Forum Moderators: open
it's showing a 404 as I have blocked empty referrals to that page using htaccess. So the bot is not able to access that file.
On one site I don't use .php for anything so blocking that--alone--reduced the bad actors over 50%.
RewriteCond %{THE_REQUEST} \.(php|pl)
RewriteCond %{REQUEST_URI} !piwik
RewriteRule \.(php|pl)$ http://127.0.0.1 [R=301,L]
RewriteCond %{HTTP_USER_AGENT} FunWebProducts [NC
I think funwebproducts is something that some users seem to get added to their useragent, never been a problem user for me.
I am wondering if there is any way one can automatically block IPs (on Apache/Linux servers) that access a large number of files in seconds clearly indicating that they are not regular users or legit bots for that matter?
One thing I noticed is that this bot is requesting only one page on my site.
I just found that google has removed the page which I blocked from serving 'empty referrals' from organic listings. And this page was the highest traffic generator to my site.
So blocking 'empty referrals' is definitely not a search engine friendly method. But what else am I supposed to do? There doesn't seem to be any other method to stop the attack.
One thing I noticed is that this bot is requesting only one page on my site. Would it be possible to apply the 'block referrer' rule to this one page alone? This page is located inside a sub-folder.
Will something like this work, provided that I want to apply this rule to the page:
http://www.example.com/foldername/page.php
<IfModule mod_rewrite.c>
#Options +FollowSymlinks
RewriteEngine On
RewriteBase /
RewriteEngine on
RewriteCond %{HTTP_REFERER} ^$
RewriteRule ^foldername/page\.php$ - [F]
</IfModule>
You were very close to solving your issue here and I'm disappointed that nobody picked up and responded.
RewriteCond %{REQUEST_URI} foldername/page\.php
RewriteRule .* - [F]
RewriteRule foldername/page\.php - [F]
you need to spend the necessary time in your logs determining the culprit that is the origin of this botnet
redirecting denied visitors to an alternative page is a very unsound practice
