Programs: Lock up your servers against Fusker

[RawAlex]

I have spent a little time looking at fusker over the last couple of weeks, and I am shocked at the number of programs that are leaving their free gallery servers wide open.

There is NO good coming out of this. You might thing you are getting type in sales because people see the content and want more, but honestly, why would they?

http://www.fusker.lewww.com/index.php?query=trixieteen

There are more than enough images here for any sane tosser to get off. No need to pay you guys a thing.

It's frustrating when I start to see these guys in the top 10 on search engines.

Affiliate programs: LOCK UP YOUR FREE GALLERY SERVERS. Support your affiliates that support you.

Alex

[Boogie]

add

http://www.fusker.lewww.com/index.php?query=sterlingcash

sterlingcash to that list. first one i checked, first one i found.


Some

ravenriley ones too:

http://www.fusker.lewww.com/index.php?query=ravenriley.com

seems like a big problem to me. Give every gallery you got away for free in one spot with no links to your adds.

what is left for them to buy?

[cd34]

well, here's one problem -- if they turn off the referrer, the galleries still come up even when blocking 'fusker' urls.

Short of protecting the files through a more sophisticated method, blocking by referrer isn't going to do much except annoy those that don't know how to turn off the referrer.

If you block empty referrers, people surfing with privacy software won't see the images. I looked through, and it is apparant that they are posting sites that are indeed blocking referrers of some of my clients (and those clients have had anti-hotlinking in there for ages), but, the only reason they would be of any value is if they were expecting people that weren't passing the referrer.

Note: this is evidenced by all of the img.photobucket.com posts. They block anything that sends the fusker referer, yet, are quite prevalent in the listings.

[Chop Smith]

Thanks Alex. About 20% of my free hosted galleries are on that blood sucker and 3 or 4 HFS'. Asking them to remove them but probably will not do any good, so I am off to do some research.

[RawAlex]

cd, I think we get back to the old "lock up images to your own domain only". Most programs have their galleries on a single domain, so restrict image calls to that domain only, perhaps allowing yahoo and google through. Otherwise, there should be no reason for anyone else to be linking to those images. The only place they should be used is inside the freehosted gallery, called from the domain itself.

galleries.myprogram.com is the only place that calls the images legally. Everyone else is a hotlinker.

How hard is that?

Alex

[RawAlex]

let me clarify: if people are linking to THE GALLERY PAGES, you want them in. If they are calling the images directly, you don't.

Turn off the referer or not - if you are not calling the images from your gallery page on your own server, then block them.

html pages are fine - but fusker never links to html. They just want your jpgs.

Alex

[cd34]

RewriteCond %{HTTP_REFERER} !^$

This is the rule that becomes the problem.

If you allow the empty referrer, the image can be seen by the smart fusker surfers. However, if you don't allow it, guys running privacy software cannot see your gallery page.

The problem with allowing the good is writing a regexp that can't be exploited easily. If we're lax on the url specificity, they could simply insert google somewhere in their url and then it makes the rule 10x more difficult to construct. :)

It becomes a real quandry.

[Head Boy]

Do we still get credits for surfers with blanked referrers? If not, it would be better to discourage their use. :)

[raymor]

I've designed what should be a reasonably good solution
for this. It'd secure your images and shouldn't block anyone,
no matter if they have they block the referer or not.
It's a couple of scripts and a bit of creative .htaccess that
I'd need to just code up real quick if there's enough interest.
I'd sell my script installed and tested, sold per domain.
In order that I might know if this would be worth my while
to code up, test, and let people know about, what do you
guys and gals think would be a fair price for it that you'd
be willing to pay?

[Chop Smith]

About the same price as strongbox. If it works as well as strongbox, there should be a good market for it. Feel free to test it on my stuff

[RawAlex]

raymor, I think that wouldn't be a bad idea.

Sparky: I think that for affiliates and programs alike, people surfing with privacy software is just a waste of time anyway. These people are WAY to scared to even suggest to use a credit card online, so why bother?

Fusker also has links like this:
http://invis.free.anonymizer.com/http://img.photobucket.com/albums/v243/me0hmaya/PHOT0500.jpg

They are using anonymizer to try to hide themselves.

