Referrer spam is an antiquated method to attempt to get visits and or links from other domains. The idea is that you are supposed to think that this great site is sending you a lot of traffic and maybe you should contact them to see about a link. It is a very old idea that might have worked in 1999, not so much today. Unfortunately there are still enough GRQ SEO people out there selling the service that it continues today.

It is bot traffic, and like any unwanted bot traffic you can use IP or referer blocking techniques to return a 403 response, but they will still be in your logs, even if they are only getting a 403. Think of them as gnats. Eventually their contract expires with an unhappy customer and they find another. :(

The general idea is that they show up on Google Analytics, webmasters are curious, they click on the link, and then get infected with a virus.

Burger vs pizza.

The final showdown.

Only one can survive.

And I'm blocking over 500-million IPv4 addresses in my router (adding to that daily) and still they're finding ways to reach my server.

I'm not sure what you are stating is accurate. The typical form of referrer spam, impact only Google Analytics. Technically it can also impact other analytic services but I'm not sure to what extent that occurs. Specifically, referrer spam is when an offending spammer makes requests directly to your Google Analytics end point. What this means is that the spammer never goes to your server, so you can't block them from your server. In the link below I explain how to effectively block it in GA.
[webmasterworld.com...]

Note: I have been noticing a rise in referrer spam where they are now faking the hostname, such that the filter described in the link above does not seem to work. But this seems to be limited to one or two hits a day (in my case).

@ClosedForLunch Pizza always wins over Berders

The typical form of referrer spam, impact only Google Analytics.

You're mistaken, or perhaps we have different definitions of the word “typical”. Classic referer spam came in the form of a direct request to your site, complete with bogus referer. The analytics-based version is newer, taking advantage of the fact that your own access controls have no effect on files that live on Google's server.

But, heehee, I sure do remember burger-imperia. (Does the site even exist? I'm ### if I'm going to check. Does it serve any purpose other than referer spam?) I used to block them by name using a bad_ref environmental variable, but since all their requests have a certain header deficiency, I no longer need to.

While looking them up, I was bemused to note that everything I've seen in the past year had the same user agent:
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.120 Safari/537.36
Is that an even remotely valid version number for Linux? Detour to access logs suggests the only human users of Chrome 37 are Androids in China and India.

They've been counting on someone to start a thread on WW to bring thousands of free visitors to the site (with a possible bonus of being featured on SearchEngineLand) :

Heh. If you go into the search engine of your choice and look up the name, all hits involve discussions of referer spam.

Further puttering-around reveals that the registrar is .ru but all the contact names are in China. Fancy that. I’m inclined to think that the referer, as such, is a red herring. Putting something--anything--in the referer slot makes you look slightly more humanoid, and then it's easiest to just use the same made-up name every time. fwiw, the site screenshot is conspicuous by its lack of anything even remotely resembling burgers.

I do feel a certain amount of pity for the assorted legitimate hamburger outlets whose name includes some variant of “Imperial”.

it might be a good time to visit the Search Engine Spider and User Agent Identification [webmasterworld.com] and study up on Blocking Methods [webmasterworld.com]

Kiddies, just remember, what goes around comes around. :)

Call it "retro spam" and deal with it like bell-bottom jeans, big hair, and pointy boots.

IOW, keep your logs out of view, deal with the 404s and don't sweat it. There are more important things to deal with.

I've registered donut imperia.





Godspeed my little friend.

I will be watching! :)