PDA

View Full Version : Hitbotters!!!!!!

jamies
06-27-2002, 03:18 PM
Man am i tired of hitbotters , every dam day i get a couple sending me a lot of junk, i put them into my .htaccess only to find the next day there is more. Any ways i dont have alot of traffic put i always try my best to send good quality traffic. Anyways i thought i would post a list of ips that have been hitbotting me.... some of this list is from choker, who has helped me out alot with .htaccess, so thank choker, anyways here is the list.. .
jamie
www.totalyfreesex.com
also looking for some good trades.



deny from 12.226.19.103
deny from 200.42.9
deny from 24.158.55.96
deny from 43.231.251.196
deny from 80.105.80.114
deny from 199.211.188.198
deny from 195.87.160.199
deny from 217.136.4.96
deny from 212.241.65.69
deny from 165.247.45.253
deny from 165.247.45
deny from 210.254.75.2
deny from 210.254.75
deny from 68.49.51.20
deny from 213.181.4
deny from 195.205.23
deny from 211.22
deny from 211.99.140
deny from 211.110
deny from 211.157.101.42
deny from 211.157.166.72
deny from 211.216.216
deny from 217.86.68.92
deny from 217.128.186.3
deny from 217.131.5
deny from 200.171.42.123
deny from 200.158.44.240
deny from 200.158.174.140
deny from 200.158.22.173
deny from 200.171.136.183
deny from 200.212.9.78
deny from 200.174.48.233
deny from 200.191.44.167
deny from 200.204.141.183
deny from 200.191.138.68
deny from 200.191.180.75
deny from 200.191.96.179
deny from 200.191.133.26
deny from 200.227.152.52
deny from 200.211.118.178
deny from 200.191.67.148
deny from 200.206.233.99
deny from 200.210.153.41
deny from 200.227.252.169
deny from 200.227.219.19
deny from 200.191.30.77
deny from 200.227.143.13
deny from 200.193.217.93
deny from 200.244.26.100
deny from 200.167.237.248
deny from 200.191.116.225
deny from 200.170.8.229
deny from 12.237.90.182
deny from 200.217.157.86
deny from 217.57.129.166
deny from 200.207.6.44
deny from 200.223.72.102
deny from 200.188.181.241
deny from 80.133.162.244
deny from 200.176.254.57
deny from 200.227.124.46
deny from 200.215.130.189
deny from 200.211.164.66
deny from 200.203.220.11
deny from 80.136.158.179
deny from 64.158.63.171
deny from 172.139.22.206
deny from 172.21.2.167
deny from 217.87.110.17
deny from 80.136.139.12
deny from 65.206.79.95
deny from 209.122.240.18
deny from 209.180.34.214
deny from 10.22.31.72
deny from 200.189.237.74
deny from 195.178.70
deny from 195.178.71
deny from 193.237.172
deny from 62.155.189
deny from 209.198.37
deny from 24.118.197
deny from 64.218.106
deny from 65.28.12
deny from 216.23.50.99
deny from 141.154.66
deny from 12.254.243.67
deny from 80.142.122.44
deny from 80.142.115.115
deny from 80.142.122.44
deny from 80.142.113.117
deny from 168.95.19.3
deny from 217.8.158.184
deny from 212.35.100.132
deny from 65.116.145.135
deny from 203.198.23.29
deny from 213.97.43.187
deny from 80.35.149.164
deny from 202.134.2.20
deny from 80.139.187.137
deny from 194.51.18.194
deny from 202.134.2.20
deny from twnic.net
deny from 152.66.219.159
deny from 195.120.182.210
cyber_ninja
06-27-2002, 03:21 PM
im glad that i dont trade traffic anymore those damn hitbots were killing me:cussing:
evilc
06-27-2002, 03:22 PM
What if we all post the ip's we ban. We can make a good list that we all can use and will keep hitbotters at bay!!

Is tat a good idea?

:cool:
Due
06-27-2002, 03:25 PM
Originally posted by evilc
What if we all post the ip's we ban. We can make a good list that we all can use and will keep hitbotters at bay!!

Is tat a good idea?

:cool:
Great idea.
Try put 50K IP addresses in your htaccess file + new added every day and see if your server like that ;)
cyber_ninja
06-27-2002, 03:29 PM
We should put all hitbotters on an island and tell Bush that Bin Laden is hideing there:bounce:
jamies
06-27-2002, 03:41 PM
why not post them all, then put them in blocks, that way the file will not be so big. deny from 121.121.121 to 122.122.122
i believe this can be done.
emgee
06-27-2002, 03:50 PM
in 99% of the cases this are NOT hitbots,just peoples who try to download all galleries,so the tradescript get affected.

every day a other surfer from an other ip-range could kick in,and there is no soultion so far. (there is a solution,but not if you try to give SE-spiders full access)

