Free tool Referrer spam checker for a whole list of sources
Paste the referring domains from an analytics report or a server log. Each one is checked against the community-maintained Matomo referrer spam list, and the ones that match are turned into a GA4 filter, an Nginx map, Apache rewrite rules or a Cloudflare expression.
- 2,355 listed hosts
- List version 2026-11-10
- Runs locally
Check referring domains
One source per line. A domain, a full referrer URL or a GA4 source / medium row all work; a number after it (tab, comma or two spaces) is read as visits. The sample is a GA4 export with four spam domains in it.
Header rows, (direct) and source names such as google are skipped. Repeated domains are merged.
Referrers from this domain and its subdomains are marked as your own.
Built only from the domains that are on the list.
Domains checked
8
On the spam list
4
The domain or a parent domain is listed.
Partial match
0
Contains a listed name; check by hand.
Visits from listed domains
6.5%
Share of all visits in the pasted rows.
Every domain
"Known source" means TapCub's own lists of search engines, social sites and AI assistants. "Not listed" is not a guarantee: new spam domains appear faster than any list.
| Line | Domain | Result | Visits |
|---|---|---|---|
| 4 | semalt.com | Listed | 312 |
| 5 | l.facebook.com | Known source: Facebook | 260 |
| 6 | darodar.com | Listed | 95 |
| 7 | forum.buttons-for-website.com | Listed as buttons-for-website.com | 41 |
| 8 | chatgpt.com | Known source: ChatGPT | 38 |
| 9 | news.ycombinator.com | Known source: Hacker News | 22 |
| 10 | partner-blog.example | Not listed | 12 |
| 11 | ilovevitaly.com | Listed | 9 |
Notes
- Note1 row(s) such as (direct) / (none) are not referrers and were skipped; their visits still count in the total.
- Note1 row(s) are source names rather than domains (such as google / organic) and were not checked; their visits still count in the total.
(.+\.)?(buttons-for-website\.com|darodar\.com|ilovevitaly\.com|semalt\.com)GA4: use "Session source" with "does not match regex" in a report filter or comparison; one regex per line, at most 250 characters each. Server rules block requests that carry these referrers; they cannot remove hits that never reached your server.
Version v1.0Updated Update history
Listed, partly listed, or simply unknown
The list is a blocklist, not an allowlist. A match is strong evidence; no match is only the absence of evidence.
Listed
The domain, or a domain it belongs to, is on the list. forum.buttons-for-website.com counts because buttons-for-website.com is listed, which is how Matomo treats subdomains. These are safe to exclude.
Contains a listed name
The name appears inside a longer domain. Matomo itself matches this way and would filter it, but short entries can catch unrelated sites. Look at the site before blocking it.
Known source
On TapCub's own lists of search engines, social networks or AI assistants. A listed name inside one of those is ignored.
Visits from listed domains
Only shown when the rows carry visit counts. Compare it with your conversion rate: spam visits never convert, so a high share drags every rate down.
The list is maintained by the Matomo community and published as public domain. Its README says it may be incomplete and may contain outdated entries; this page uses the version of 2026-11-10.
Clean a referral report in three steps
Most useful when an unfamiliar domain suddenly appears near the top of your referrals.
-
1
Export the referrers
In GA4 open Traffic acquisition, set the dimension to Session source / medium and export, or copy the Referer column from a server log. Paste it as is.
-
2
Check the matches
Listed domains are safe to exclude. Partial matches need a look; unknown domains with a sudden spike, near-zero engagement and no conversions are suspects even when unlisted.
-
3
Exclude them
Copy the rules in the format you need: a GA4 report filter for historical data, or a server rule so that crawling spammers get a 403 from now on.
Three kinds of match
Each domain is lowercased and converted to its ASCII form (internationalised names become xn--). It is then compared with the 2,355 hosts on the list.
- Source: matomo-org/referrer-spam-list, file spammers.txt, commit 6cd0b65 of 2026-11-10; licence: public domain
- Matomo ships this list with every release and updates it weekly; its README explains the subdomain rule used here
- Not affiliated with Matomo. To check one link's channel instead, use the channel classifier
| Result | Matches when | Example |
|---|---|---|
| Your domain | the domain is yours or a subdomain of it | help.shop.example.com |
| Listed | the domain is exactly a list entry | semalt.com |
| Listed as … | a parent domain is a list entry | forum.buttons-for-website.com |
| Contains … | a list entry appears inside the domain, and it is not a known source | a longer domain that includes a short entry |
| Known source | TapCub's search, social or AI lists include it | l.facebook.com |
| Not listed | none of the above | partner-blog.example |
The sample GA4 export
A store's Traffic acquisition report with ten rows, exported as Session source / medium and Sessions.