People using this type of service have issues. Programs should not be sad to see them not be able to see content.

Alex

[Mr. Blue]

I read on another board that programs don't necessarily mind fusker grabbing their pictures. Still people are seeing the watermark on these photos, still seeing the URL, maybe they might type in the url and the program would get some type in traffic. That traffic would be all profit as they don't have to pay an affiliate. I guess that's the logic they're using when making the decision not to block fusker.

[Useless]

Sparky: I think that for affiliates and programs alike, people surfing with privacy software is just a waste of time anyway. These people are WAY to scared to even suggest to use a credit card online, so why bother?
I whole-heartedly agree. These surfers probably aren't even seeing our banners anyway because they have Norton blocking all advertising. I really don't mind if they don't see my images.

I read on another board that programs don't necessarily mind fusker grabbing their pictures. Still people are seeing the watermark on these photos, still seeing the URL, maybe they might type in the url and the program would get some type in traffic.
And George Bush will bring democracy to the Middle East.

That is flawed thinking on the sponsor's part. There are sooo many pics on Fusker and such a large variety, it offers much more content than many paysites (perhaps all). Type-in traffic from Fuskerers is as plentiful as exit link traffic, I'm sure. I'd fire my marketing & promotions person if he/she told me that I'd make money by allowing hotlinking without any real text & banner advertising to go along with it.

[Cleo]

Besides the problems with Fusker type sites there is the problems with password type sharing sites. Many paysites rely on only htaccess to protect their member's area which also allows site ripping. When Angel added Strongbox to her site sign ups almost doubled as they could no longer get access from the password sites and her member's area could no longer be ripped.

[Ramster]

StrongBox is fantastic, no doubt.

Fusker? I'm at a lost. I recented added htaccess to my hosted gallery server to only allow the images to be pulled from the hosted gallery domain for the most part.

I hate these fuckers. It is INSANE INSANE INSANE that some of the big programs don't just shut these fucking leaches down. They can do it in a day easily. A few of them get together and send some letters out to the hosts and registrars on the same day. Why don't they do that?

[Mr. Blue]

And George Bush will bring democracy to the Middle East.

That is flawed thinking on the sponsor's part. There are sooo many pics on Fusker and such a large variety, it offers much more content than many paysites (perhaps all). Type-in traffic from Fuskerers is as plentiful as exit link traffic, I'm sure. I'd fire my marketing & promotions person if he/she told me that I'd make money by allowing hotlinking without any real text & banner advertising to go along with it.

lol, that's pretty much what I thought. I've always believed that the industry would do better if they limit the amount of free porn they give away. It's the one thing I noticed most coming from mainstream pages to adult pages. A lot of adult pages give way too much away.

When I started surfing for porn in the early 90's, lol, it was a pain in the ass to find good free porn and I bought a few memberships to avoid the annoyance of it...now there's so much free porn it kind of amazes me at times when people do buy memberships.

[Tommy]

I think we should work on one problem at a time

if asll webmasters protected their images 99% of these cock suckers would be fliping burgers

the first thing you should upload to a new domain is your htaccess file.
I keep mine on my desktop ready to go at a moments notice

_________________________________________

ErrorDocument 404 yourdomain.com/
ErrorDocument 403 yourdomain.com/

RewriteEngine on
RewriteOptions inherit

RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)*yourdomain.com [NC]
RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)*yourdomain.com [NC]
RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)*yourdomain.com [NC]
RewriteRule .*\.(asf|mpg|mpeg|wmv|avi|rm|gif|jpe|jpg)$ yourdomain.com/ [NC,R,L]

AddType text/x-server-parsed-html .html

[Cleo]

Tommy besides the fact that your htaccess uses wild cards which makes it very insecure Fusker type sites often do not provide any referral information.

[docholly]

This was our topic at OTB on Saturday.. MML is such a trend setter.. |mml|

[swedguy]

Fusker type sites often do not provide any referral information.
It has nothing to do with the site. A site can not turn off the Referer's, only the surfer can do that.

