8 replies to this topic

[hegu]

I am seeing plenty of urls like this in my logs.

CODE

http://83.133.124.250/?xurl=http://83.133.124.250/lzD2KDYD7R3JvRC5df7e5d00c2ac80539a405bd23c66885806g&xref=http://mysite.com

http://76.73.39.226/?xurl=http://76.73.39.226/IAR19tTE6R7M6lu3c2990f77aa8229cb50993b3c84185e3228x&xref=http://mysite.com

There is 'xurl' and 'xref' in urls constantly.

I can block these visitors by the following code in my root htaccess?

CODE

RewriteEngine On
RewriteCond %{HTTP_REFERER} (?xurl=) [NC,OR]
RewriteCond %{HTTP_REFERER} (&xref=) [NC]
RewriteRule .* - [F,L]

thanks.

[Michael Martinez]

XURL is a URL shortening service. Are you SURE you're trying to block referrer spam?

[hegu]

XURL is a URL shortening service. Are you SURE you're trying to block referrer spam?

Which url shortening service?

All these hits are pointing to index.php of the web site. Hundreds of them. Not even a single visitor goes from index.php to another page. every time 3 - 5 hits to index.php from an ip with in few seconds time.

[chrishirst]

Well the IPs are from a German (Hessen) and a US (Chicago) DSL providers. So it is more likely to be "zombied" computers that are being used to seek out another victim.


Referrer spambots leave a real URI of the website that is being "promoted"

[hegu]

Referrer spambots leave a real URI of the website that is being "promoted"

So they are not actually leaving any url of their website in my logs, they are not referer spambots?

[chrishirst]

Probably not, on some of the sites we host, similar referrers were appearing which seemed to be a prelude to a couple of "mass meshing" and code injection attacks.
http://blog.armorize...sidenamejs.html

NB: The virus alert you may get on that page is a false positive so you may want to disable your AV first.

More info here.
http://sucuri.net/ma...idename-js.html
http://sucuri.net/ma...minibar-js.html

[hegu]

If I want to block these referer urls, still the .htaccess code in my first post is correct?

[chrishirst]

You should "escape" the ? with a backslash ie: \? to signify it is a literal character rather than a special or meta character in the expression.

[hegu]

Thanks. Working perfectly. (need to check rewrite logs for any errors though, if any)