# Spam sites and spammers



## jiml8 (Jul 3, 2005)

I don't know about you but they are driving me nuts.

Here, for anyone interested, is my site .htaccess file. This includes specific IPs and ranges that I have blacklisted over time as spammers and it includes a new mod rewrite section to pick up the recent wave of referer spam. I had constructed my own mod rewrite section but then I ran across this which was more comprehensive than my list, so I just adopted (and adapted) it.

<Files .htaccess>
order allow,deny
deny from all
</Files>

order allow,deny
deny from 12.38.79.66
deny from 24.1.118.30
deny from 38.119.107
deny from 61.6.47.39
deny from 61.19
deny from 62.202.3.71
deny from 62.85.185.70
deny from 62.99.209.54
deny from 62.202.3.71
deny from 62.233.33.68
deny from 63.206.202.98
deny from 64.14.144.85
deny from 64.57.64.193
deny from 64.65.56.215
deny from 64.75.38.3
deny from 64.91.228.145
deny from 64.91.234.66
deny from 62.243.245.103
deny from 64.19.80.100
deny from 64.57.64.193
deny from 64.63.203.240
deny from 65.9.68.64
deny from 65.125.225.26
deny from 66.144.4
deny from 66.55.139
deny from 66.154.6.98
deny from 66.89.196.101
deny from 66.122.165.9
deny from 66.154.0.40
deny from 66.154.77.144
deny from 66.160.92
deny from 66.172.94.28
deny from 66.192.31.98
deny from 66.221.193.64
deny from 66.225.215.32
deny from 66.230.151.210
deny from 67.15.40
deny from 67.71.82.149
deny from 67.100.248.78
deny from 67.234.73.8
deny from 68.4.93.89
deny from 69.28.242.87
deny from 69.31.86.130
deny from 69.31.86.131
deny from 69.50.191
deny from 69.180.116
deny from 69.93
deny from 70.17.113.70
deny from 80.53.64.26
deny from 80.5.160.5
deny from 80.55.55.94
deny from 80.58.4.44
deny from 80.58.9.172
deny from 80.58.33.107
deny from 80.190.243.116
deny from 80.178.112.254
deny from 80.178.113.59
deny from 81.24.130.200
deny from 81.24.134.20
deny from 81.118.4.4
deny from 81.195.83.55
deny from 81.199.4.10
deny from 83.102.146.162
deny from 138.217.14.55
deny from 141.76.1.121
deny from 141.158.65.245
deny from 151.37.162.250
deny from 160.79.240.52
deny from 161.72.6.10
deny from 168.98.201.170
deny from 168.143.113.5
deny from 169.229.10.27
deny from 193.52.195.6
deny from 193.170.198.122
deny from 194.7.172.197
deny from 195.24.72.116
deny from 195.194.162.9
deny from 195.222.29.32
deny from 198.26.118.36
deny from 198.26.130.36
deny from 198.26.130.37
deny from 199.104.132.6
deny from 200.13.188.18
deny from 200.62.146.126
deny from 200.80.216.57
deny from 200.84.87.176
deny from 200.182.136.2
deny from 202.75.47.87
deny from 202.56.231.117
deny from 203.19.215.98
deny from 203.30.27.226
deny from 203.71.132.10
deny from 203.71.132.30
deny from 203.194.17.54
deny from 203.194.8.67
deny from 205.200.0.171
deny from 205.206.126.230
deny from 207.44.204.19
deny from 209.66.122.12
deny from 209.66.122.10
deny from 209.165.183.130
deny from 210.100.171.194
deny from 210.103.11.251
deny from 210.177.229.13
deny from 210.180.96.5
deny from 210.212.204.241
deny from 212.21.228.22
deny from 212.41.228.5
deny from 212.58.63.165
deny from 212.88.95.211
deny from 212.179.154.242
deny from 212.253.2.205
deny from 212.255.127.209
deny from 213.41
deny from 213.74.42.132
deny from 213.91.217.13
deny from 213.91.217
deny from 213.186.192.220
deny from 216.10.124.141
deny from 216.47.253.233
deny from 216.123.219.194
deny from 217.26.244.12
deny from 217.27.146.148
deny from 217.27.146.119
deny from 217.27.146.179
deny from 217.27.147.231
deny from 217.27.147.15
deny from 217.70.180.17
deny from 217.153.144.178
deny from 217.160.73.204
deny from 217.162.54.150
deny from 217.160.92.178
deny from 217.160.210.190
deny from 217.219.163.9
deny from 217.235.120.240
deny from 217.27
deny from 218.17.72.56
deny from 218.44.245.36
deny from 218.57.113.11
deny from 218.204.97.211
deny from 220.130.45.171
deny from 221.232.72.227
deny from 221.232.71.94
allow from all

