Wir mögen keinen Referer Spam, und auch keine Werbung im User-Agent!

# Bad-IP-Liste z.B. ns27.referertrick.com IP 87.118.122.99
deny from 87.           oder
deny from 87.118.       oder
deny from 87.118.122.   oder
deny from 87.118.122.99

# Bad-Word-Liste im User Agent
RewriteEngine on
RewriteCond %{HTTP_REFERER} doctor [OR]
RewriteCond %{HTTP_REFERER} pharma [OR]
RewriteRule ^.*$ - [forbidden,last]

# User Agent
SetEnvIfNoCase User-Agent "iCCrawler - iCjobs" banned=yes
SetEnvIfNoCase Referer icjobs.de banned=yes
order deny,allow
deny from env=banned

<?php
$url = "http://".$_SERVER['HTTP_HOST'].getenv('REQUEST_URI');
$getdate = date('d m Y');
$gettime = date('H:i:s');

if (!empty($_SERVER['HTTP_REFERER'])) {
$HTTP_REFERER = $_SERVER['HTTP_REFERER'];
}

if (!empty($_SERVER['HTTP_USER_AGENT'])) {
$HTTP_USER_AGENT = $_SERVER['HTTP_USER_AGENT'];
}

function bannedIP() {

if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
$HTTP_X_FORWARDED_FOR = $_SERVER['HTTP_X_FORWARDED_FOR'];
}

if (!empty($_SERVER['HTTP_X_FORWARDED'])) {
$HTTP_X_FORWARDED = $_SERVER['HTTP_X_FORWARDED'];
}

if (!empty($_SERVER['HTTP_FORWARDED_FOR'])) {
$HTTP_FORWARDED_FOR = $_SERVER['HTTP_FORWARDED_FOR'];
}

if (!empty($_SERVER['HTTP_FORWARDED'])) {
$HTTP_FORWARDED = $_SERVER['HTTP_FORWARDED'];
}

if (!empty($_SERVER['HTTP_VIA'])) {
$HTTP_VIA = $_SERVER['HTTP_VIA'];
}

if (!empty($_SERVER['HTTP_X_COMING_FROM'])) {
$HTTP_X_COMING_FROM = $_SERVER['HTTP_X_COMING_FROM'];
}

if (!empty($_SERVER['HTTP_COMING_FROM'])) {
$HTTP_COMING_FROM = $_SERVER['HTTP_COMING_FROM'];
}

if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
$HTTP_CLIENT_IP = $_SERVER['HTTP_CLIENT_IP'];
}

if (!empty($_SERVER['REMOTE_ADDR'])) {
$REMOTE_ADDR = $_SERVER['REMOTE_ADDR'];
}

$proxy_ip = '';
if (!empty($HTTP_X_FORWARDED_FOR)) {
$proxy_ip = $HTTP_X_FORWARDED_FOR;
} else if (!empty($HTTP_X_FORWARDED)) {
$proxy_ip = $HTTP_X_FORWARDED;
} else if (!empty($HTTP_FORWARDED_FOR)) {
$proxy_ip = $HTTP_FORWARDED_FOR;
} else if (!empty($HTTP_FORWARDED)) {
$proxy_ip = $HTTP_FORWARDED;
} else if (!empty($HTTP_VIA)) {
$proxy_ip = $HTTP_VIA;
} else if (!empty($HTTP_X_COMING_FROM)) {
$proxy_ip = $HTTP_X_COMING_FROM;
} else if (!empty($HTTP_COMING_FROM)) {
$proxy_ip = $HTTP_COMING_FROM;
}

if (!empty($proxy_ip)) {
return $proxy_ip;
} else if (!empty($HTTP_CLIENT_IP)) {
return $HTTP_CLIENT_IP;
} else if (!empty($REMOTE_ADDR)) {
return $REMOTE_ADDR;
}
}

$ip_rm  = bannedIP();

