Forum Moderators: DixonJones

Message Too Old, No Replies

.htaccess and referer spam

wanting to block a certain word if it appears anywhere in the referers url

         

doodlebee

4:11 pm on May 1, 2005 (gmt 0)

10+ Year Member


OKay, I'm sure this has a simple answer, but I have yet to find it.

I am *so* sick of referer spam. I get a lot from poker sites. For 4 months, I've tried all kinds of variations on my htaccess rewrite cond, but poker spam keeps getting through.

Could someone please tell me *what* I need to put in there to make is so that if *any* URL tries to get in my referer logs that has the word "poker" in *any* position in the URL - it gets denied access?

I would really appreciate this.

I have a list that seems to be working great for other things, but I just can't get this poker like to work at all.

Currently, this is what I have for my list (I've made it *very* short, so you don't have to see the repitition of things - it's a really long list -I just want to give a general idea of what's going on here.)

In all honesty, I don't know what some of the things do here - I pieced together my list from tutorials and searching for the last few months, and it seems to work - I just can't get past the "poker" thing.

So here goes:

RewriteEngine on

RewriteCond %{HTTP_REFERER} ^http://(www\.)?iconsurf\.com/ [NC]
RewriteRule \.(jpe?g¦gif¦bmp¦png)$ - [F]
RewriteCond %{HTTP_REFERER}!.*mywebsite\.com/.*$ [NC]
RewriteCond %{HTTP_REFERER}!.*mysubdomain\.com/.*$ [NC]
RewriteCond %{HTTP_REFERER}!^http://([^/]+)google\..*$ [NC]
RewriteCond %{HTTP_REFERER}!^http://([^/]+)altavista\..*$ [NC]
RewriteCond %{HTTP_REFERER}!^http://([^/]+)yahoo\..*$ [NC]
RewriteCond %{HTTP_REFERER}!^http://([^/]+)msn\..*$ [NC]
RewriteCond %{HTTP_REFERER}!^http://([^/]+)a9\..*$ [NC]
RewriteCond %{HTTP_REFERER}!^http://([^/]+)lycos\..*$ [NC]
RewriteCond %{REQUEST_URI}!/403.shtml$ [NC]
RewriteCond %{HTTP_REFERER} ^http://(www\.)?.*(-¦.)?adult(-¦.).*$ [OR]
RewriteCond %{HTTP_REFERER} ^http://(www\.)?.*(-¦.)?nude(-¦.).*$ [OR]
RewriteCond %{HTTP_REFERER} ^http://(www\.)?.*(-¦.)?porn(-¦.).*$ [OR]
^http://(www\.)?.*accepted.cc$ [OR]
RewriteCond %{HTTP_REFERER} ^http://(www\.)?.*episodesusdbz/.*$ [OR]
RewriteCond %{HTTP_REFERER} ^http://(www\.)?advancedmoneyloans.*$ [OR]
RewriteCond %{HTTP_REFERER} ^http://(www\.)?zanax(-¦.).*$ [OR]
RewriteCond %{HTTP_REFERER} ^http://(www\.)?(-¦.)zindagi(-¦.).*$ [NC]
RewriteRule .* - [F]

now, the "iconsurf.com" is a website I've noticed has been stealing my bandwidth by linking to an image that is necessary on my site. No matter what I've done, I can't seem to stop him from doing this - and it irks me. So if anyone has a way to stop this from happening, too - I'd appreciate it muchly.

The first set of condition supposedly does what I want done with the "poker" issue - but that's not working. I don't know if it's because I have the "poker" one showing up laster on or what.

If anyone has any suggestions, I'd *really* appreciate it! Thanks!

Longhaired Genius

4:44 pm on May 1, 2005 (gmt 0)

10+ Year Member



Is iconsurf looking for a .ico file?

Personally, I don't try to match the whole referrer when banning a site, just a fragment will do. I would try:

Options +FollowSymlinks
RewriteEngine on

RewriteCond %{HTTP_REFERER} poker
RewriteRule .* - [F]

doodlebee

9:56 pm on May 1, 2005 (gmt 0)

10+ Year Member


You are so kidding me - it's that simple?!

Thanks!

And yes, iconsurf is linking to my icon file. Irritates me to no end!

Longhaired Genius

9:06 am on May 2, 2005 (gmt 0)

10+ Year Member



You haven't forbidden requests for .ico files.

doodlebee

2:12 pm on May 2, 2005 (gmt 0)

10+ Year Member


Actually - yeah, I had - I just gave you what was in my hard drive (which I changed the jp?g etc. to ".ico"[smilestopper]) - I just never changed the stuff in the text file - sorry!

keyplyr

8:30 am on May 3, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



My experience is Iconsurf obeys robots.txt:

User-agent: IconSurf
Disallow: /

The less you have in .htaccess, the less needs to process every single time a request is made.

doodlebee

4:16 pm on May 3, 2005 (gmt 0)

10+ Year Member


Tbanks! I'll give that a shot, too :[smilestopper]) I appreciate it!