1. Home
  2. Forums Index
  3. Server Side / Apache Web Server 3:04 pm May 1, 2026

Forum Moderators: phranque

Message Too Old, No Replies

.htaccess to help block viruses, bandwidth theft, bad bots, etc...

         

decdim

10:32 pm on Jan 12, 2004 (gmt 0)



30 minutes of post edit not working for me...

...post deleted, sorry for any inconveince!

[edited by: decdim at 12:10 am (utc) on Jan. 13, 2004]

pendanticist

10:52 pm on Jan 12, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Welcome to WebmasterWorld, decdim :)

Could you come back and edit this thread please? It's way to wide to view.

<aside>

Oh If you put:

{b}{/b} substituting "[ and ]" where appropriate in your coding and the link will not be active.

http://www.whateveryouwant.com and it won't be clickable.

Plus, it makes it easier for folks to copy if they wanna take a look.

</aside>

pendanticist

4:19 am on Jan 13, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Not an inconvenience here, decdim. :)

I wasn't so much suggesting you mask all those urls as I was asking you to edit the width down to where folks can read it. That's all. The side-scroll is murder as you must have seen in "Preview" mode.

You need not have deleted your material as Jim would have corrected it for you eventually anyway. :)

decdim

11:24 pm on Jan 14, 2004 (gmt 0)



I can still repost what I have, if someone wanted to take the time to edit it. Using the (b)(/b) made the links turn bold but I couldn't get it to just show up as a unclickable link. As for width, is there a way to set the topic width so that it naturally wraps? Instead of <CR> at specific points - that way the lines that need to stay together will without breaking them apart.

Thanks!

pendanticist

2:37 am on Jan 15, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Take the time to edit it? Well a simple find and replace will do the URLs ok, if you just replace the non-space between the ":" and the first "/" with both the opening and closing bold tag - having no spaces between tags. Just a simple pasting of both tags once, to get them correct and then replace them all. You'll see. It's not all that bad.

Jim is the real authority in this forum and I hope I didn't give you the impression I was speaking for him. Whoops on me if that's the case. :o Having said that, it's always good to delink this way prior to posting as it saves someone else from doing it.

As for the width in these editors. I really don't know what to tell you there. I've had mine at this setting for almost ever and have only changed the heighth of this page since.

You might check and see what the settings allow in here too. For all I know, the wordwrap feature carried over from the editor you copied out of.

Then again, BR tags are not manual insertions so maybe that had something to do with it. I just don't know that many of the ideosynchracies these editors have...sorry.

You could ask the same question in Community Center [webmasterworld.com]. Brett'll help 'ya out. :)

decdim

3:14 am on Jan 15, 2004 (gmt 0)



Original .htaccess post (change "links" to whatever you want - personal message or whatever):

# This section blocks worm attacks
Redirect /scripts http://worm.attack.denied
Redirect /MSADC http://worm.attack.denied
Redirect /c http://worm.attack.denied
Redirect /d http://worm.attack.denied
Redirect /_mem_bin http://worm.attack.denied
Redirect /msadc http://worm.attack.denied
RedirectMatch (.*)\cmd.exe$ http://worm.attack.denied$1

Redirect /scripts http://worm.attack.denied
Redirect /MSADC http://worm.attack.denied
Redirect /c http://worm.attack.denied
Redirect /d http://worm.attack.denied
Redirect /_mem_bin http://worm.attack.denied
Redirect /msadc http://worm.attack.denied
RedirectMatch (.*)\root.exe$ http://worm.attack.denied$1

Redirect /MSOffice http://worm.attack.denied
RedirectMatch (.*)\cltreq.asp$ http://worm.attack.denied$1

Redirect /_vti_bin http://worm.attack.denied
Redirect /_vti_pvt http://worm.attack.denied
RedirectMatch (.*)\owssrv.dll$ http://worm.attack.denied$1

# This section blocks "hot linking" of images
RewriteEngine on
RewriteCond %{HTTP_REFERER}!^http://YOUR_DOMAIN.TDL/.*$ [NC]
RewriteCond %{HTTP_REFERER}!^http://www.YOUR_DOMAIN.TDL/.*$ [NC]
RewriteRule .*\.(jpg¦jpeg¦gif¦png¦bmp)$ http://bandwidth.theft.denied [R,NC]

