Go to main content

Textpattern CMS support forum

You are not logged in. Register | Login | Help

#1 2014-08-23 22:53:55

detail
Member
From: geez, I seem to be in NZ
Registered: 2010-07-13
Posts: 176
Website

Avoid semalt.com

Somehow in the not so distant past I must have logged on to semalt.com who claim to be a SEO company. Actually they did offer a reasonable analysis of a few basic issues I had but it appears that they are some kind of info harvesting scam. There’s a few blogs about their pernicious activities.

logorrhoea.net/2014/01/how-to-block-semalt-com-referrer-traffic-using-htaccess/
www.onlinethreatalerts.com/article/2014/1/1/what-is-the-website-www-semalt-com-about/

I have been having them bot my sites up to 100 times a day, each from various servers around the world, all from various sub domains.

35.semalt.com/crawler.php?u=http:/…
51.semalt.com/crawler.php?u=http:/…
98.semalt.com/crawler.php?u=http:/…
33.semalt.com/crawler.php?u=http:/…
17.semalt.com/crawler.php?u=http:/…
95.semalt.com/crawler.php?u=http:/…
29.semalt.com/crawler.php?u=http:/…
12.semalt.com/crawler.php?u=http:/…
17.semalt.com/crawler.php?u=http:/…
29.semalt.com/crawler.php?u=http:/…
65.semalt.com/crawler.php?u=http:/…
29.semalt.com/crawler.php?u=http:/…
96.semalt.com/crawler.php?u=http:/…
45.semalt.com/crawler.php?u=http:/…
52.semalt.com/crawler.php?u=http:/…

I guess you get the picture …

There’s also unexplained bots from kambasoft and savetubevideo, which I am told are related.

One of the recommended ways to deter these pests is to add a few lines to the .htaccess file.

RewriteEngine On
RewriteCond %{HTTP_REFERER} ^http://.*semalt\.com [NC,OR]
RewriteCond %{HTTP_REFERER} ^http://.*kambasoft\.com [NC,OR]
RewriteCond %{HTTP_REFERER} ^http://.*savetubevideo\.com [NC]
RewriteRule (.*) http://www.semalt.com [R=301,L]

Anyone have any thoughts on this before I commit myself?

Offline

#2 2014-08-24 07:26:39

gaekwad
Server grease monkey
From: People's Republic of Cornwall
Registered: 2005-11-19
Posts: 4,137
GitHub

Re: Avoid semalt.com

I’ve had semalt.com appearing in access logs, even without signing up for anything – they’re pretty widespread, in my experience.

Offline

#3 2014-08-24 13:26:10

colak
Admin
From: Cyprus
Registered: 2004-11-20
Posts: 9,011
Website GitHub Mastodon Twitter

Re: Avoid semalt.com

i don’t know much about htaccess but I seem to remember that the redirect uses a lot of resources. I think (somebody please correct me) that it is best to serve a 403. Something like

RewriteEngine on
# Options +FollowSymlinks
RewriteCond %{HTTP_REFERER} ^http://.*semalt\.com [NC,OR]
RewriteCond %{HTTP_REFERER} ^http://.*kambasoft\.com [NC,OR]
RewriteCond %{HTTP_REFERER} ^http://.*savetubevideo\.com [NC]
RewriteRule .* - [F]

> Edit

A web search returned the solution bellow which somehow looks better

RewriteEngine on
RewriteCond %{HTTP_REFERER} ^https?://([^.]+\.)*kambasoft\.com [NC,OR]
RewriteCond %{HTTP_REFERER} ^https?://([^.]+\.)*semalt\.com [NC,OR]
RewriteCond %{HTTP_REFERER} ^http?://([^.]+\.)*savetubevideo\.com [NC]
RewriteRule .* - [F]

Last edited by colak (2014-08-24 16:12:15)


Yiannis
——————————
NeMe | hblack.art | EMAP | A Sea change | Toolkit of Care
I do my best editing after I click on the submit button.

Offline

#4 2014-08-24 22:34:30

detail
Member
From: geez, I seem to be in NZ
Registered: 2010-07-13
Posts: 176
Website

Re: Avoid semalt.com

Y

Thanks for that.

I think the object of that last line I have there is that rather than getting your site’s error message it redirects back to the spammer’s site.

RewriteRule (.*) http://www.semalt.com [R=301,L]

Something about Google finding all these 403 error messages and adding a black mark against your site. That’s probably the point of all this.

Anyway, I’ll see if it Stops the Bots. (Australians might get that joke.)

PS It looks as if there is another attacking site: musica . descargar – musica – gratis . net /

G

Offline

#5 2014-08-25 23:46:38

detail
Member
From: geez, I seem to be in NZ
Registered: 2010-07-13
Posts: 176
Website

Re: Avoid semalt.com

Ha.

That’s managed to stifle the bots. Haven’t seen any subsequently after 30 hours.

And without seeming to lose other more standard page views.

A muchly happy ending to a curious site invasion.

Offline

Board footer

Powered by FluxBB