Log Spammer

[keyplyr]

Log Spammer formerly using: www.xopy.com
as referrer, is now using: www.aizzo.com/blog_posts
which resolves to the same advert for hosting.

AFAIK, still using only these two IPs:
205.209.177.70
65.75.134.180

[pendanticist]

65.75.134.180 - Confirmed overnight.

[idoc]

This was my solution:

Deny from 205.209.128.0/18
Deny from 65.75.128.0/18

Maybe not so elegant a solution but...Done.

[kpaul]

i've started to email ISPs about the issue when i have the time...

-kpaul

[CheeseburgerBrown]

Bless you, Webmaster World. I've been trying to grok that xopy kipple in my logs for weeks.

My sites are hosted by some faceless monolithic hosting company, so I can't be allowing and denying by IP the way I used to do. I rely on clumsily grafted .htaccess files to control access.

What should an idiot in my situation do to block this logjam?

Any recommendations?

[kpaul]

hey, stranger. is this the cheeseburgerbrown i think it is? is there any other? ;)

[CheeseburgerBrown]

But of course! Howdy, kpaul. :)

[kpaul]

CB:

if you can create an .htaccess file,

Deny from 205.209.177.70
Deny from 65.75.134.180

should work. They'll most likely be back with new/different IPs, though...

[Sunshyn]

I denied both IPs last week but wondered if there'd be a problem with just denying the referrer domain if they started coming back under different IPs. After all, it's the referrer they're spamming.

SetEnvIf Referer xopy\.com ban

[kpaul]

RewriteCond %{HTTP_REFERER} badrefererspamdomain.com [NC]
RewriteRule .* - [F]

[CheeseburgerBrown]

Thanks for the advice. My .htaccess file has been refortified.