# This blocks many of the bad bots (some good too, comment out what you want)
RewriteEngine On
RewriteCond %{HTTP_REFERER} q=Guestbook [NC,OR]
RewriteCond %{HTTP_USER_AGENT} "DTS Agent" [OR] # OD
RewriteCond %{HTTP_USER_AGENT} "Fetch API Request" [OR] # OD
RewriteCond %{HTTP_USER_AGENT} "Indy Library" [OR] # spambot
RewriteCond %{HTTP_USER_AGENT} "LINKS ARoMATIZED" [OR] # rude bot
RewriteCond %{HTTP_USER_AGENT} "Microsoft URL Control" [OR] # spambot
RewriteCond %{HTTP_USER_AGENT} "^DA \d\.\d+" [OR] # OD
RewriteCond %{HTTP_USER_AGENT} "^Download" [OR] # OD
RewriteCond %{HTTP_USER_AGENT} "^Internet Explore" [OR] # spambot
RewriteCond %{HTTP_USER_AGENT} "^Mozilla/4.0$" [OR] # dumb bot
RewriteCond %{HTTP_USER_AGENT} "^Mozilla/\?\?$" [OR] # formmail attacker
RewriteCond %{HTTP_USER_AGENT} "compatible ; MSIE 6.0" [OR]
# spambot (note extra space before semicolon)
RewriteCond %{HTTP_USER_AGENT} "efp@gmx\.net" [OR] # rude bot
RewriteCond %{HTTP_USER_AGENT} "mister pix" [NC,OR] # rude bot
RewriteCond %{HTTP_USER_AGENT} ^Atomz [OR] # rude bot
RewriteCond %{HTTP_USER_AGENT} ^BlackWidow [OR]
RewriteCond %{HTTP_USER_AGENT} ^Bot\ mailto:craftbot@yahoo.com [OR]
RewriteCond %{HTTP_USER_AGENT} ^CherryPicker [OR]
RewriteCond %{HTTP_USER_AGENT} ^ChinaClaw [OR]
RewriteCond %{HTTP_USER_AGENT} ^Crescent [OR]
RewriteCond %{HTTP_USER_AGENT} ^Custo [OR]
RewriteCond %{HTTP_USER_AGENT} ^DISCo [OR]
RewriteCond %{HTTP_USER_AGENT} ^Download\ Demon [OR]
RewriteCond %{HTTP_USER_AGENT} ^EasyDL/\d\.\d+ [OR] # OD
RewriteCond %{HTTP_USER_AGENT} ^eCatch [OR]
RewriteCond %{HTTP_USER_AGENT} ^EirGrabber [OR]
RewriteCond %{HTTP_USER_AGENT} ^EmailCollector [OR]
RewriteCond %{HTTP_USER_AGENT} ^EmailSiphon [OR]
RewriteCond %{HTTP_USER_AGENT} ^EmailWolf [OR]
RewriteCond %{HTTP_USER_AGENT} ^Express\ WebPictures [OR]
RewriteCond %{HTTP_USER_AGENT} ^ExtractorPro [OR]
RewriteCond %{HTTP_USER_AGENT} ^EyeNetIE [OR]
RewriteCond %{HTTP_USER_AGENT} ^FlashGet [OR]
RewriteCond %{HTTP_USER_AGENT} ^FlickBot [OR] # rude bot
RewriteCond %{HTTP_USER_AGENT} ^FrontPage [OR] # stupid user trying to edit my site
RewriteCond %{HTTP_USER_AGENT} ^GetRight [OR]
RewriteCond %{HTTP_USER_AGENT} ^GetWeb! [OR]
RewriteCond %{HTTP_USER_AGENT} ^Go!Zilla [OR]
RewriteCond %{HTTP_USER_AGENT} ^Go-Ahead-Got-It [OR]
RewriteCond %{HTTP_USER_AGENT} ^GornKer [OR]
RewriteCond %{HTTP_USER_AGENT} ^GrabNet [OR]
RewriteCond %{HTTP_USER_AGENT} ^Grafula [OR]
RewriteCond %{HTTP_USER_AGENT} ^HMView [OR]
RewriteCond %{HTTP_USER_AGENT} HTTrack [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^IE\ \d\.\d\ Compatible.*Browser$ [OR] # spambot
RewriteCond %{HTTP_USER_AGENT} ^Image\ Stripper [OR]
RewriteCond %{HTTP_USER_AGENT} ^Image\ Sucker [OR]
RewriteCond %{HTTP_USER_AGENT} Indy\ Library [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^InterGET [OR]