RewriteEngine on
# Block Referrer Spam

# Drugs / Herbal

RewriteCond %{HTTP_REFERER} (sleep-?deprivation) [NC,OR]
RewriteCond %{HTTP_REFERER} (sleep-?disorders) [NC,OR]
RewriteCond %{HTTP_REFERER} (insomnia) [NC,OR]
RewriteCond %{HTTP_REFERER} (phentermine) [NC,OR]
RewriteCond %{HTTP_REFERER} (phentemine) [NC,OR]
RewriteCond %{HTTP_REFERER} (vicodin) [NC,OR]
RewriteCond %{HTTP_REFERER} (hydrocodone) [NC,OR]
RewriteCond %{HTTP_REFERER} (levitra) [NC,OR]
RewriteCond %{HTTP_REFERER} (hgh-) [NC,OR]
RewriteCond %{HTTP_REFERER} (-hgh) [NC,OR]
RewriteCond %{HTTP_REFERER} (ultram-) [NC,OR]
RewriteCond %{HTTP_REFERER} (-ultram) [NC,OR]
RewriteCond %{HTTP_REFERER} (cialis) [NC,OR]
RewriteCond %{HTTP_REFERER} (soma-) [NC,OR]
RewriteCond %{HTTP_REFERER} (-soma) [NC,OR]
RewriteCond %{HTTP_REFERER} (diazepam) [NC,OR]
RewriteCond %{HTTP_REFERER} (gabapentin) [NC,OR]
RewriteCond %{HTTP_REFERER} (celebrex) [NC,OR]
RewriteCond %{HTTP_REFERER} (viagra) [NC,OR]
RewriteCond %{HTTP_REFERER} (fioricet) [NC,OR]
RewriteCond %{HTTP_REFERER} (ambien) [NC,OR]
RewriteCond %{HTTP_REFERER} (valium) [NC,OR]
RewriteCond %{HTTP_REFERER} (zoloft) [NC,OR]
RewriteCond %{HTTP_REFERER} (finasteride) [NC,OR]
RewriteCond %{HTTP_REFERER} (lamisil) [NC,OR]
RewriteCond %{HTTP_REFERER} (meridia) [NC,OR]
RewriteCond %{HTTP_REFERER} (allegra) [NC,OR]
RewriteCond %{HTTP_REFERER} (diflucan) [NC,OR]
RewriteCond %{HTTP_REFERER} (zovirax) [NC,OR]
RewriteCond %{HTTP_REFERER} (valtrex) [NC,OR]
RewriteCond %{HTTP_REFERER} (lipitor) [NC,OR]
RewriteCond %{HTTP_REFERER} (proscar) [NC,OR]
RewriteCond %{HTTP_REFERER} (acyclovir) [NC,OR]
RewriteCond %{HTTP_REFERER} (sildenafil) [NC,OR]
RewriteCond %{HTTP_REFERER} (tadalafil) [NC,OR]
RewriteCond %{HTTP_REFERER} (xenical) [NC,OR]
RewriteCond %{HTTP_REFERER} (melatonin) [NC,OR]
RewriteCond %{HTTP_REFERER} (xanax) [NC,OR]
RewriteCond %{HTTP_REFERER} (herbal) [NC,OR]
RewriteCond %{HTTP_REFERER} (drugs) [NC,OR]
RewriteCond %{HTTP_REFERER} (lortab) [NC,OR]
RewriteCond %{HTTP_REFERER} (adipex) [NC,OR]
RewriteCond %{HTTP_REFERER} (propecia) [NC,OR]
RewriteCond %{HTTP_REFERER} (carisoprodol) [NC,OR]
RewriteCond %{HTTP_REFERER} (tramadol) [NC]
RewriteRule .* - [F]

