1

I am getting loads of spam/junk hits on my sites, they result in thousands of hits per day which is crippling my server resulting very poor performance on adsense revenue.

Although I am blocking them through IP address way, but this need constant daily updates to cope with them which I am not able to cope with.

I have found that culprits are mostly from specific hosts (or user agents, I don't know exact term)

The PTR record reads as following:

*host.colocrossing.com (example: 107-175-65-166-host.colocrossing.com)
*compute-1.amazonaws.com (example: ec2-54-208-232-206.compute-1.amazonaws.com)
*bc.googleusercontent.com (example: 193.73.184.35.bc.googleusercontent.com)

Based on my search on internet i tried to use following lines in my htaccess file with no result.

All I want to do is to stop hits originating from above domains.

<IfModule mod_rewrite.c>
RewriteEngine On

RewriteCond %{HTTP_REFERER} ^amazonaws\.com$ [OR,NC]

RewriteCond %{HTTP_REFERER} ^compute-1.amazonaws\.com$ [OR,NC]

RewriteCond %{HTTP_REFERER} ^colocrossing\.com$ [OR,NC]

RewriteCond %{HTTP_REFERER} ^bc.googleusercontent\.com$ [OR,NC]

RewriteCond %{REMOTE_HOST} ^amazonaws\.com$ [OR,NC]

RewriteCond %{REMOTE_HOST} ^compute-1.amazonaws\.com$ [OR,NC]

RewriteCond %{REMOTE_HOST} ^colocrossing\.com$ [OR,NC]

RewriteCond %{REMOTE_HOST} ^bc.googleusercontent\.com$ [NC]

RewriteRule .* - [F,L]
</IfModule>

closed as unclear what you're asking by Stephen Ostermiller Mar 18 '18 at 17:18

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • You will find that blocking whole IP address blocks is the way to go. Try your solution first, however, you will find that domain/sub-domain names are ever changing just like the IP addresses before. Look up the domain, find the AS number, and block that whole IP block. These are not users. BTW- This is likely one of two things. One compromised computers from a web host, or two, permissive hosts of some kind like AWS and Google. Especially where a user can write and execute code to ping sites in a variety of ways. – closetnoc Mar 18 '18 at 15:25
  • 1
    Please research the terminology and edit your question. It isn't clear if you want to match referrers, the host of the IP address, or the user agent. You mention all three in your question. If you need help, give us an example of an IP address you are blocking. Show how you obtained it from your logs. Tell how you would turn it into a host name to block. – Stephen Ostermiller Mar 18 '18 at 17:17
  • Dear All, Thanks for your comments, i want to block hosts such as bc.googleusercontent.com, compute-1.amazonaws.com and colocrossing.com. In my opinion, anything hosted on these hosts is not actual user, they are bots or people trying to run scripts. @closetnoc : Sir, I am doing blocking IP addresses, but they keep on changing IP addresses, Blocking whole range of IP might result in blocking actual users as well. Please correct me if wrong. I agree with second part of your comment "permissive hots of some kind like AWS & google" – Jain Mar 19 '18 at 10:01
  • @StephenOstermiller : Sir,Sorry for wrong question, I am novice, I want to stop hosts like AWS, Google & Colocrossing. I am blocking 130.211.144.120 & 130.211.138.158 , i searched on blacklist domain websites and found they belong to bc.googleusercontent.com They will generating 13000+ hits in 24 hours. Please help – Jain Mar 19 '18 at 10:01
  • @MrWhite : Noted Sir, This code is yet not deployed, I am seeking help of Gurus like you to confirm that code is correct so that I can deploy it. Apologies for mistakes, await help, Regards – Jain Mar 19 '18 at 10:01

Browse other questions tagged or ask your own question.