Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

The story is incredibly long. Long story short, someone is using amazonaws IPs for a bot that's clicking on my Adsense ads. I'm trying to ban all amazonaws IPs, but it doesn't work. The bigger problem is that I can't ban any ip.

I tried this:


RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_REFERER} ^http://.*amazonaws\.com [OR] 
RewriteCond %{REMOTE_HOST} ^.*\.compute-1\.amazonaws\.com$ [NC,OR] 
RewriteCond %{REMOTE_ADDR} ^xx.xx.xxx.xxx [OR]
RewriteRule ^(.*)$ - [F]

xx.xx.xxx.xxx is an IP that I have access to and with which I can test if the htaccess works. Otherwise, I tried banning myself to see if it works. Doesn't.

I also tried the classic code:

# BAN USER BY IP

 order allow,deny
 allow from all
 deny from 1.2.3.4

Didn't work either.

What am I doing wrong and why can't I ban any ip, let alone the amazonaws ones?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Check your /etc/apache2/apache2.conf or /etc/apache2/httpd.conf, or if you have multi-hosting, /etc/apache2/sites-available/mydomain.com.conf for the presence of AllowOverride All.

Next try it this way:

RewriteEngine On
RewriteCond %{HTTP_REFERER} ^.*amazonaws\.com$ [NC,OR] 
RewriteCond %{REMOTE_HOST} ^.*compute-1\.amazonaws\.com$ [NC,OR] 
RewriteCond %{REMOTE_ADDR} ^12.148.196.(12[8-9]|1[3-9][0-9]|2[0-4][0-9]|25[0-5])$ [OR]
RewriteRule .* - [F,L]

These are examples created from my own .htaccess file. The IP address range in the example is an amazonaws.com IP address range, but may not be the IP address range that you need. You notice I removed the RewriteBase. It is not necessary unless you need it for another reason.

You may also want to break these up into separate Cond/Rule sets to make things easier. If there is even one error using [OR], then the whole set fails. If you separate into three separate sets, the only the one that fails - fails.

share|improve this answer
    
The HTTP_REFERER does start with the protocol (ie. HTTP://) so this does need to be included if using the "start" position marker ie. ^. There are a few errors with the 3rd RewriteCond which checks the IP address: Remove the surrounding quotes "..." and the [OR] flag, also you can't check for number ranges like [160-191] - this is a character class and would be equivalent to [0169] and also [0-255] is [01255]. Checking for number ranges in regex is not trivial unfortunately. The . should also be escaped, or use the equality operator eg. =204.246.160.255 –  w3d Mar 9 at 19:46
    
The .* is a wildcard for everything. You do not have to include the HTTP:// because the wildcard covers this. Using ^ is a place marker, ^.* means everything from start of string. When I quote IP addresses I do not use [OR] though I think it should still work. Using the quotes forces regex to treat the IP address as a string. Doing this, you do not have to escape the . [period]. The [160-191] is a range of values. I may have made a mistake in using a range in a quoted string in my example. You may need to remove the quotes and escape the . [period] with a \. Also use ^ and $ for the IP. –  closetnoc Mar 9 at 20:15
    
I removed the quotes tom the IP address regex in my answer since they were in error. I do not want to confuse future answer seekers. –  closetnoc Mar 9 at 20:47
    
I tried the following code RewriteEngine On RewriteCond %{HTTP_REFERER} ^http://(www\.)?.*(-|.)?amazon(-|.).*$ [NC,OR] RewriteCond %{REMOTE_HOST} ^.*compute\.amazonaws\.com [NC,OR] RewriteCond %{REMOTE_HOST} ^.*xlhost\.com [NC] RewriteRule ^(.*)$ - [F,L]. It didn't work. Visits keep coming. :| –  Punct Ulica Mar 9 at 21:14
    
It will make it easier to understand what is failing if you break these up. I still say the HTTP_REFERER regex is too complex. Stay simple. This is why I used ^.*amazonaws\.com$ Also, if I use ^ then I like to always use $. Is it possible to paste the domain names and IP addresses from your log file into a comment? I have a regex testing CGI I use to test regex's. I will be glad to test these regular expressions for you without having to wait to check the log file. –  closetnoc Mar 9 at 21:37

Report it to Google. This is fraud and they investigate it (and will refund costs/void invalid clicks).

Depending on the bot (user agent) it might be easier to ban that user agent. By AdSense I'm guessing you mean display ads as it's unlikely you'd be concerned about bots that were earning you more money. Banning a user agent won't deter anyone with any skill, but neither will banning an IP address.

Conversely, you could exclude the IP address from seeing ads in AdWords Ads (campaign settings).

share|improve this answer
    
The bot uses a fake user agent so that isn't a solution. I wish it was that simple. I reported it to Google, but Google doesn't really care. And yes, Adsense display ads. I'm a publisher. –  Punct Ulica Mar 10 at 8:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.