RewriteCond %{HTTP_USER_AGENT} ^Internet\ Ninja [OR]
RewriteCond %{HTTP_USER_AGENT} ^Irvine [OR]
RewriteCond %{HTTP_USER_AGENT} ^JetCar [OR]
RewriteCond %{HTTP_USER_AGENT} ^JOC\ Web\ Spider [OR]
RewriteCond %{HTTP_USER_AGENT} ^larbin [OR]
RewriteCond %{HTTP_USER_AGENT} ^LeechFTP [OR]
RewriteCond %{HTTP_USER_AGENT} ^Mass\ Downloader [OR]
RewriteCond %{HTTP_USER_AGENT} ^Microsoft.URL [OR]
RewriteCond %{HTTP_USER_AGENT} ^MIDown\ tool [OR]
RewriteCond %{HTTP_USER_AGENT} ^Mister\ PiX [OR]
RewriteCond %{HTTP_USER_AGENT} ^Mozilla.*NEWT [OR]
RewriteCond %{HTTP_USER_AGENT} ^MSIECrawler [OR] # IE’s "make availableoffline" mode
RewriteCond %{HTTP_USER_AGENT} ^Navroad [OR]
RewriteCond %{HTTP_USER_AGENT} ^NearSite [OR]
RewriteCond %{HTTP_USER_AGENT} ^NetAnts [OR]
RewriteCond %{HTTP_USER_AGENT} ^NetSpider [OR]
RewriteCond %{HTTP_USER_AGENT} ^Net\ Vampire [OR]
RewriteCond %{HTTP_USER_AGENT} ^NetZIP [OR]
RewriteCond %{HTTP_USER_AGENT} ^NG [OR] # unknown bot
RewriteCond %{HTTP_USER_AGENT} ^NICErsPRO [OR]
RewriteCond %{HTTP_USER_AGENT} ^NPBot [OR] # NameProtect spybot
RewriteCond %{HTTP_USER_AGENT} ^Octopus [OR]
RewriteCond %{HTTP_USER_AGENT} ^Offline\ Explorer [OR]
RewriteCond %{HTTP_USER_AGENT} ^Offline\ Navigator [OR]
RewriteCond %{HTTP_USER_AGENT} ^PageGrabber [OR]
RewriteCond %{HTTP_USER_AGENT} ^Papa\ Foto [OR]
RewriteCond %{HTTP_USER_AGENT} ^pavuk [OR]
RewriteCond %{HTTP_USER_AGENT} ^pcBrowser [OR]
RewriteCond %{HTTP_USER_AGENT} ^PersonaPilot [OR] # rude bot
RewriteCond %{HTTP_USER_AGENT} ^puf [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^RealDownload [OR]
RewriteCond %{HTTP_USER_AGENT} ^ReGet [OR]
RewriteCond %{HTTP_USER_AGENT} ^SearchExpress [OR]
RewriteCond %{HTTP_USER_AGENT} ^SiteSnagger [OR]
RewriteCond %{HTTP_USER_AGENT} ^SmartDownload [OR]
RewriteCond %{HTTP_USER_AGENT} ^Sqworm [OR] # rude bot
RewriteCond %{HTTP_USER_AGENT} ^SuperBot [OR]
RewriteCond %{HTTP_USER_AGENT} ^SuperHTTP [OR]
RewriteCond %{HTTP_USER_AGENT} ^Surfbot [OR]
RewriteCond %{HTTP_USER_AGENT} ^SurveyBot [OR] # rude bot
RewriteCond %{HTTP_USER_AGENT} ^Siphon [OR]
RewriteCond %{HTTP_USER_AGENT} ^tAkeOut [OR]
RewriteCond %{HTTP_USER_AGENT} ^Teleport\ Pro [OR]
RewriteCond %{HTTP_USER_AGENT} ^TurnitinBot [OR]
RewriteCond %{HTTP_USER_AGENT} ^VoidEYE [OR]
RewriteCond %{HTTP_USER_AGENT} ^Web\ Image\ Collector [OR]
RewriteCond %{HTTP_USER_AGENT} ^Web\ Sucker [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebAuto [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebBandit [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebCopier [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebFetch [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebGo\ IS [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebLeacher [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebReaper [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebSauger [OR]