| Row | Result | Sessions |
|---|---|---|
| semalt.com | Listed | 312 |
| darodar.com | Listed | 95 |
| forum.buttons-for-website.com | Listed as buttons-for-website.com | 41 |
| ilovevitaly.com | Listed | 9 |
| l.facebook.com, chatgpt.com, news.ycombinator.com | Known sources | 320 |
| google / organic, (direct) / (none), partner-blog.example | Not checked or not listed | 6,202 |
457 of 6,979 sessions, 6.5%, come from listed domains. Removing them raises a 2.0% conversion rate to about 2.1%, and four of the eight referral rows, including the largest, disappear.
What not to do with spam referrers
Referrer spam is a nuisance for reports, not an attack on your site. The usual reactions make it worse.
Visiting the domain
Spam referrers exist to make you curious. The sites behind them often push dubious offers or malware. Check them here, not in a browser.
Relying on robots.txt
robots.txt is a request that well-behaved crawlers follow. Spam bots ignore it. Block at the server, the CDN or in the report.
Using GA4 "unwanted referrals"
That setting is for payment and login redirects: it stops a domain being counted as a new source, but the session itself is kept. To hide spam from reports, use a filter or comparison instead.
Deleting history to clean up
You can rarely delete past hits selectively. Exclude the domains in reports and note the date the spam started, so trends read correctly.
What TapCub does with suspicious traffic
TapCub does not ship a referrer spam list. These are the protections that exist today.
Hits from unregistered hosts are dropped
Data is only accepted when the page and its origin are on the domains you registered for the project, so your site key used elsewhere does not show up in reports.
Learn moreBots counted separately
Five detection layers and 197+ rules keep crawlers and scrapers out of human reports. Spam bots that pass as browsers can still get through.
Learn moreFilter by referring domain
Any report can be filtered on the referring domain to inspect a suspect source or leave one out.
Learn moreReferrer spam questions
Still have a question?
Chat with the team behind TapCub — we usually reply within a few hours on business days.
What is referrer spam?
Fake traffic sent to make a domain appear in your referral reports, so that you visit it out of curiosity. Some spammers crawl your pages with a forged Referer header; others ("ghost spam") send hits straight to an analytics endpoint without ever loading your site. Both inflate visits and drag conversion rates down.
Is referrer spam dangerous?
It does not break into your site, but the domains behind it are often linked to aggressive ads or malware, so do not open them. The real damage is to your data: inflated sessions, false referral sources and lower conversion rates.
How do I remove referrer spam from GA4?
GA4's data filters cover developer traffic, internal traffic (by IP) and web hostname traffic; none of them filters by referrer, and Google's help states they do not affect historical data. A hostname filter keeps out ghost spam that reports someone else's hostname. For reports, add a filter or comparison on Session source with "does not match regex" and the GA4 regex from this tool.
Where does this spam list come from?
From Matomo's referrer-spam-list on GitHub, a community-maintained list of 2,355 hosts in the version used here (2026-11-10), published as public domain. Matomo filters it automatically in its own product. It is not complete: new spam domains appear all the time.
Should I block spam referrers on my server?
If they actually request your pages, yes: a 403 costs nothing and keeps the hits out of server logs and JavaScript analytics. It cannot help with ghost spam, which never reaches your server; only the analytics side can filter that.
A domain is not on the list. Is it genuine?
Not necessarily. Look for a sudden spike from a site you have never heard of, close to 100% bounce, near-zero time on page, one landing page and no conversions. Those are typical of spam whether or not a list has caught up.
Does TapCub filter referrer spam automatically?
No, there is no referrer spam list in TapCub today. TapCub drops hits from hosts you have not registered, separates detected bots from people, and lets you filter any report by referring domain.
Is my list uploaded?
No. The check runs in your browser against a copy of the list that is downloaded with the page. Nothing you paste is sent to TapCub.
Update history
New features, fixes and data refreshes for this tool, newest first.
-
· v1.0
LaunchedFirst release.
Data this tool relies on
- Referrer spam list (Matomo) — checked 2026-11-10, reviewed every 3 months (next review by 2027-02-10)
Missing something or found an error? Tell us — requests that come up often go into the next update. All tool updates
Clean data starts at collection
TapCub counts humans and bots separately and only accepts hits from your own domains, so referral reports start out cleaner.