/*Spam-Bots ärgern und abwenden*/
if ($ip_rm == gethostbyaddr($ip_rm)) {
$fp = fopen($_SERVER['DOCUMENT_ROOT']."/path/to/log_ip.log", "a");
$out = "noHOST logged on $getdate at $gettime for IP: $ip_rm URL: $url UA: $HTTP_USER_AGENT\r\n";
fwrite($fp, $out);
fclose($fp);
header('Location: http://'.$_SERVER['HTTP_HOST'].'/bye_bye.php');
/* oder Adress-Sammler mit Müll füttern*/ PHP-Script Schoberbuster
exit();
}

/*IP Address Range sperren*/
$banned_ip = array();
$banned_ip[] = '/72.29.68.228/';    //desert.safarihost.com
$banned_ip[] = '/87.118.90.146/';   //ns.km37031.keymachine.de -> unister-gmbh.de
$banned_ip[] = '/87.118.116.23/';   //ns.km31539.keymachine.de -> keyweb.de
$banned_ip[] = '/87.118.122.99/';   //ns27.referertrick.com
$banned_ip[] = '/87.230.47.8/';     //vwp3769.webpack.hosteurope.de
$banned_ip[] = '/178.63.25.142/';   //server5.bplaced.ne == xrmb2.net
$banned_ip[] = '/188.40.239.*/';    //on2.de - Sunrise GmbH
$banned_ip[] = '/217.114.213.156/'; //ns1.sourcedns.eu -> www.suedtirol-auskunft.com

foreach($banned_ip as $banned) {
if (preg_match($banned,$ip_rm)) {
$fp = fopen($_SERVER['DOCUMENT_ROOT']."/path/to/log_ip.log", "a");
$out = "Visit logged on $getdate at $gettime for IP: $ip_rm URL: $url\r\n";
fwrite($fp, $out);
fclose($fp);
header('Location: http://'.$_SERVER['HTTP_HOST'].'/bye_bye.php');
exit();
}
}

/*Referer spammer ärgern, abwenden, automatisch sperren*/
$myurl = "http://".$_SERVER['HTTP_HOST'];

function backlinkCheck($HTTP_REFERER,$myurl) {
$arrRemote = file($HTTP_REFERER);
for ($i=0; $i<count($arrRemote); $i++) {
$Remote = $Remote . $arrRemote[$i];
}
if (stristr($Remote,$myurl)) {
return true;
} else {
return false;
}
}

$refer = explode('/', $HTTP_REFERER);
if (!empty($HTTP_REFERER) && ($refer[2] != $_SERVER['HTTP_HOST'])) {
if (backlinkCheck($HTTP_REFERER,$myurl) != true) {
$fr = fsockopen($refer[2], 80, $errno, $errstr, 1);
if ($fr) {
$ref = "GET / HTTP/1.1\r\n";
$ref .= "Host: " . $refer[2] . "\r\n";
$ref .= "Referer: http://".$_SERVER['HTTP_HOST']."/banned.php\r\n";
$ref .= "User-Agent: Mozilla/5.0 (Linux x86_64; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8\r\n";
$ref .= "Connection: Close\r\n\r\n";
fwrite($fr, $ref);
fclose($fr);
}
$fp = fopen($_SERVER['DOCUMENT_ROOT']."/path/to/log_rf.log", "a");
$out = "Referer logged on $getdate at $gettime for IP: $ip_rm Referer: $HTTP_REFERER UA: $HTTP_USER_AGENT\r\n";
fwrite($fp, $out);
fclose($fp);
header('Location: http://'.$_SERVER['HTTP_HOST'].'/bye_bye.php');
exit();
}
}

/*User-Agent spammer abwenden, sperren*/
$banned_ua = '#cash|casino|cheap#i';

if ((!empty($HTTP_USER_AGENT) && preg_match($log_ua,$HTTP_USER_AGENT)) || empty($HTTP_USER_AGENT)) {
$fp = fopen($_SERVER['DOCUMENT_ROOT']."/path/to/log_ua.log", "a");
$out = "UA logged on $getdate at $gettime for IP: $ip_rm URL: $url UA: $HTTP_USER_AGENT\r\n";
fwrite($fp, $out);
fclose($fp);
header('Location: http://'.$_SERVER['HTTP_HOST'].'/bye_bye.php');
exit();
}
?>