# Porn

RewriteCond %{HTTP_REFERER} (porno) [NC,OR]
RewriteCond %{HTTP_REFERER} (shemale) [NC,OR]
RewriteCond %{HTTP_REFERER} (gangbang) [NC,OR]
RewriteCond %{HTTP_REFERER} (-****) [NC,OR]
RewriteCond %{HTTP_REFERER} (-anal) [NC,OR]
RewriteCond %{HTTP_REFERER} (-orgy) [NC,OR]
RewriteCond %{HTTP_REFERER} (****-) [NC,OR]
RewriteCond %{HTTP_REFERER} (anal-) [NC,OR]
RewriteCond %{HTTP_REFERER} (orgy-) [NC,OR]
RewriteCond %{HTTP_REFERER} (singles-?christian) [NC,OR]
RewriteCond %{HTTP_REFERER} (dating-?christian) [NC,OR]
RewriteCond %{HTTP_REFERER} (cumeating) [NC,OR]
RewriteCond %{HTTP_REFERER} (cream-?pies) [NC,OR]
RewriteCond %{HTTP_REFERER} (cumsucking) [NC,OR]
RewriteCond %{HTTP_REFERER} (cumswapping) [NC,OR]
RewriteCond %{HTTP_REFERER} (cumfilled) [NC,OR]
RewriteCond %{HTTP_REFERER} (cumdripping) [NC,OR]
RewriteCond %{HTTP_REFERER} (krankenversicherung) [NC,OR]
RewriteCond %{HTTP_REFERER} (cum*****) [NC,OR]
RewriteCond %{HTTP_REFERER} (suckingcum) [NC,OR]
RewriteCond %{HTTP_REFERER} (drippingcum) [NC,OR]
RewriteCond %{HTTP_REFERER} (*****cum) [NC,OR]
RewriteCond %{HTTP_REFERER} (swappingcum) [NC,OR]
RewriteCond %{HTTP_REFERER} (eatingcum) [NC,OR]
RewriteCond %{HTTP_REFERER} (cum-) [NC,OR]
RewriteCond %{HTTP_REFERER} (-cum) [NC,OR]
RewriteCond %{HTTP_REFERER} (sperm) [NC,OR]
RewriteCond %{HTTP_REFERER} (christian-?dating) [NC,OR]
RewriteCond %{HTTP_REFERER} (jewish-?singles) [NC,OR]
RewriteCond %{HTTP_REFERER} (sex-?meetings) [NC,OR]
RewriteCond %{HTTP_REFERER} (swinging) [NC,OR]
RewriteCond %{HTTP_REFERER} (swingers) [NC,OR]
RewriteCond %{HTTP_REFERER} (personals) [NC,OR]
RewriteCond %{HTTP_REFERER} (sleeping) [NC,OR]
RewriteCond %{HTTP_REFERER} (libido) [NC,OR]
RewriteCond %{HTTP_REFERER} (grannies) [NC,OR]
RewriteCond %{HTTP_REFERER} (mature) [NC,OR]
RewriteCond %{HTTP_REFERER} (enhancement) [NC,OR]
RewriteCond %{HTTP_REFERER} (sexual) [NC,OR]
RewriteCond %{HTTP_REFERER} (gay-?teen) [NC,OR]
RewriteCond %{HTTP_REFERER} (teen-?chat) [NC,OR]
RewriteCond %{HTTP_REFERER} (gay-?chat) [NC,OR]
RewriteCond %{HTTP_REFERER} (adult-?finder) [NC,OR]
RewriteCond %{HTTP_REFERER} (adult-?friend) [NC,OR]
RewriteCond %{HTTP_REFERER} (friend-?finder) [NC,OR]
RewriteCond %{HTTP_REFERER} (friend-?adult) [NC,OR]
RewriteCond %{HTTP_REFERER} (finder-?adult) [NC,OR]
RewriteCond %{HTTP_REFERER} (finder-?friend) [NC,OR]
RewriteCond %{HTTP_REFERER} (discrete-?encounters) [NC,OR]
RewriteCond %{HTTP_REFERER} (cheating-?wives) [NC,OR]
RewriteCond %{HTTP_REFERER} (housewives) [NC,OR]
RewriteCond %{HTTP_REFERER} (\-sex\.) [NC,OR]
RewriteCond %{HTTP_REFERER} (xxx) [NC,OR]
RewriteCond %{HTTP_REFERER} (snowballing) [NC]
RewriteRule .* - [F]

# Weight

RewriteCond %{HTTP_REFERER} (fat-) [NC,OR]
RewriteCond %{HTTP_REFERER} (-fat) [NC,OR]
RewriteCond %{HTTP_REFERER} (diet) [NC,OR]
RewriteCond %{HTTP_REFERER} (pills) [NC,OR]
RewriteCond %{HTTP_REFERER} (weight) [NC,OR]
RewriteCond %{HTTP_REFERER} (supplement) [NC]
RewriteRule .* - [F]

