Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

One of our primary webservers, which runs Apache on Ubuntu, is coming under attack from heaps of referrer SPAM requests lately. There's enough of this that it is really sucking up our internet bandwidth.

How do others deal with this and block it?

Update: OK, thanks to Kevin, I've installed fail2ban and am seeing what I can filter with it. Any suggestions still gratefully accepted though ;-)

share|improve this question
up vote 3 down vote accepted

There's a really comprehensive .htaccess file here that will deny the majority of those bad bots for you.

Just edit the last line to 'forbid', rather than sending them to the honeypot script...

e.g.: change last line to:

RewriteRule ^.* - [F]

EDIT: Yes "Mozilla/4.0.." spoofing is annoying. If you can't block by user-agent header, then IP addresses have to be the way to go.

For an automated self maintaining solution, have a look at project honeypot!

/ Richy

share|improve this answer
Thanks, that's a useful file to add. Although I do notice that most of them are spoofing "Mozilla/4.0...." – Glenn Jun 1 '09 at 6:41
Then project honeypot may help. I've edited the answer to provide info on this. – Rich Jun 1 '09 at 8:31

Is there anything you can use in the referrer request that you could feed to fail2ban?

share|improve this answer
OK, I've found the website for it and am reading through the documentation. Will try it out as a first step... – Glenn Jun 1 '09 at 5:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.