1

The story is incredibly long. Long story short, someone is using amazonaws IPs for a bot that's clicking on my Adsense ads. I'm trying to ban all amazonaws IPs, but it doesn't work. The bigger problem is that I can't ban any ip.

I tried this:


RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_REFERER} ^http://.*amazonaws\.com [OR] 
RewriteCond %{REMOTE_HOST} ^.*\.compute-1\.amazonaws\.com$ [NC,OR] 
RewriteCond %{REMOTE_ADDR} ^xx.xx.xxx.xxx [OR]
RewriteRule ^(.*)$ - [F]

xx.xx.xxx.xxx is an IP that I have access to and with which I can test if the htaccess works. Otherwise, I tried banning myself to see if it works. Doesn't.

I also tried the classic code:

# BAN USER BY IP

 order allow,deny
 allow from all
 deny from 1.2.3.4

Didn't work either.

What am I doing wrong and why can't I ban any ip, let alone the amazonaws ones?

Improve this question
1
  • The first rule block with the OR flag on the last RewriteCond directive is an error and will block everyone (the RewriteRule will effectively execute unconditionally)! So, if neither of these rules do anything then it suggests .htaccess overrides are disabled in your server config. Check for the AllowOverride directive in the virtualhost / server config.
    – MrWhite
    Apr 3, 2019 at 20:55

2 Answers 2

Reset to default
2

Check your /etc/apache2/apache2.conf or /etc/apache2/httpd.conf, or if you have multi-hosting, /etc/apache2/sites-available/mydomain.com.conf for the presence of AllowOverride All.

Next try it this way:

RewriteEngine On
RewriteCond %{HTTP_REFERER} ^.*amazonaws\.com$ [NC,OR] 
RewriteCond %{REMOTE_HOST} ^.*compute-1\.amazonaws\.com$ [NC,OR] 
RewriteCond %{REMOTE_ADDR} ^12.148.196.(12[8-9]|1[3-9][0-9]|2[0-4][0-9]|25[0-5])$ [OR]
RewriteRule .* - [F,L]

These are examples created from my own .htaccess file. The IP address range in the example is an amazonaws.com IP address range, but may not be the IP address range that you need. You notice I removed the RewriteBase. It is not necessary unless you need it for another reason.

You may also want to break these up into separate Cond/Rule sets to make things easier. If there is even one error using [OR], then the whole set fails. If you separate into three separate sets, the only the one that fails - fails.

Improve this answer
10
  • The HTTP_REFERER does start with the protocol (ie. HTTP://) so this does need to be included if using the "start" position marker ie. ^. There are a few errors with the 3rd RewriteCond which checks the IP address: Remove the surrounding quotes "..." and the [OR] flag, also you can't check for number ranges like [160-191] - this is a character class and would be equivalent to [0169] and also [0-255] is [01255]. Checking for number ranges in regex is not trivial unfortunately. The . should also be escaped, or use the equality operator eg. =204.246.160.255
    – MrWhite
    Mar 9, 2014 at 19:46
  • The .* is a wildcard for everything. You do not have to include the HTTP:// because the wildcard covers this. Using ^ is a place marker, ^.* means everything from start of string. When I quote IP addresses I do not use [OR] though I think it should still work. Using the quotes forces regex to treat the IP address as a string. Doing this, you do not have to escape the . [period]. The [160-191] is a range of values. I may have made a mistake in using a range in a quoted string in my example. You may need to remove the quotes and escape the . [period] with a \. Also use ^ and $ for the IP.
    – closetnoc
    Mar 9, 2014 at 20:15
  • I removed the quotes tom the IP address regex in my answer since they were in error. I do not want to confuse future answer seekers.
    – closetnoc
    Mar 9, 2014 at 20:47
  • I tried the following code RewriteEngine On RewriteCond %{HTTP_REFERER} ^http://(www\.)?.*(-|.)?amazon(-|.).*$ [NC,OR] RewriteCond %{REMOTE_HOST} ^.*compute\.amazonaws\.com [NC,OR] RewriteCond %{REMOTE_HOST} ^.*xlhost\.com [NC] RewriteRule ^(.*)$ - [F,L]. It didn't work. Visits keep coming. :|
    – Punct Ulica
    Mar 9, 2014 at 21:14
  • It will make it easier to understand what is failing if you break these up. I still say the HTTP_REFERER regex is too complex. Stay simple. This is why I used ^.*amazonaws\.com$ Also, if I use ^ then I like to always use $. Is it possible to paste the domain names and IP addresses from your log file into a comment? I have a regex testing CGI I use to test regex's. I will be glad to test these regular expressions for you without having to wait to check the log file.
    – closetnoc
    Mar 9, 2014 at 21:37
0

Report it to Google. This is fraud and they investigate it (and will refund costs/void invalid clicks).

Depending on the bot (user agent) it might be easier to ban that user agent. By AdSense I'm guessing you mean display ads as it's unlikely you'd be concerned about bots that were earning you more money. Banning a user agent won't deter anyone with any skill, but neither will banning an IP address.

Conversely, you could exclude the IP address from seeing ads in AdWords Ads (campaign settings).

Improve this answer
1
  • The bot uses a fake user agent so that isn't a solution. I wish it was that simple. I reported it to Google, but Google doesn't really care. And yes, Adsense display ads. I'm a publisher.
    – Punct Ulica
    Mar 10, 2014 at 8:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.