myprintscreen\.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*openfrost\.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*openmediasoft\.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*savetubevideo\.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*semalt\.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*softomix\.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*softomix\.net/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*softomix\.ru/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*soundfrost\.org/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*srecorder\.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*vapmedia\.org/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*videofrost\.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*videofrost\.net/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*youtubedownload\.org/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*zazagames\.org/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*buttons\-for\-website\.com [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*darodar\.com/ [NC,OR]
RewriteCond %{HTTP_REFERER} ^https://.*7makemoneyonline\.com/ [NC]
RewriteRule ^(.*)$ – [F,L]
</IfModule>

As a remark for others who find this by googling: Keep the entry with only “[NC]” at the end as the last one of your list.

I found a blog that has a list of approx 8.000(!) bad referers. As they do, I also discourage anyone from simply taking that list and slapping it on their server. The diction of the blogger feels a bit weird to me, but anyways: https://perishablepress.com/4g-ultimate-referrer-blacklist/

Best regards
Floutsch

Thank you, @motivmedia, for your thorough list.

Perishable Press is an excellent source. Jeff Starr, the site’s author, has written several books on WordPress and development in general. That said, however, 8000 is excessive for small-time bloggers like me!

I appreciate you sharing your work here. I may use your list verbatim. Thanks again.

If anyone is looking for an IP list of motivmedia’s block list, it is here:

109.236.81.84
199.59.243.120
217.23.11.135
217.23.11.15
217.23.2.19
217.23.7.112
217.23.7.180
217.23.7.19
217.23.8.124
50.16.241.41
78.110.60.230

Some of the sites were actually hosted on the same IP.