################# # flashesofpanic.com - how we're telling some people to fuck off. # Last revised 11 January 2008 ## Major revision 15 April 2005: Rewritten to use mod_security ## as explained at ## The old mod_rewrite, mod_setenvif and mod_access version is ## still at , ## but it is no longer updated. # Note that as of the 2.x versions of mod_security, adding rules # via the .htaccess file is no longer supported. These rules will not # be updated further. # mod_security options SecFilterEngine On SecFilterScanPOST On # SecAuditLog logs/audit_log # Not sure what my host would think of that... SecFilterDefaultAction "deny,status:412" # Would be nice to use here... ################# # Anti-hotlinking rules: # Follows http://alistapart.com/articles/hotlinking (thanks!) # Added 14 January 2007 RewriteEngine On RewriteCond %{REQUEST_FILENAME} .*jpg$|.*gif$|.*png$ [NC] RewriteCond %{HTTP_REFERER} !^$ RewriteCond %{HTTP_REFERER} !flashesofpanic\.com [NC] RewriteCond %{HTTP_REFERER} !yahoo\. [NC] RewriteCond %{HTTP_REFERER} !google\. [NC] RewriteCond %{HTTP_REFERER} !amherst\. [NC] RewriteCond %{HTTP_REFERER} !search\?q=cache [NC] RewriteRule (.*) /showpic.php?pic=$1 ################# # Referer spam rules: # Anti-referer-spam regex, courtesy of Dorothea: # http://cavlec.yarinareth.net/archives/2005/01/11/killing-referrer-spam/ # and extended by myself, Dorothea, and Laurel (http://www.niceperson.org) # Note that one needs to be *careful* with regexes, to # avoid matching more than you intended to! # IMPORTANT NOTE: If a *Google Search* (or other search) containing any # of these terms could find your site, this will *reject* a click-through # on the search result! Haven't figured the mod_security workaround yet. SecFilterSelective "HTTP_REFERER" "(nyx-tones|allauctions4u|statusrank|newsdor|onlinecallingcards|drugtest1|atelierconarte|manicsearch\.info|amazing[sites|pages]\.info|sitesplus\.info|wowlinks\.info|supremelinks\.info|searchquest\.info|wondersearch\.info|fantasypages\.info|siteplus\.info|extremelinks\.info|wwwpages\.info|techiesearch\.info|wains\.info|searchpower\.info|whymarketing|the-tarot|baldwinharbor|bitacle.org|online-dating|-trannies|instantsatellite|loan\..+|soniccash|loanaccept|-keylogger\.|jessica-alba|007-spy|novascotialobsters|beertec|bluearticle|for-all-birds|freecontactsinfo|-ambien|tgirl-|pogai\.info|hiddenrepository|3squirting|marketplace-|anal-|-anal|-mature|mature-|shemale|asian-flu|realtysite|18latina|3333\.ws|bargain-tool|-fatties-|\damateurs|36busty|hentai|3yaoi|the-great-pumpkin|50webs|fincompa|finances-inco|abolishpoverty|stellapast|trumpetmission|thumbguru|spasmodogg|xratedcities|linksclinic|denrer|computerxchange|xratedhostz|x-honi|125mb\.com|3d\.net|ivtcscs|stock-a|appsi|cerretelle-happydale|molords|topcities|membertwo|travinsurance|er5acc|bannbaba|erosfreehost|loan-boat|real-estate-ltd|7zulu|alamuk|kulu-best|filthhost|company-si|home5insurance|boulderfilms|ylaala|v-muga|mesotheliomanexus|anotheruniversesucks|3marketeersproductions|credit-dreams|xinglif|last-lesky|kirckfix|buddhistaidsproject|chilympiad|education-line|musicdownloads|500escorts|der-dzzz|imoney555|pills4order|incestmovieclips|pills-home|iimk\.org|mapi-tech|totaldebtservice|markuvid|z-borge|tugjobs|totaldebtservice|insurancecompanies4you|screensavers4u|realestateslaws\.com|especiallyferrets\.org|carthagelodge\.org|axxs\.de|dog-lover-gift|milflessons|diana-tek|university-degrees-online|cheap-laptop-page|21ebony|cheapestwebhosting|marriage-counseling|monstersofcock|harry-potter-fire|absoluteagency|cxa\.de|bigtitsroundasses|bigmouthfuls|freediabetessupply|contracted\.info|megacockcravers|x-cart\.org|pelikk|ovalx|trans-union-review|jaja-jak|see-her-squirt|picnicworld|foolia|rinngebottet|basdt|ovalx|camgirlslive|pimp-my-ride-tuning|tailro|allsitesaccess|livedatematch|motrr|aff-friend-finder|covver|dangerousdongs|rotbiker|insurance-auto-car|life-quotes-insurance|real-estate-find|free--movie--downloads|v1h|genespp|warrpp|florists-flowers-delivery|ole6\.net|camcrush|poesie4|testthis\.com|lens-cheap|employment-find-jobs|racepointfunding|insurance-by-city|cavehh|boysfirsttime|captainstabbin|inthevip|hotgoth|streetblowjobs|mikesapartment|car-insurance|on\.to|ua-princeton|thetrafficproject|snapmiracle|notepad4u|dualcameras|hostingtutorial|swimming-portal|coll?insky|sigecc|colkk|greenzap|dvd-copy|1st-email-address|buy-hgh|mista-x|threethreethree|op-clan|humor\.com|flower-delivery-2day|dvdwizardpro|e-pills|xanax|buy-2005|registrarprice|life-insurance|rasterweb|squirting\.personalsites|lesbian\.|covert-call|tranny|iwantu|smutdemon|pregnant-anal|mature-grannies|lkh.*\.de|gangbang|bignaturals|shemale-cock|cleanmypcs|milfhunter|firsttimeauditions|welivetogether|big-fat-woman|top-gift-baskets|bukake|private-krankenkasse|hobby-huren|pkv-iq|doobu|motherboard-finder|name-registration-4u|extremetracking|lkh\.de|krankenversicherung|camfun24|skin-care-companies|rowdd|roody|weight-diet|miccel|adultactioncam|coupon-net|refinancing|webcamsgirls|musicbox1|isacommie|qualityonlinejewelry|cologne-perfume|niceshoesonsale|kloony|nakedphoto|italiancharms|lemonrider01|costpercustomer|111-111-4u|quickcontactsonline|shitsite|chat-nett|psxtreme|terashells|yelucie|crescentarian|ronnieazza|lemonrider|insurancequotecity|homeloans4u|smsportal|personal-loans|flowersdeliveredquick|chat-nett|avantbrowser|keljob|phentermine|findwebhostingnow|onlywebhosting4u|book\.skip\.pl|diet-pills|online-bargains|dvdsqueeze|coresat|exitq|asiangen|backupc|cheat-elite|a-bargain|4u\.info|insurancequoteweb|sysrem|mcdortaklar|books\.livenet\.pl|jfcadvocacy|ingyensms|hasslerenterprises|bigyonet|gargzdai|1a1merchantaccounts|neweighweb|darkangelclan|mp-forum|jmsimonr|middlecay|neweighweb|targetindustries|zalaszentgrot|zone-b51|krantas|azian|mor-lite|formula42|paramountseedfarms|reservedining|hdic|ansar-|stories-on|hometeaminspection|catchathief|sportingcolors|ingenysms|rifp|parkviewsoccer|lvcpa|twinky|psychexams|marshallyachts|krantas|devilofnights|rethy|tecrep|tclighting|atlanta2000|suttonjames|nehrucollege|pagetwo|locators|popex|teenassearch|massearch|teensearch|2pursuit|hq_inform|adultfriendfinder|insuranceinfo|lee-hom|itipa|find-it-buy-it|9sekund|kylos|roxtet|spy-software|ionic-bonds|iconsurf|viagra|cialis|tramadol|bill-consolidation|onlinegamingassociation|free-sms|brandimensions|defunctportal|canadianlabels|8gold|texas-hold|hold-em|holdem|fidelityfunding|sportsparent|mortgage|spoodles|houseofseven|stmaryonline|newtruths|popwow|oiline|flafeber|thatwhichis|tmsathai|pisoc|crepesuzette|mediavisor|commerce|easymoney|4free|macsurfer|pussy|blogincome|lillystar|aizzo|webdevsquare|laser-eye|escal8|xopy|vixen1|linkerdome|youradulthosting|inkjet-toner|ime.nu|perfume-cologne|italiancharmsbracelets|shoesdiscount|psnarones|hasfun|casino|gambling|poker|porn|sex|[^A-Za-z]paris[^A-Za-z]|gabriola|nude|xxx|pics|video|adminshop|devaddict|iaea|empathica|insuranceinfo|atelebanon|handy-sms|just-deals|pisx|rimpim)" ################# # Comment