Help with mod_rewrite!

Server Config
1

Hi everyone!

I’m having many spam requests, shown bellow, on my apache server error log and I would like to block them using mod_rewrite.

[Sat Jun 30 12:21:21 2012] [error] [client 177.0.148.85] File does not exist: /var/www/html/favicon.ico, referer: http://sattotal.blogspot.com.br/2011/10/sobre-o-satelite-star-one-c3.html
[Sat Jun 30 12:22:56 2012] [error] [client 201.75.1.138] File does not exist: /var/www/html/favicon.ico, referer: http://sattotal.blogspot.com.br/2012/05/especialista-revela-os-segredos-de-uma.html
[Sat Jun 30 12:23:19 2012] [error] [client 201.14.103.135] File does not exist: /var/www/html/favicon.ico, referer: http://sattotal.blogspot.com.br/2008_04_27_archive.html
[Sat Jun 30 12:25:01 2012] [error] [client 188.82.51.233] File does not exist: /var/www/html/favicon.ico, referer: http://sattotal.blogspot.pt/2011/11/satelite-hellas-sat-2-39-este-portugal.html
[Sat Jun 30 12:25:04 2012] [error] [client 212.57.81.68] File does not exist: /var/www/html/favicon.ico, referer: http://sattotal.blogspot.pt/2009/03/novidade-hustler-tv-hd.html
[Sat Jun 30 12:25:08 2012] [error] [client 189.71.46.254] File does not exist: /var/www/html/favicon.ico, referer: http://sattotal.blogspot.com.br/
[Sat Jun 30 12:25:27 2012] [error] [client 189.71.46.254] File does not exist: /var/www/html/favicon.ico, referer: http://sattotal.blogspot.com.br/
[Sat Jun 30 12:25:53 2012] [error] [client 188.82.51.233] File does not exist: /var/www/html/favicon.ico, referer: http://sattotal.blogspot.pt/2009/09/europa-canal-bulgaro-bgfar-hd-no-hellas.html
[Sat Jun 30 12:29:57 2012] [error] [client 89.153.157.48] File does not exist: /var/www/html/favicon.ico, referer: http://sattotal.blogspot.pt/2009/11/portugal-panda-biggs-novo-canal-na-zon.html

I tried to block them using the following rewrite rule, but isn’t working… :frowning:

RewriteEngine On
RewriteCond %{HTTP_REFERER} ^http://sattotal\.blogspot\.* [NC]
RewriteRule ^(.*)$ - [F,L]

Any help will be very appreciated.

Thanks,

Mlino

2

You don’t use mod_rewrite to do that…
Use a firewall.

3

I have tried it but no success, since IP changes every time… Any other suggestion? eg… a rule in firewall that can do the trick.

Cheers,

Mlino

4

I think it can be done in HTACCESS, found this via a google search:

http://www.htaccess-guide.com/deny-visitors-by-referrer/

5

Hi SpacePhoenix,

Thanks for your replay. I’m trying to use mod_rewrite to block by sub-domain rather than the entire site(blogspot.com), because blocking this way can cause some real traffic be blocked along with the span traffic. The spam traffic changes their address[referer] all the time, so I need to have an entry in .htaccess for every address the spammers use.

I tried to use regular expressions but I can’t manage to write a rule that could match the pattern for those sites. :-/

Cheers,

Mlino

6

mlino,

Two comments:

  1. Your mod_rewrite looks fine.

  2. You’ve making a mountain out of a molehill. I believe that most modern browsers will look for a favicon.ico in order to populate the icon’s spot in a tabbed browser … automatically! In other words, no harm, no foul. I’d provide an icon file if I were you.

Regards,

DK