Referrer spam

vistopher · 2025-09-20 17:58:12

colak wrote #340570:

Maybe I should wait until then?

No guarantee I will update it with any speed.. the plugin should still work after the modification so I’m not too concerned about updating it. Although it will be very nice for future plugins

colak · 2025-09-21 04:31:10

vistopher wrote #340576:

No guarantee I will update it with any speed.. the plugin should still work after the modification so I’m not too concerned about updating it. Although it will be very nice for future plugins

Hi,

I installed and enabled the plugin, but I cannot see the IPs in admin > Visitor logs, but I do see them after clicking on the relevant table in rss_admin_db_manager.

I’m running the latest txp.

colak · 2025-09-21 05:12:09

skewray wrote #340572:

I suspect these hits are Google Cloud, not fake IPs. FYI, my ham-handed solution :

# Google AS15169 Evil=96.2% 2025-08-27 Warning: May block Google employees....

The ranges are not a complete set, just what I’ve seen on my site. If I get the cookie thing working, I may rip this sort of stuff out. It is a bit labor intensive to create.

The RewriteCond %{HTTP_USER_AGENT} directive returns a 500 for me:(

colak · 2025-09-21 05:41:37

I’ve been researching if I can apply the ratelimit_module only for specific IPs. At the moment it is a global directive which is not nice for legit visitors. No results were returned.

vistopher · 2025-09-21 19:07:49

colak wrote #340578:

Hi,

I installed and enabled the plugin, but I cannot see the IPs in admin > Visitor logs, but I do see them after clicking on the relevant table in rss_admin_db_manager.

I’m running the latest txp.

I’ve only tested it on 4.8.8, not the beta versions. I will try to install the latest beta tonight and see if what the issue is.

colak · 2025-09-22 03:33:27

It appears that all attacks come from ips belonging to google starting with 34.174. I’m very close to apply a Deny from 34.174. directive to up to 1 million users.

jakob · 2025-09-22 06:01:23

You are, it seems, not alone as many others are reporting similar activity from those IPs.

colak · 2025-09-22 08:13:02

jakob wrote #340593:

You are, it seems, not alone as many others are reporting similar activity from those IPs.

Thanks so much Julian, I’m glad I’m not the only one. I wrote to google and their form said that they would respond within a week. As others have the problem hopefully Google will take action.
Meanwhile, I’m denying access to every single ip that starts with 34.174.

vistopher · 2025-09-22 13:49:10

colak wrote #340578:

Hi,

I installed and enabled the plugin, but I cannot see the IPs in admin > Visitor logs, but I do see them after clicking on the relevant table in rss_admin_db_manager.

I’m running the latest txp.

Alright, the github is updated and works with the 4.9.0 beta versions.

This is the change I had not accounted for:

Developer: ‘Visitor logs’ panel is now bound to the new ‘lore’ event name (was: ‘log’) to prevent conflicts with privacy filters.

colak · 2025-09-22 15:19:34

vistopher wrote #340601:

Alright, the github is updated and works with the 4.9.0 beta versions.

Developer: ‘Visitor logs’ panel is now bound to the new ‘lore’ event name (was: ‘log’) to prevent conflicts with privacy filters.

Thanks so much. It works as intended.

phiw13 · 2025-09-23 08:06:04

colak wrote #340592:

I’m very close to apply a Deny from 34.174. directive to up to 1 million users.

Out of curiosity, which syntax are you using? The older (Apache 2.2) Allow / Deny Directive, or the newer Require Directive (see Apache docs)?

<RequireAll>
    Require all granted
    Require not ip 34.174.
</RequireAll>

Although from the docs it is not clear if a partial IP address actually work. Documentation seems a little unclear, although this page (httpd.apache.org/docs/2.4/howto/access.html#host) it seems to imply a partial IP is allowed (and posting the above in my .htaccess does not throw a 500).

colak · 2025-09-23 14:30:15

phiw13 wrote #340613:

Out of curiosity, which syntax are you using? The older (Apache 2.2) Allow / Deny Directive, or the newer Require Directive (see Apache docs)?

<RequireAll>...

Although from the docs it is not clear if a partial IP address actually work. Documentation seems a little unclear, although this page (httpd.apache.org/docs/2.4/howto/access.html#host) it seems to imply a partial IP is allowed (and posting the above in my .htaccess does not throw a 500).

Hi Philippe,
I use the latest 2.4 version, and the following in my htaccess.

<RequireAll>
Require all granted
Require not ip 34.174.0.0/16
</RequireAll>

Require not ip 34.174 did not work for me.

phiw13 · 2025-09-23 23:54:24

colak wrote #340615:

Hi Philippe,
I use the latest 2.4 version, and the following in my htaccess.

<RequireAll>...

Require not ip 34.174 did not work for me.

Thanks! So partial IP is’t apparently working as well as dreamed about. Good to know.

I had previously only worked with full specific IPs.. I currently have no needs to go blocking on a large scale, but who knows what the future brings.

colak · 2025-09-24 02:10:16

Just to clarify that Require not ip 34.174.0.0/16 works as Require not ip 34.174. should have worked.

I think that it is harsh mass blocking 1 million IPs, but hopefully the attack will stop in a few days, and I’ll comment out the rule.

skewray · 2025-09-24 03:04:09

On my site, Require not ip 34.174.0.0/16 does not work, but Require not ip 34.174. does. The first does pass the syntax check, since everything including and after the / is ignored. This is why I ended up doing the code I posted earlier. That, and I didn’t want to block legitimate traffic like googlebots, Mastodon servers, Bluesky, &c.

Textpattern CMS support forum

#16 2025-09-20 17:58:12

Re: Referrer spam

colak wrote #340570:

#17 2025-09-21 04:31:10

Re: Referrer spam

vistopher wrote #340576:

#18 2025-09-21 05:12:09

Re: Referrer spam

skewray wrote #340572:

#19 2025-09-21 05:41:37

Re: Referrer spam

#20 2025-09-21 19:07:49

Re: Referrer spam

colak wrote #340578:

#21 2025-09-22 03:33:27

Re: Referrer spam

#22 2025-09-22 06:01:23

Re: Referrer spam

#23 2025-09-22 08:13:02

Re: Referrer spam

jakob wrote #340593:

#24 2025-09-22 13:49:10

Re: Referrer spam

colak wrote #340578:

#25 2025-09-22 15:19:34

Re: Referrer spam

vistopher wrote #340601:

#26 2025-09-23 08:06:04

Re: Referrer spam

colak wrote #340592:

#27 2025-09-23 14:30:15

Re: Referrer spam

phiw13 wrote #340613:

#28 2025-09-23 23:54:24

Re: Referrer spam

colak wrote #340615:

#29 2025-09-24 02:10:16

Re: Referrer spam

#30 2025-09-24 03:04:09

Re: Referrer spam

Board footer