htaccess blocking .ru websites

[serenoo]

On my .htacess I have:
.....
RewriteCond %{HTTP_REFERER} spamwebsiteurl1 [NC,OR]
RewriteCond %{HTTP_REFERER} spamwebsiteurl2 [NC,OR]
.....
But this force me to add one by one all the spam refer websites. Is there a way to block with only one instruction all websites that ends with .ru?

[whitespace]

RewriteCond %{HTTP_REFERER} spamwebsiteurl1 [NC,OR]

The second argument (ie. spamwebsiteurl1) to the RewriteCond directive is a regular expression (regex for short). In your example, "spamwebsiteurl1" will be matched anywhere in the referring URL.

To match URLs whose domain ends with ".ru" you could perhaps use a regex like:

\.ru\b

\b is a word boundary. ie. the end of the string or end of the domain (which is followed by a slash - a non-word character).

[lucy24]

:: overlapping ::

Is there a way to block with only one instruction all websites that ends with .ru?

Mine looks like this:

RewriteCond %{HTTP_REFERER} \.(ru|ua)(/|$) [NC]
RewriteCond %{HTTP_REFERER} !(google|yandex|mail)\.

The [NC] flag is because of mail.RU; you don't need it when naming specific sites unless they have a record of garbling their own casing. Be sure to exempt any legitimate search engines.

The \b version will also cover sites in .ru.blahblah. I don't know if those actually occur, but when blocking referer spam it sure can't hurt.

Edit: Only as I post this do I realize that I don't need to make an [NC] for mail.RU, since the rule is intended to exempt them anyway ... and besides it isn't "mail" but "Mail", at least in the UA. Oops.

:: wandering off to check logs and see if any referer spam has actually used capital RU or UA ::

Nope, don't find any. It always helps if you can leave off the [NC] flag.

Further edit: I also find that the actual form in referers-- as opposed to the robot's UA-- is simply "mail.ru" lower case. Double oops. And, finally, there exist spam sites with names in the form "blahblahmail.ru" so I'll need a front anchor there. Triple oops.

:: wandering off again to edit htaccess ::

[tangor]

All this reminds me to ask (and I meant to long ago when tedster was active!) if, on a site where rewrite does NOT work if

SetEnvIfNoCase Referer "\.ru" ban
SetEnvIfNoCase User-Agent "\.ru" ban

which DOES work accomplished the same thing. Actually, it does what I want, if I can't get to the rewrite module. Probably should change the host ... but I've been there 12 years and, by gollies, they've been a champ and good friend all that time and the site has no worries or complaints. .... Or I'm just lazy and complacent in this one regard. :)

[whitespace]

All SetEnvIfNoCase does is set an environment variable, it doesn't actually block anything. You would still need some code later that says: If ban then block (which you don't necessarily need mod_rewrite for). For example, using mod_authz_host:

Deny from env=ban

[tangor]

Natch, already had that. Thanks. :)