spam rules: # Applies the same regex as above to the payload of POST requests. # SecFilterSelective "POST_PAYLOAD" "(allauctions4u|statusrank|newsdor|onlinecallingcards|drugtest1|atelierconarte|manicsearch\.info|amazing[sites|pages]\.info|sitesplus\.info|wowlinks\.info|supremelinks\.info|searchquest\.info|wondersearch\.info|fantasypages\.info|siteplus\.info|extremelinks\.info|wwwpages\.info|techiesearch\.info|wains\.info|searchpower\.info|whymarketing|the-tarot|baldwinharbor|bitacle.org|online-dating|-trannies|instantsatellite|loan\..+|soniccash|loanaccept|-keylogger\.|jessica-alba|007-spy|novascotialobsters|beertec|bluearticle|for-all-birds|freecontactsinfo|-ambien|tgirl-|pogai\.info|hiddenrepository|3squirting|marketplace-|anal-|-anal[^i]|-mature|mature-|shemale|asian-flu|realtysite|18latina|3333\.ws|bargain-tool|-fatties-|\damateurs|36busty|hentai|3yaoi|the-great-pumpkin|50webs|fincompa|finances-inco|abolishpoverty|stellapast|trumpetmission|thumbguru|spasmodogg|xratedcities|linksclinic|denrer|computerxchange|xratedhostz|x-honi|125mb\.com|3d\.net|ivtcscs|stock-a|appsi|cerretelle-happydale|molords|topcities|membertwo|travinsurance|er5acc|bannbaba|erosfreehost|loan-boat|real-estate-ltd|7zulu|alamuk|kulu-best|filthhost|company-si|home5insurance|boulderfilms|ylaala|v-muga|mesotheliomanexus|anotheruniversesucks|3marketeersproductions|credit-dreams|xinglif|last-lesky|kirckfix|buddhistaidsproject|chilympiad|education-line|musicdownloads|500escorts|der-dzzz|imoney555|pills4order|incestmovieclips|pills-home|iimk\.org|mapi-tech|totaldebtservice|markuvid|z-borge|tugjobs|totaldebtservice|insurancecompanies4you|screensavers4u|realestateslaws\.com|especiallyferrets\.org|carthagelodge\.org|axxs\.de|dog-lover-gift|milflessons|diana-tek|university-degrees-online|cheap-laptop-page|21ebony|cheapestwebhosting|marriage-counseling|monstersofcock|harry-potter-fire|absoluteagency|cxa\.de|bigtitsroundasses|bigmouthfuls|freediabetessupply|contracted\.info|megacockcravers|x-cart\.org|pelikk|ovalx|trans-union-review|jaja-jak|see-her-squirt|picnicworld|foolia|rinngebottet|basdt|ovalx|camgirlslive|pimp-my-ride-tuning|tailro|allsitesaccess|livedatematch|motrr|aff-friend-finder|covver|dangerousdongs|rotbiker|insurance-auto-car|life-quotes-insurance|real-estate-find|free--movie--downloads|v1h|genespp|warrpp|florists-flowers-delivery|ole6\.net|camcrush|poesie4|testthis\.com|lens-cheap|employment-find-jobs|racepointfunding|insurance-by-city|cavehh|boysfirsttime|captainstabbin|hey\.com|inthevip|hotgoth|streetblowjobs|mikesapartment|car-insurance|on\.to|ua-princeton|thetrafficproject|snapmiracle|notepad4u|dualcameras|hostingtutorial|swimming-portal|coll?insky|sigecc|colkk|greenzap|dvd-copy|1st-email-address|buy-hgh|mista-x|threethreethree|op-clan|humor\.com|flower-delivery-2day|dvdwizardpro|e-pills|xanax|buy-2005|registrarprice|life-insurance|rasterweb|squirting\.personalsites|lesbian\.|covert-call|tranny|iwantu|smutdemon|pregnant-anal|mature-grannies|lkh.