Comments on: How To Block Annoying Referrer Spammers? http://www.symphonious.net/2006/04/01/how-to-block-annoying-referrer-spammers/ Living in a state of accord. Wed, 07 Jan 2009 19:46:35 +0000 http://wordpress.org/?v=2.7 hourly 1 By: Stephen Thorne http://www.symphonious.net/2006/04/01/how-to-block-annoying-referrer-spammers/comment-page-1/#comment-15362 Stephen Thorne Sat, 01 Apr 2006 02:16:18 +0000 http://www.symphonious.net/2006/04/01/how-to-block-annoying-referrer-spammers/#comment-15362 I don't know exactly how to handle referrer spam, but I do know how to spot a spam url. Given any url, for example, http://hostname.example.com/foo/bar/baz.html take hostname.example.com, and append .multi.surbl.org to it. Then do a DNS lookup on it, i.e. "hostname.example.com.multi.surbl.org". if the query comes back with an ip address, (it will be 127.0.0.XX, where XX will change according to the blacklists that list that hostname) then it is spam. Remove elements from the hostname until you're left with nothing but the root (.com, .cx, .com.au, etc, there's a list of them on surbl.org for you convenience). As for how to make apache drop HTTP connections based on the referrer, I don't know how to do that, but it would be a fun mod_anti_spam. ;) Heck, you could probably use the same technique to stop comment spam, if you inspect the HTTP GET/POST data as well as the Referrer: header... I don’t know exactly how to handle referrer spam, but I do know how to spot a spam url.

Given any url, for example, http://hostname.example.com/foo/bar/baz.html

take hostname.example.com, and append .multi.surbl.org to it. Then do a DNS lookup on it, i.e. “hostname.example.com.multi.surbl.org”. if the query comes back with an ip address, (it will be 127.0.0.XX, where XX will change according to the blacklists that list that hostname) then it is spam. Remove elements from the hostname until you’re left with nothing but the root (.com, .cx, .com.au, etc, there’s a list of them on surbl.org for you convenience).

As for how to make apache drop HTTP connections based on the referrer, I don’t know how to do that, but it would be a fun mod_anti_spam. ;)

Heck, you could probably use the same technique to stop comment spam, if you inspect the HTTP GET/POST data as well as the Referrer: header…

]]>