Forum Replies Created

Viewing 15 replies - 16 through 30 (of 30 total)
  • Thread Starter mwillems

    (@mwillems)

    Otto,

    There appears to be a big battle going on here, see above.

    I tried the plugin, but it actually did not work for me, for some reason (database tables made, but activate it and I could not see my own web site, and yet no logging was done).

    Plus, one poster above thinks it is laughable and idiotic (etc) to use that plugin – hence I tried .htaccess at his advice..

    Michael

    Thread Starter mwillems

    (@mwillems)

    You are really grumpy, aren’t you? Of course I am reading. The question was “should I really kill ALL mentions of those words?”

    Eg if I do pill, what if http://www.rape-and-pillage.com refers to me? if I kill credit, what if http://www.credit.co.uk wants to use my services?

    FYI, my .htaccess now looks like this, and I have only just started: I suspect I will have 1,000 terms in there before I am done….;)

    RewriteCond %{HTTP_REFERER} ^(.*)phentermine(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)dietpills(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)credit-card(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)mortgage(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)las-vegas(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)casino(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)poker(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)black-jack(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)tramadol(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)xanax(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)vioxx(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)valtrex(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)celexa(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)paxil(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)hoodia(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)zyrtec(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)allegra(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)diflucan(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)cheap-soma(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)lipitor(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)hydrocodone(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)ambien(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)zoloft(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)valium(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)floxacin(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)erectile-dysfunction(.*)$ [NC,OR]
    RewriteCond %{HTTP_REFERER} ^(.*)adipex(.*)$ [NC]

    Thread Starter mwillems

    (@mwillems)

    And I still wonder how to do this using .htaccess.

    Like I have 152 variants in the last two days of the word “mortgage”. I counted. I either exclude all mortgage posts (might be a bit heavy) or add 152 lines to the htaccess for THIS thing alone – and then there’s all the pills, the sex, etc.

    Thread Starter mwillems

    (@mwillems)

    Oh and what am I tryoing to do? When this happens, several times a day (like, 2-4 times), my server load goes up to at least 50-100. So the server effectively dies. I turn off httpd (which takes me forever under that load) and the load vanishes immediately.

    Thread Starter mwillems

    (@mwillems)

    >>>Are these all referrer to the same other site? Specifically, shaablog.com?<<<

    I wish. Twice a day, that domain changes.

    Whoami: OK, aha… .htaccess then? Let’s see if I can get httpd.conf configured right to actually read it then.

    Thread Starter mwillems

    (@mwillems)

    But surely, whoami, mod_rewrite does not do the kind of stuff that this script does?

    Thread Starter mwillems

    (@mwillems)

    Whoami,

    If you saw my logs you would not suggest that, I think. It is not just Phentermine. There are literally hundreds of strings. From child porn to herbal viagra. They change daily.

    Michael

    Thread Starter mwillems

    (@mwillems)

    Terry, yes, it is the very first line.

    And your ideas are very welcome, Terry!

    AHA — the string as suggested by the sacript was wrong: it was <?php include_once (“/var/www/html/willems.ca/blog/wp-content/referrer-karma.php”); check_referrer(); ?>

    That should have read <?php include_once (“/blog/wp-content/referrer-karma.php”); check_referrer(); ?>

    So now, wqhen I browse my own site, I get a blank page only. Maybe my internal IP is not reverse lookup-able or something?

    The database is still empty though., In other words the passwords etc are good, since the tables have been created – but the tables are still empty.

    Michael

    Thread Starter mwillems

    (@mwillems)

    Terry,

    Yes I did add that line, and yes, to the Blog’s main index.php file.

    Whoami,

    No, the strings change daily. HELLOOO! to you too. 🙂

    Thread Starter mwillems

    (@mwillems)

    It seems to be working now – added to /bog/index.php

    But I see nothing in the logs yet, even though I see people hitting the blog (I am watching tail -f /var/log/httpd/access.log in real time). Is ther ea delay before log entries show, or does it only show blocked entries?

    Thread Starter mwillems

    (@mwillems)

    Cancel that red bar question – my bad. Apologies. Typo in the database name… sorry.

    Thread Starter mwillems

    (@mwillems)

    Ok, tha looks like what I need, except when I run the test page, I see only a red bar that says:

    check_referrer() error.

    Does that mean it cannot do a reverse lookup on my own internal IP, or is something else wrong? I am reluctant to mess with my site unless I know what is going on, of course.. anyone use this great-looking script?

    Thread Starter mwillems

    (@mwillems)

    Will follow the link.

    The URL changes several times a day, so that wil not work.

    Can you or anyone tell me what is actually happening here? Is some fake site pointing to me, and are people following that link? Why?? Is this a DDOS, or is this somehow intended to get people to buy fake drugs: in which case why would it do that? I am really puzzled!

    Oh! It was http://rpc.pingomatic.com/ – that slows it down very dramatically. Taking that away, all is oK.

    I have the same problem (1.5). Turning off “notify all blogs” makes no difference as far as I can detect. The blog is at http://www.willems.ca/blog/

    This is stopping me from continuing my blog – any suggestions anyone? I have seen that options suggestied- tried that, no difference. Anything else?

Viewing 15 replies - 16 through 30 (of 30 total)