More referrer spam

Customer support forums for the modsecurity rules feed. There is no such thing as a bad question here as long as it pertains to using the real time modsecurity rules feed. Newbies feel free to get help getting started or asking questions that may be obvious.
stephan-zrh
Forum User
Forum User
Posts: 71
Joined: Mon May 07, 2012 9:37 am
Location: Zurich

More referrer spam

Unread post by stephan-zrh »

Hello,

We are getting complaints about more referrer spam:
best-seo-solution.com
*.simple-share-buttons.com
*.social-buttons.com

A customer sent a screenshot from Google Analytics, listing *.social-buttons.com, but I can't find it right away in the logs. I have attached the screenshot.

Unfortunately I can only find best-seo-solution.com in the logfiles:
best-seo-solution.com:
177.155.251.253 - - [04/Apr/2015:20:12:58 +0200] "GET / HTTP/1.0" 301 451 "http://best-seo-solution.com/try.php?u=http://__.com" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36"
177.155.251.253 - - [04/Apr/2015:20:13:00 +0200] "GET / HTTP/1.0" 200 7219 "http://best-seo-solution.com/try.php?u=http://__.com" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36"
180.72.17.228 - - [05/Apr/2015:04:22:20 +0200] "GET / HTTP/1.0" 301 451 "http://best-seo-solution.com/try.php?u=http://__.ch" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36"
180.72.17.228 - - [05/Apr/2015:04:22:22 +0200] "GET / HTTP/1.0" 200 7209 "http://best-seo-solution.com/try.php?u=http://__.ch" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36"
I found this website listing even more spammers: http://www.roimarketing.co.nz/articles/ ... -block-it/

Can you maybe add these to the blocklist?

Kind regards

-Stephan
Attachments
referrer.png
referrer.png (81.66 KiB) Viewed 12817 times
User avatar
mikeshinn
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 4149
Joined: Thu Feb 07, 2008 7:49 pm
Location: Chantilly, VA

Re: More referrer spam

Unread post by mikeshinn »

I think I'm going to add in a user definable list as well, that way you can add in whatever sites you like as you go. We'd still appreciate the reports so we can add them to the general rules, but this way you should be able to adapt quicker.
stephan-zrh
Forum User
Forum User
Posts: 71
Joined: Mon May 07, 2012 9:37 am
Location: Zurich

Re: More referrer spam

Unread post by stephan-zrh »

Thanks a lot!
stephan-zrh
Forum User
Forum User
Posts: 71
Joined: Mon May 07, 2012 9:37 am
Location: Zurich

Re: More referrer spam

Unread post by stephan-zrh »

Hello,

Just wanted to ask regarding these spammers. I see in the rules that best-seo-solution is listed but not yet the others (also not from the site linked above). Will you be adding these also?

Kind regards

-Stephan
stephan-zrh
Forum User
Forum User
Posts: 71
Joined: Mon May 07, 2012 9:37 am
Location: Zurich

Re: More referrer spam

Unread post by stephan-zrh »

Just a short followup-question:

Is there a timeline for the GUI so that we can enter such URLs ourselves? It would of course be ideal, if we could just click a checkbox to notify you of such entries instead of having to notify you separately.

Kind regards

-Stephan
stephan-zrh
Forum User
Forum User
Posts: 71
Joined: Mon May 07, 2012 9:37 am
Location: Zurich

Re: More referrer spam

Unread post by stephan-zrh »

Hello,

Just wondering if there is any progress on this.

Unfortunately, the problem is becoming increasingly annoying. We have a new customer's site up for a month and already the referrer-spammers are showing up (see attached image).

I also found this list: http://perishablepress.com/blacklist/ul ... cklist.txt

Kind regards

-Stephan
Attachments
referrer-spam.png
referrer-spam.png (44.26 KiB) Viewed 12700 times
Post Reply