WordPress.org

Ready to get started?Download WordPress

Forums

[resolved] Am I getting hacked? Strange referrer on my site stats from 2x.com (12 posts)

  1. monicadube
    Member
    Posted 8 months ago #

    Hi everyone,

    I'm a freelance writer and I use WordPress for my business website (www.monicadube.com).

    Recently I've been seeing a strange referrer on my site stats from "www.2x.com." The reason it's so strange is because the referring URL is exactly the same as my posts and pages, except it has 2x.com in front of it.

    For example, it will say the referring URL is something like:
    http://www.2x.com/exact-title-of-my-blog-post
    or
    http://www.2x.com/my-services-page

    2x.com appears to be cloud computing software, so why is this happening? It's a bit concerning.

    Thanks.

    -Monica

  2. kmessinger
    Volunteer Moderator
    Posted 8 months ago #

    I don't believe you are getting hacked. You can always check at http://sitecheck.sucuri.net/scanner/

    You might drop 2x an email and hope they respond. When you click on the referrer url it 404's? I get some referrals from double-click advertising that 404. I have nothing to do with them and run no ads anywhere. I would think it is one of those questions that doesn't have an answer unless going into quantum physics.

    Someone else?

  3. monicadube
    Member
    Posted 8 months ago #

    Thanks so much for that link. I'm in the clear as far as hacking goes. And yeah, the links just 404 when I click them.

    In the meantime, I've emailed 2x.com, so I'll let you know what they say.

    Thanks for your help!
    -Monica

  4. burnedbrass
    Member
    Posted 8 months ago #

    I have the same concern as above; except when I click on the referrer url (2x preceded by my post or page,) it points to a page that says, "The domain 2x.cc is listed for sale. Click here to inquire about this domain name."
    When I click on their their inquiry link, it directs me to a Bodis(dot)com.

  5. pazzaglia
    Member
    Posted 8 months ago #

    I'm having the same kinds of referrals showing up - and its no small number - yesterday they were 10% of my traffic. Multiiple "refers" for about 100 pages - one page had 492 referrals.

    I used their tech ticket service to ask what's happening.. anyone find out anything else in the meantime?

    Ciao,

    L

  6. monicadube
    Member
    Posted 8 months ago #

    As of today, 2x.com still has not responded to my email, so I haven't found out anything else. In the meantime, I continue to get these weird referrals from them.

    -Monica

  7. pazzaglia
    Member
    Posted 8 months ago #

    Something is definitely fishy because I used their support ticketing system to send a request and when I clicked to check "on the status" of my request the ticket had been deleted.

    Well, I'm running my website through PageSpeed (google's content chaching network) and I have the ability to block requests from specific domains and IP's.

    I just put up a block for the following IP's..
    204.202.20.2
    74.208.7.14

    Let's see if the referral traffic from 2x.com goes down if they can't snag my content.

    In the meantime, am open to any other suggestions on how to track and block this apparent content and traffic thief.

  8. Carolyn
    Happiness Engineer
    Posted 7 months ago #

    @monicadube: I'm with Jetpack support and we were contacted by someone from 2x.com to see why your stats are reflecting links from their website when those pages don't exist on their site.

    We're investigating to see if there are any conflicts with Jetpack and any services that are using the RetinaJS JavaScript library as we found this GitHub support thread that is also showing the "2x.com" referral in their Jetpack stats.

    I'll post an update here once we have more information to share!

    Thank you!

  9. Carolyn
    Happiness Engineer
    Posted 7 months ago #

    I have an update! Our developers discovered a bug in the RetinaJS library that was replacing URLs with "2x" and was causing those URLs to be listed as referrals instead of views in your stats.

    We'll be filtering those results in your Jetpack stats moving forward, and one of our developers has submitted a patch to RetinaJS to fix this issue. Here's a link to the patch request:
    https://github.com/imulus/retinajs/pull/115

    I hope that clarifies things!

  10. monicadube
    Member
    Posted 7 months ago #

    Thanks so much for your help! So, the reason why my page URLs were duplicated (after the 2x.com part) was because those pages were actually being visited, correct?

  11. Carolyn
    Happiness Engineer
    Posted 7 months ago #

    So, the reason why my page URLs were duplicated (after the 2x.com part) was because those pages were actually being visited, correct?

    Yes, but more specifically they were being visited by users who were viewing your site on a Retina device and the bug in that JavaScript library was causing the URL to be appended.

    Going forward you shouldn't see those URLs in your stats and hopefully the RetinaJS developers will deploy that fix soon.

  12. monicadube
    Member
    Posted 7 months ago #

    Great, thanks! :)

Reply

You must log in to post.

About this Topic

Tags