We’ve recently become aware that a Russian party is using the referrer spam tactic to target your Google Analytics data in order to open your Gmail account with a message that says “Vote for Republicans!”
A Russian spammer is employing the domain name ǧ.com (which is actually XN–JKA.COM) to spam Google Analytics accounts in the United States with fake referral traffic. A Google Analytics user will notice referral traffic from ǧ.com and become curious about the unusual, singular domain name. When they visit the ǧ.com path in their browsers they will be forwarded to:
https://mail.google.com/mail/u/0/?view=cm&fs=1&to=You&su=Vote+for+Republicans!&body=Google+officially+recommends+vote+for+Republicans!%0A%0ABest+regards,%0AGoogle%0A%C7%A7.com&bcc=i@%E1%B8%B7.com;support@google.com&tf=1.
This Gmail web path will open a signed in Gmail account and show a draft of a composed message that says “Google officially recommends vote for Republicans!”
Subject: Vote for Republicans!
Body: Google officially recommends vote for Republicans!
Best regards,
ǧ.com
The email message is addressed to you (your gmail address), support@google.com, and i@ḷ.com.
Luckily, the message is only a draft and will not actually be sent from your account.
The domain name being used has undisclosed whois information; However, according to ICANN their contact information is Russian. Furthermore, hostingchecker.com shows that the domain XN–JKA.COM is hosted by NFOrce Entertainment B.V. in Enschede in the Netherlands.
This appears to be a tactic from Russian spammers to promote the Republican party to those who have access to Google Analytics. This type of method by Russian spammers is not new and has been used many times to promote the Republican party and Donald Trump in the past.
If you want to filter the referral traffic in Google Analytics visit: What is ǧ.com and how do I filter it in Google Analytics?