[my private solution is to block 2-3 ip's each day...only to get the next day some new ones..]
Due
06-27-2002, 04:48 PM
This code is working well for me.
They can enter my site with the leach browsers but the moment they try and load a CGI file they are blocked:
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} ^DISCo\Pump.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Drip.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^EirGrabber.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^ExtractorPro.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^EyeNetIE.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^FlashGet.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^GetRight.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Gets.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Go!Zilla.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Go-Ahead-Got-It.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Grafula.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^IBrowse.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^InterGET.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Internet\Ninja.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^JetCar.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^JustView.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^MIDown\tool.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Mister\PiX.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^NearSite.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^NetSpider.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Offline\Explorer.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^PageGrabber.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Papa\Foto.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Pockey.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^ReGet.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Slurp.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^SpaceBison.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^SuperHTTP.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Teleport.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Teleport\Pro.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Teleport* [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebAuto.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebCopier.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebFetch.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebReaper.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebSauger.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebStripper.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebWhacker.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebZIP.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Web\Image\Collector.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Web\Sucker.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Webster.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Wget.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^eCatch.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^ia_archiver.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^lftp.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^tAkeOut.*
RewriteRule .[Cc][Gg][Ii]*$ http://www.tgp4all.com/empty.html [L]
code||die
06-27-2002, 05:04 PM
Originally posted by Due
This code is working well for me.
They can enter my site with the leach browsers but the moment they try and load a CGI file they are blocked:
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} ^DISCo\Pump.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Drip.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^EirGrabber.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^ExtractorPro.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^EyeNetIE.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^FlashGet.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^GetRight.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Gets.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Go!Zilla.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Go-Ahead-Got-It.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Grafula.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^IBrowse.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^InterGET.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Internet\Ninja.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^JetCar.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^JustView.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^MIDown\tool.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Mister\PiX.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^NearSite.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^NetSpider.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Offline\Explorer.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^PageGrabber.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Papa\Foto.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Pockey.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^ReGet.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Slurp.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^SpaceBison.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^SuperHTTP.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Teleport.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Teleport\Pro.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Teleport* [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebAuto.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebCopier.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebFetch.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebReaper.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebSauger.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebStripper.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebWhacker.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebZIP.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Web\Image\Collector.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Web\Sucker.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Webster.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^Wget.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^eCatch.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^ia_archiver.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^lftp.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^tAkeOut.*
RewriteRule .[Cc][Gg][Ii]*$ http://www.tgp4all.com/empty.html [L]

wouldn't "\ " signify a space, instead of "\"?
example:

RewriteCond %{HTTP_USER_AGENT} ^Web\ Sucker.* [OR]
emgee
06-27-2002, 05:57 PM
Due - you still have "slurp" in your file,the inktomi-se-spider;-)

but tomorrow i add the rest of this file to my htaccess.
rowan
06-27-2002, 06:25 PM
Originally posted by Due
This code is working well for me.
They can enter my site with the leach browsers but the moment they try and load a CGI file they are blocked:

<...>


Here's a simple way to get the names of non browsers visiting your site, just put it in an include file wherever you want to check...


$ua = $HTTP_SERVER_VARS["HTTP_USER_AGENT"];
if ($ua == "") $ua = "unknown";
$t = strtolower($ua);
if (strstr($t, "mozilla") == "") {
$d = date("d-M-Y H:i:s");
$t = sprintf("%s %s %s %s\n", $d, $HTTP_SERVER_VARS["REMOTE_ADDR"], $HTTP_SERVER_VARS["REQUEST_URI"], $ua);
$fh = fopen("/PATH/TO/YOUR/LOGS/user-agent.log", "a");
fputs($fh, $t);
fclose($fh);
}


Change PATH/TO/YOUR/LOGS to the appropriate path.

What it does is log any user-agent that does NOT contain the word "mozilla" in it - both MSIE and Netscape do have this. This will log the user-agent of 99% of the non browser visits, like search engine spiders (good) and leech programs (bad).

Or, if you already log user-agent then just do something like

grep -vi mozilla LOGFILENAME.log

Cheers.

(edit cos I called MSIE "Windows". oops ;) )
rocco
06-27-2002, 09:32 PM
Rowman

Is it work for real?

$ua = $HTTP_SERVER_VARS["HTTP_USER_AGENT"];
if ($ua == "") $ua = "unknown";
$t = strtolower($ua);
if (strstr($t, "mozilla") == "") {
$d = date("d-M-Y H:i:s");
$t = sprintf("%s %s %s %s\n", $d, $HTTP_SERVER_VARS["REMOTE_ADDR"], $HTTP_SERVER_VARS["REQUEST_URI"], $ua);
$fh = fopen("/PATH/TO/YOUR/LOGS/user-agent.log", "a");
fputs($fh, $t);
fclose($fh);
}


and does it take a lot of cpu and ram.... I don't know a lot of stuff about that and I asked me if I could try it hehe

Thanks
rowan
06-27-2002, 09:44 PM
Originally posted by rocco
Rowman

<...>
and does it take a lot of cpu and ram.... I don't know a lot of stuff about that and I asked me if I could try it hehe

Thanks

Yeah, it works, I took that directly from an include file on one of my sites. Those few lines of code will use a tiny amount of RAM and hardly any CPU. The only thing that will load the server is the file access (open, seek, write, close), but I've had it going at over 100 hits per sec with no problems.

Cheers.
rocco
06-27-2002, 09:44 PM
Rowman

Is it work for real?

$ua = $HTTP_SERVER_VARS["HTTP_USER_AGENT"];
if ($ua == "") $ua = "unknown";
$t = strtolower($ua);
if (strstr($t, "mozilla") == "") {
$d = date("d-M-Y H:i:s");
$t = sprintf("%s %s %s %s\n", $d, $HTTP_SERVER_VARS["REMOTE_ADDR"], $HTTP_SERVER_VARS["REQUEST_URI"], $ua);
$fh = fopen("/PATH/TO/YOUR/LOGS/user-agent.log", "a");
fputs($fh, $t);
fclose($fh);
}


and does it take a lot of cpu and ram.... I don't know a lot of stuff about that and I asked me if I could try it hehe

Thanks
rocco
06-27-2002, 09:47 PM
Humm and how about Opera browser and aol browser?

Also is it a .htaccess or a cgi file?

Thanks man

Rocco
rowan
06-27-2002, 10:07 PM
Originally posted by rocco
Humm and how about Opera browser and aol browser?

Also is it a .htaccess or a cgi file?

Thanks man

Rocco

You can put in a test for "opera" if you like, from memory the AOL browser user-agent line has mozilla in it.

The above code is PHP but the concept is simple, it could be applied to perl or C as well.

Cheers.