A brute solution to referrer spamming (Apache+PHP)

[Bisqwit]

Recently, I've received a lot of medicin-selling-site spam via the referrer field of HTTP accesses, and all such hits are logged into the access log, annoying me to no end.
Thousands of those hits in day.

I just discovered a solution.

First, in my Apache configuration, I have these rules, which redirect those spam-referrers into a specialized error message, regardless what they were searching for. This is designed to prevent them from exhausting my server's resources by roboting heavy pages.

RewriteCond %{HTTP_REFERER} ^spamsite1$ [OR]
RewriteCond %{HTTP_REFERER} ^spamsite2$ [OR]
RewriteCond %{HTTP_REFERER} ^spamsite3$
RewriteRule ^/ /errors/error-spamref.php [L]

This error-spamref.php, is a relatively light PHP page, which displays an informative message ("the site you're referred from has been recently used in referrer-spamming, blah blah blah").
As the last line, this PHP file contains the following line:
flush();preg_match('@b((?<!a)b)*b@', str_pad('',16000,'b'));

This last line is a PHP command which crashes the PHP interpreter. If the PHP interpreter is loaded as a module in Apache, it will crash the Apache thread too.
When an Apache thread crashes, the hit will not be logged in the access log. The rest of the server is not affected.

Therefore, this solution prevents those spam hits from appearing in my access logs, removing the annoyance with some cost of CPU time and network traffic.

If you use mod_gzip, remember to disable the gzipping for the error message page or the accidental visitors won't see the error message at all.

[Bisqwit]

Oh btw, if your PHP supports the posix_* family functions, you can use this instead of the preg crash. It's much cleaner, and has the same end result.

flush(); posix_kill(posix_getpid(), 9);

[studio42one]

I have a similar problem on my server, an odd set of referring urls. My server is a GoDaddy virtual host - I tried using htaccess to mod-rewrite when the referrer has a certain IP address but it doesn't work on their servers for some reason?!?

Any other ideas how to stop this WITHOUT htaccess?

Thanks!

[killroy]

Erm, crashing your server seems a little silly jsut to avoid a log line... why not just tell apache not to log that line?

I use this line to tell apache to log only if the environment variable "dont-log" isn't set:

CustomLog logs/access.log complete env=!dont-log

And I use this to set the variable:
<LocationMatch "(\.(gif¦jpg¦png¦ico¦css¦js)¦robots\.txt)$">
SetEnv image-request 1
SetEnv dont-log 1
</LocationMatch>

This stops logging of images and other files. just put your special file there.

SN

[Bisqwit]

It's only the current process that is killed, not the whole Apache.
I agree it's somewhat brute (as indicated in the topic), but it works and doesn't seem to have side-effects.

I'm aware of the env-feature as well, but in the current setup, it would require me to scatter the spam-fighting code in multiple configuration files, which wouldn't be nearly as tidy as this current solution is.