{"id":1256,"date":"2011-01-28T13:29:51","date_gmt":"2011-01-28T12:29:51","guid":{"rendered":"http:\/\/t-machine.org\/?p=1256"},"modified":"2011-01-28T13:29:51","modified_gmt":"2011-01-28T12:29:51","slug":"modsecurity-updated-anti-spam-marketer-rule","status":"publish","type":"post","link":"http:\/\/new.t-machine.org\/index.php\/2011\/01\/28\/modsecurity-updated-anti-spam-marketer-rule\/","title":{"rendered":"ModSecurity updated anti-spam marketer rule"},"content":{"rendered":"

After a little tweaking, my rule is growing, and proving extremely effective:<\/p>\n

\n

# bad websites: domains which regularly or overwhelmingly feature spam
\nSecRule REQUEST_HEADERS:REFERER “http:\/\/[^\/]*(yijiezi|yourhcg|lukejaten|squidoo|answerbag|jvlai|chaohuis|cledit|bait|lukejaten)” “t:lowercase,deny,nolog,status:500”<\/p>\n

# porn and gambling: they make much cash out of random visitors
\nSecRule REQUEST_HEADERS:REFERER “http:\/\/[^\/]*(holdem|poker|casino|porn|girlz|pussy|penis|babe|exposed|sex)” “t:lowercase,deny,nolog,status:500”<\/p>\n

# fake \/ illegal designer clothing and luxury goods
\nSecRule REQUEST_HEADERS:REFERER “http:\/\/[^\/]*(shop|store|cheap|gossip|handbag|money|deluxe|sunglass|chanel|replica|buy|sale|furniture)” “t:lowercase,deny,nolog,status:500”<\/p>\n

# celebrity gossip and trying to make money out of children, I guess
\nSecRule REQUEST_HEADERS:REFERER “http:\/\/[^\/]*(miley|bieber|pokemon)” “t:lowercase,deny,nolog,status:500”<\/p>\n

# side-effects of Republican America?
\nSecRule REQUEST_HEADERS:REFERER “http:\/\/[^\/]*(health|dental|pills|treatment|seller)” “t:lowercase,deny,nolog,status:500”<\/p>\n

# side-effects of weakly-regulated investment markets?
\nSecRule REQUEST_HEADERS:REFERER “http:\/\/[^\/]*(forex|realty|invest|loans)” “t:lowercase,deny,nolog,status:500”<\/p>\n

# the people that created this problem
\nSecRule REQUEST_HEADERS:REFERER “http:\/\/[^\/]*(seo)” “t:lowercase,deny,nolog,status:500”<\/p>\n

# webhosting and bodybuilding: apparently, these industries are as commoditized as porn and gambling – LOL
\nSecRule REQUEST_HEADERS:REFERER “http:\/\/[^\/]*(download|hosting|videos|bodybuilding|bodybuild)” “t:lowercase,deny,nolog,status:500”\n<\/p><\/blockquote>\n

Incidentally, I looked into using wordlists for this, but they don’t work. The most effective anti-spam is to look at the domain-names – these sites are trying to get good rankings for their domains, not for specific pages. Apart from the spam-friendly sites, where it’s a combination of both.<\/p>\n

So .. sadly … we need the regexp so that we can target the domain-name specifically. If ModSecurity were better (documented) I’m sure it could easily do that. I’m suspicious it *does* do that, but with their shotgun approach to documentation, it could take days or weeks to discover it if so :).<\/p>\n","protected":false},"excerpt":{"rendered":"

After a little tweaking, my rule is growing, and proving extremely effective: # bad websites: domains which regularly or overwhelmingly feature spam SecRule REQUEST_HEADERS:REFERER “http:\/\/[^\/]*(yijiezi|yourhcg|lukejaten|squidoo|answerbag|jvlai|chaohuis|cledit|bait|lukejaten)” “t:lowercase,deny,nolog,status:500” # porn and gambling: they make much cash out of random visitors SecRule REQUEST_HEADERS:REFERER “http:\/\/[^\/]*(holdem|poker|casino|porn|girlz|pussy|penis|babe|exposed|sex)” “t:lowercase,deny,nolog,status:500” # fake \/ illegal designer clothing and luxury goods SecRule REQUEST_HEADERS:REFERER “http:\/\/[^\/]*(shop|store|cheap|gossip|handbag|money|deluxe|sunglass|chanel|replica|buy|sale|furniture)” “t:lowercase,deny,nolog,status:500” […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,45],"tags":[],"_links":{"self":[{"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/posts\/1256"}],"collection":[{"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/comments?post=1256"}],"version-history":[{"count":0,"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/posts\/1256\/revisions"}],"wp:attachment":[{"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/media?parent=1256"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/categories?post=1256"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/new.t-machine.org\/index.php\/wp-json\/wp\/v2\/tags?post=1256"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}