Thread: Block Russian / Chinese sites through .htaccess

When checking stats for some of our sites, we're finding that the vast majority of referrer spam is coming from .ru and .cn domains.

Our .htaccess files are getting full with the specific domains and/or ip addresses we're blocking. Is there any way to configure .htaccess to block any site which ends in .ru and .cn?

Thanks in advance.

Pete.

Hi,

Have a look at:

block a country, block by ip address, deny access by country

Cheers,

Ed

Hi Eddie,

We're hoping/looking for a solution where we can run some sort of regex against the referrer domain name, and block *.ru and *.cn.

blockacountry gives a list of address ranges known to be in these particular countries - but it's a big list (and the .htaccess is big already with other blocked sites) and will really slow the websites down.

Regards,

Pete.

Hi Pete,

I guess you could also use

<Limit GET HEAD POST>
order deny,allow
deny from .ru
deny from .cn
</Limit>

in your .htaccess but remember that in this case your server has to to do a reverse DNS lookup on each request which may be slower. For reference I use the list of IP address method and I do not notice any server slowdown.

Cheers,

Eddie.

also those CIDR blocks in the htaccess are smaller than they need to be and hence more code than your htaccess needs.

100.100.0.0 /16 would take out 100.100.X.X address space. Get it wrong and you will block a larger or smaller space than you want.

Try the following but remember that referer is not reliably available and the following will block anything which has part of its referer as .ru or .cn
i.e. you need to expand on the regx below if you want to limit it to the tld only.

Code:

RewriteEngine On
RewriteCond %{HTTP_REFERER} \.ru [NC,OR]
RewriteCond %{HTTP_REFERER} \.cn [NC]
RewriteRule .* - [F]

new ip blocks are allocated all the time so using ip blocks means you have to constantly keep them updated.
I'm sure there are apache routines available from maxmind to do this automatically but you have to pay for the database and updates and on a shared server UH probably won't allow it to be implemeted.

Originally Posted by eddie0uk

Hi,

Have a look at:

block a country, block by ip address, deny access by country

Cheers,

Ed

I would recommend IP2Location's Block Visitors by Country. At least they update their IP database every month.