*\.de|gangbang|bignaturals|shemale-cock|cleanmypcs|milfhunter|firsttimeauditions|welivetogether|big-fat-woman|top-gift-baskets|bukake|private-krankenkasse|hobby-huren|pkv-iq|doobu|motherboard-finder|name-registration-4u|extremetracking|lkh\.de|krankenversicherung|camfun24|skin-care-companies|rowdd|roody|weight-diet|miccel|adultactioncam|coupon-net|refinancing|webcamsgirls|musicbox1|isacommie|qualityonlinejewelry|cologne-perfume|niceshoesonsale|kloony|nakedphoto|italiancharms|lemonrider01|costpercustomer|111-111-4u|quickcontactsonline|shitsite|chat-nett|psxtreme|terashells|yelucie|crescentarian|ronnieazza|lemonrider|insurancequotecity|homeloans4u|smsportal|personal-loans|flowersdeliveredquick|chat-nett|avantbrowser|keljob|phentermine|findwebhostingnow|onlywebhosting4u|book\.skip\.pl|diet-pills|online-bargains|dvdsqueeze|coresat|exitq|asiangen|backupc|cheat-elite|a-bargain|4u\.info|insurancequoteweb|sysrem|mcdortaklar|books\.livenet\.pl|jfcadvocacy|ingyensms|hasslerenterprises|bigyonet|gargzdai|1a1merchantaccounts|neweighweb|darkangelclan|mp-forum|jmsimonr|middlecay|neweighweb|targetindustries|zalaszentgrot|zone-b51|krantas|azian|mor-lite|formula42|paramountseedfarms|reservedining|hdic|ansar-|stories-on|hometeaminspection|catchathief|sportingcolors|ingenysms|rifp|parkviewsoccer|lvcpa|twinky|psychexams|marshallyachts|krantas|devilofnights|rethy|tecrep|tclighting|atlanta2000|suttonjames|nehrucollege|pagetwo|locators|popex|teenassearch|massearch|teensearch|2pursuit|hq_inform|adultfriendfinder|insuranceinfo|lee-hom|itipa|find-it-buy-it|9sekund|kylos|roxtet|spy-software|ionic-bonds|iconsurf|viagra|tramadol|bill-consolidation|onlinegamingassociation|free-sms|brandimensions|defunctportal|canadianlabels|8gold|texas-hold|hold-em|holdem|fidelityfunding|sportsparent|mortgage|spoodles|houseofseven|stmaryonline|newtruths|popwow|oiline|flafeber|thatwhichis|tmsathai|pisoc|crepesuzette|mediavisor|commerce|easymoney|4free|macsurfer|pussy|blogincome|lillystar|aizzo|webdevsquare|laser-eye|escal8|xopy|vixen1|linkerdome|youradulthosting|inkjet-toner|ime.nu|perfume-cologne|italiancharmsbracelets|shoesdiscount|psnarones|hasfun|casino|gambling|poker|porn|[^A-Za-z]paris[^A-Za-z]paris|gabriola|nude|xxx|adminshop|devaddict|iaea|empathica|insuranceinfo|atelebanon|handy-sms|just-deals|pisx|rimpim)" # And I need to make specific exceptions for my own MT use - # this can keep me from getting at MT-Blacklist! #SetEnvIf Request_URI "move/mt\.cgi.*" !spam_ref #SetEnvIf Request_URI "move/plugins/Blacklist/mt-blacklist\.cgi.*" !spam_ref ###### # And the ones too dumb to spoof user-agent: SecFilterSelective "HTTP_USER_AGENT" "(hdic|bdfetch|npbot)" # Also from Dorothea, deny by user-agent. This is a known spammer # UA: NT 5.2 is Win2003 Server, .NET. I guess it's the 1.1.4322 that matters. SecFilterSelective "HTTP_USER_AGENT" "\(compatible; MSIE 6\.0; Windows NT 5\.2; \.NET CLR 1\.1\.4322\)" # Looks like Reffy can randomize UAs, so we're still vulnerable there. # Here's one sucker, though, via http://www.annelisabeth.com/blog/archives/000244.html # pineapple baby - comment spammer - see below for an explanation of # what the rewrite rule does. RewriteOptions MaxRedirects=30 RewriteCond %{HTTP:VIA} ^.+pinappleproxy [NC] RewriteCond %{HTTP_REFERER} ^(.*)$ [NC] RewriteRule ^(.*)$ %1 [R=301,L]