# Gambling
RewriteCond %{HTTP_REFERER} (pharmacy) [NC,OR]
RewriteCond %{HTTP_REFERER} (inkjet) [NC,OR]
RewriteCond %{HTTP_REFERER} (diet) [NC,OR]
RewriteCond %{HTTP_REFERER} (drugs) [NC,OR]
RewriteCond %{HTTP_REFERER} (holdem) [NC,OR]
RewriteCond %{HTTP_REFERER} (loan) [NC,OR] 
RewriteCond %{HTTP_REFERER} (texas-?hold-?em) [NC,OR]
RewriteCond %{HTTP_REFERER} (poker) [NC,OR]
RewriteCond %{HTTP_REFERER} (casino) [NC,OR]
RewriteCond %{HTTP_REFERER} (bitlocker) [NC,OR]
RewriteCond %{HTTP_REFERER} (blackjack) [NC]
RewriteRule .* - [F]
# User Agents

RewriteCond %{HTTP_USER_AGENT} (Program\ Shareware|Fetch\ API\ Request) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} (Microsoft\ URL\ Control) [NC]
RewriteRule .* - [F]

# Misc / Specific Sites

RewriteCond %{HTTP_REFERER} (netwasgroup\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (nic4u\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (wear4u\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (foxmediasolutions\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (liveplanets\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (aeterna-tech\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (continentaltirebowl\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (chemsymphony\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (infolibria\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (globaleducationeurope\.net) [NC,OR]
RewriteCond %{HTTP_REFERER} (soma\.125mb\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (mitglied\.lycos\.de) [NC,OR]
RewriteCond %{HTTP_REFERER} (foxmediasolutions\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (jroundup\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (feathersandfurvanlines\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (conecrusher\.org) [NC,OR]
RewriteCond %{HTTP_REFERER} (sbj-broadcasting\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (edthompson\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (codychesnutt\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (artsmallforsenate\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (axionfootwear\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (protzonbeer\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (candiria\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (bigsitecity\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (coresat\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (istarthere\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (amateurvoetbal\.net) [NC,OR]
RewriteCond %{HTTP_REFERER} (alleghanyeda\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (xadulthosting\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (datashaping\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (zick\.biz) [NC,OR]
RewriteCond %{HTTP_REFERER} (newprinceton\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (dvdsqueeze\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (xopy\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (webdevboard\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (devaddict\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (eaton-inc\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (whiteguysgroup\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (guestbookz\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (webdevsquare\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (indfx\.net) [NC,OR]
RewriteCond %{HTTP_REFERER} (snap\.to) [NC,OR]
RewriteCond %{HTTP_REFERER} (2y\.net) [NC,OR]
RewriteCond %{HTTP_REFERER} (astromagia\.info) [NC,OR]
RewriteCond %{HTTP_REFERER} (free-?sms) [NC]
RewriteRule .* - [F]


----------



## Rockn (Jul 29, 2001)

How would this keep you from being spammed if it were on your web server? Does this just keep certaing referrers from accessing the web site?


----------



## jiml8 (Jul 3, 2005)

Rockn said:


> How would this keep you from being spammed if it were on your web server? Does this just keep certaing referrers from accessing the web site?


Yup. Gives them an error code 403.

I was going to forward them to fbi.gov, but I figured that was just a bandwidth waster.

I don't see the sense in it. After all, who is going to see referer spam but the webmaster? And he's just gonna get pissed.

My logs are a mess with all this crap. I no longer can find valid referers, so I take this action to deal with the problem.


----------



## jiml8 (Jul 3, 2005)

Actually, they are trying to spam my message board but I disabled it because of them. I am looking at alternative message board software that might be less vulnerable while still being convenient to use.


----------



## Rockn (Jul 29, 2001)

How exactly are they spamming your message board unless they have an account? Don't let anonymous posters post and that should solve your problem. Who cares about the referrer access as they only clutter up the log files.


----------



## jiml8 (Jul 3, 2005)

message board is old and primitive. No user accounts. I disabled it but didn't take it down because there is useful info on it.

Referrer spam bugs me because I use that information in my log analysis and all the clutter is a problem. Also, of course, these spammers are harvesting the message board over, and over, and over. Which wastes bandwidth.


----------



## Rockn (Jul 29, 2001)

I hear ya, but I believe they can harvest regardless of the htaccess entries. Go with a PHP based message board like the one used here. You might want to ask Mike what he does regarding spammers if anything and I am sure this site gets thousands of hits a day.


----------

