Forum Moderators: phranque
I currently have a website that is being spammed and the bandwidth used up is about 16-20 gb per day. I checked the cpanel's latest visitors and it shows that every few seconds a unique visitor will visit my website. Under the logs, it shows these:
Host: 72.130.***.147 /picture/abc.jpg
Http Code: 200 Date: Aug 22 12:15:21 Http Version: HTTP/1.1 Size in Bytes: 14099
Referer: http://www.example.com/?hop=sslorder
Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)
/?hop=sslorder
Http Code: 200 Date: Aug 22 12:15:21 Http Version: HTTP/1.1 Size in Bytes: 146526
Referer: 1
Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)
/WMM_TYPE01_BLUE.SWF?f=def.mp3&m=manual&l=no
Http Code: 200 Date: Aug 22 12:15:21 Http Version: HTTP/1.1 Size in Bytes: 805
Referer: http://www.example.com/?hop=sslorder
Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)
and a lot of other files with the same referer http://www.example.com/?hop=sslorder where www.example.com is my own website. And each time the "Host" shown in the log is different. I heard that rewriting the url based on the referer will help but I have no idea on how to start. And will it cause other referers like http://www.example.com/?hop=realaffiliate to be unable to visit the website? Urgently need help. Thanks.
[edited by: jdMorgan at 9:34 pm (utc) on Aug. 22, 2007]
[edit reason] Exampl.com. obscured IP address [/edit]
Jim
actually the site index is an html file without any scripts. Hop is just a clickbank affiliate style of identifying the user i supposed. There are no variable of "hop" mentioned in any of my pages. But I've checked the affiliate database that this sslorder is not in my affiliate database.
Jim
Options +FollowSymLinks
RewriteEngine on
RewriteRule ^foo\.html$ http://www.google.com [R=301,L]
This will decide:
Whether you can use mod_rewrite
Whether you need, and are allowed to set Options
Whether mod_rewrite is installed and allowed on your server.
If you get a 500-Server error right away, delete the first line - The "Options" line. This line will either be needed and allowed, won't be needed, but will be allowed, or won't be allowed -- There is no way to tell without tersting.
If it still doesn't work, then you can't use mod_rewrite.
If it does work, then we can proceed with the more complex stuff.
Jim
Options +FollowSymLinks
RewriteEngine on
#
RewriteCond %{HTTP_REFERER} ^http://www\.bad-domain\.com/[^?]*\?hop=sslorder
RewriteCond %{REQUEST_URI} !^/path-to-your-custom-403-error-page\.html$
RewriteRule .* - [F]
The first RewriteCond assumes that the referrer is always the same domain, and always with a "hop=sslorder" query string. If the domain changes, and "sslorder" is always an invalid "hop" value, then you could shorten that line to:
RewriteCond %{HTTP_REFERER} \?hop=sslorder
Jim