RewriteCond %{HTTP_USER_AGENT} ^Website\ eXtractor [OR]
RewriteCond %{HTTP_USER_AGENT} ^Website\ Quester [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebStripper [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebWhacker [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebZIP [OR]
RewriteCond %{HTTP_USER_AGENT} ^Wget [OR]
RewriteCond %{HTTP_USER_AGENT} ^Widow [OR]
RewriteCond %{HTTP_USER_AGENT} ^WWWOFFLE [OR]
RewriteCond %{HTTP_USER_AGENT} ^Xaldon\ WebSpider [OR]
RewriteCond %{HTTP_USER_AGENT} ^ZyBorg
RewriteCond %{HTTP_USER_AGENT} ^[A-Z]+$ [OR] # spambot
RewriteCond %{HTTP_USER_AGENT} ^eCatch [OR]
RewriteCond %{HTTP_USER_AGENT} ^larbin [OR]
RewriteCond %{HTTP_USER_AGENT} ^pavuk [OR]
RewriteCond %{HTTP_USER_AGENT} ^pcBrowser [OR]
RewriteCond %{HTTP_USER_AGENT} ^tAkeOut [OR]
RewriteCond %{HTTP_USER_AGENT} anarchie [NC,OR] # OD
RewriteCond %{HTTP_USER_AGENT} cherry.?picker [NC,OR] # spambot
RewriteCond %{HTTP_USER_AGENT} crescent [NC,OR] # OD
RewriteCond %{HTTP_USER_AGENT} dloader(NaverRobot) [OR]
RewriteCond %{HTTP_USER_AGENT} e?mail.?(collector¦magnet¦reaper¦
siphon¦sweeper¦harvest¦collect¦wolf) [NC,OR] # spambot
RewriteCond %{HTTP_USER_AGENT} express [NC,OR] # OD
RewriteCond %{HTTP_USER_AGENT} extractor [NC,OR] # OD
RewriteCond %{HTTP_USER_AGENT} flashget [NC,OR] # OD
RewriteCond %{HTTP_USER_AGENT} getright [NC,OR] # OD
RewriteCond %{HTTP_USER_AGENT} go.?zilla [NC,OR] # OD
RewriteCond %{HTTP_USER_AGENT} grabber [NC,OR] # OD
RewriteCond %{HTTP_USER_AGENT} httrack [NC,OR] # OD
RewriteCond %{HTTP_USER_AGENT} imagefetch [OR] # rude bot
RewriteCond %{HTTP_USER_AGENT} net.?(ants¦mechanic¦spider¦vampire¦zip) [NC,OR] # OD
RewriteCond %{HTTP_USER_AGENT} nicerspro [NC,OR] # spambot
RewriteCond %{HTTP_USER_AGENT} ninja [NC,OR] # Download Ninja OD
RewriteCond %{HTTP_USER_AGENT} offline [NC,OR] # OD
RewriteCond %{HTTP_USER_AGENT} snagger [NC,OR] # OD
RewriteCond %{HTTP_USER_AGENT} tele(port¦soft) [NC,OR] # OD
RewriteCond %{HTTP_USER_AGENT} vayala [OR]
# dumb bot, doesn’t know how tofollow links, generates lots of 404s
RewriteCond %{HTTP_USER_AGENT} web.?(auto¦bandit¦collector¦copier¦
devil¦downloader¦fetch¦hook¦mole¦miner¦mirror¦reaper¦sauger¦sucker¦site¦snake¦
stripper¦weasel¦zip) [NC,OR] # ODs
RewriteCond %{REMOTE_ADDR} "^63\.148\.99\.2(2[4-9]¦[3-4][0-9]¦5[0-5])$" [OR] # Cyveillance spybot
RewriteCond %{REMOTE_ADDR} ^12\.148\.196\.(12[8-9]¦1[3-9][0-9]¦2[0-4][0-9]¦25[0-5])$ [OR]
# NameProtect spybot
RewriteCond %{REMOTE_ADDR} ^12\.148\.209\.(19[2-9]¦2[0-4][0-9]¦25[0-5])$ [OR]
# NameProtect spybot
RewriteCond %{REMOTE_ADDR} ^64\.140\.49\.6([6-9])$ [OR] # Turnitin spybot
RewriteCond %{HTTP_USER_AGENT} ^Zeus
RewriteRule ^.* - [F,L]

# This blocks IE Favorites Icon image - unless you have one, then comment out
RedirectMatch permanent .*/favicon\.ico$ http://no.favicon.here

# This blocks "hacks", "quirks" and unwanted snoops...
Redirect permanent /cgi-bin/formmail.pl http://oops.formmail.gone
Redirect permanent /cgi-bin/formmail.cgi http://oops.formmail.gone
Redirect permanent /cgi-bin/Formmail.pl http://oops.formmail.gone
Redirect permanent /cgi-bin/Formmail.cgi http://oops.formmail.gone
Redirect permanent /cgi-bin/Formmail http://oops.formmail.gone
Redirect permanent /cgi-bin/FormMail http://oops.formmail.gone
Redirect permanent /cgi-bin/formmail http://oops.formmail.gone
Redirect permanent /cgi-gin/formMail http://oops.formmail.gone
Redirect permanent /cgi-bin/FormMail.pl http://oops.formmail.gone
Redirect permanent /cgi-bin/FormMail.cgi http://oops.formmail.gone
Redirect permanent /cgi-bin/formMail.pl http://oops.formmail.gone
Redirect permanent /cgi-bin/formMail.cgi http://oops.formmail.gone
Redirect permanent /cgi-local/formmail.pl http://oops.formmail.gone
Redirect permanent /cgi-local/formmail.cgi http://oops.formmail.gone
Redirect permanent /cgi-local/Formmail.pl http://oops.formmail.gone
Redirect permanent /cgi-local/Formmail.cgi http://oops.formmail.gone
Redirect permanent /cgi-local/Formmail http://oops.formmail.gone
Redirect permanent /cgi-local/formmail http://oops.formmail.gone
Redirect permanent /cgi-local/formMail http://oops.formmail.gone
Redirect permanent /cgi-local/FormMail.pl http://oops.formmail.gone
Redirect permanent /cgi-local/FormMail.cgi http://oops.formmail.gone
Redirect permanent /cgi-local/formMail.pl http://oops.formmail.gone
Redirect permanent /formMail.cgi http://oops.formmail.gone
Redirect permanent /formmail.pl http://oops.formmail.gone
Redirect permanent /formmail.cgi http://oops.formmail.gone
Redirect permanent /Formmail.pl http://oops.formmail.gone
Redirect permanent /Formmail.cgi http://oops.formmail.gone
Redirect permanent /Formmail http://oops.formmail.gone
Redirect permanent /formmail http://oops.formmail.gone
Redirect permanent /formMail http://oops.formmail.gone
Redirect permanent /FormMail.pl http://oops.formmail.gone
Redirect permanent /FormMail.cgi http://oops.formmail.gone
Redirect permanent /formMail.php http://oops.formmail.gone
Redirect permanent /formmail.php http://oops.formmail.gone
Redirect permanent /Formmail.php http://oops.formmail.gone
Redirect permanent /FormMail.php http://oops.formmail.gone
Redirect permanent /sumthin http://directory.doesnt.exist
Redirect permanent /default.htm http://no.default.found
Redirect permanent /java-sys http://access.is.denied
Redirect permanent /default.ida?
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
%u9090%u6858%ucbd3%u7801%u9090
%u6858%ucbd3%u7801%u9090%u6858
%ucbd3%u7801%u9090%u9090%u8190
%u00c3%u0003%u8b00%u531b%u53ff
%u0078%u0000%u00=a http://no.virus.here
Redirect permanent /missing.html http://no.virus.here
Redirect permanent /default.ida http://no.virus.here
Redirect permanent /400.shtml http://no.400.found
Redirect permanent /400.html http://no.400.found
Redirect permanent /cgi-bin/jenv.cgi http://oops.jenvi.gone
Redirect permanent /w3c/p3p.xml http://no.issues.here

 

Join The Conversation

Moderators and Top Contributors

Hot Threads This Week

  1. Home
  2. Forums Index
  3. Server Side / Apache Web Server 3:04 pm May 1, 2026