[cd34]

How about linkchecker software? Some TGP software doesn't send a referrer and would thus get a forbidden and possibly remove the gallery. I don't know about the software being used by freesite/linklist software.

I have a way to do it with a mod_perl filter that would be rather robust, wouldn't require cookies or anything -- wouldn't get involved in passing the file, it would purely insert itself in the handler to verify that it should accept or decline the link. I could write a DSO to do it, but, I would think that 99% of the people probably cannot insert modules into their apache config. Even mod_perl is iffy, but, it would be about the highest performance method I can think of. I can think of a method using PHP, but, since I cannot insert a php script into the request handler, mod_perl seems like the most portable and high performance option.

The problem is, no matter what method is used, there is either a simple reliance on some piece of data somewhere that can be easily circumvented. But, if we make it hard enough for enough people, combined with other efforts, it might make it worthwhile.

And regrettably, anyone using an edge cache won't be able to prevent hotlinking which might be why the big-boys allow hotlinking.

[raymor]

Tommy besides the fact that your htaccess uses wild cards which makes it very insecure Fusker type sites often do not provide any referral information.

Take another look at that regex.
There's nothing insecure about his wildcards,
which allow for subdomains. The regex is
correct in that it allows members.yourdomain.com
without allowing hacker.com/yourdomain.com.
If you can actually come up with any possible
insecurity related to that use of wildcards
please ket me know exactly what that would
be, as for the last 7 years noone has found one.

[Cleo]

In Tommy's example you can hotlink by putting the page in a directory called "yourdomain.com"

[cd34]

this one?

RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)*yourdomain.com [NC]

http://yourdomain.com.fusker.lewww.com/index.php?lid=123

[PR_Tom]

I'll mention this thread to the techs and see what they're stance on it is.

Good stuff.

[Tommy]

my stuff always shows up as broken images on all those fucker sites

I feel very safe

the only annoying thing is that the stats counts it as a reffer so my server stats are filled up with that junk

[swedguy]

RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)?yourdomain.com$
RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)?yourdomain.com/

That would make it safe.

#1 - http://www.yourdomain.com
#2 - http://www.yourdomain.com/**anything**

[Cleo]

This is what I've found that works.
RewriteCond %{HTTP_REFERER} !^http://www.yourdomain.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://yourdomain.com*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://yourdomain.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.yourdomain.com*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://yourdomain.com:80/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.yourdomain.com:80/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://yourdomain.com:80.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.yourdomain.com:80.*$ [NC]

[airdick]

Has anyone in analyzed their logs to check the % of non-referrer image requests to fuskered objects vs. non-fuskered images?

I suppose that if I see a real impact from fusker I could use the same software I use for protecting my wmv files to insure that only surfers that have hit some html on the my domain in the last X minutes can get at my images, but I haven't tried it yet for fear of causing problems for surfers, reviewers and tgp scripts that might be using multiple proxies. Are any gallery/freesite builders using the antithotlinking.com product to protect images as well as movies?

Regarding paysites that don't mind fusker traffic: I suspect that if sites can make money giving away watermarked images on Usenet that they can also make some money from watermarked images on fusker, although unlike Usenet the paysite would end up footing the bill for the bandwidth.

[cd34]

and would block requests from certain edge proxy servers (ask Cleo)

http://www.yourdomain.com:80/blah

RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)?yourdomain.com(\:[0-9]+)?/

I think.

[RawAlex]

You can also go through the process at a higher level and block off all access by people being refered by fusker and such, which is another powerful way to stop the most blatant site rippers. If you do get fuskered and your listing comes up as broken images on one of their sites, a surfer will click "images are broken" and your site will be removed.

Fusker appears to use XML or RSS to share a feed of all of the fuskered sites amoungst it's site system. Get yourself removed from one, and you will disappear from all of them in a short time.

All programs should look very closely at their servers and assure that they are secure. You know, 90% of the bank card phishing would be gone if the banks did a better job of protecting their sites and checking incoming referals.

Alex

[swedguy]

Sometimes IE doesn't want to add the trailing slash, so the referer will be http://yourdomain.com instead of http://yourdomain.com/

This one will take care of that and everything else....

RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)?yourdomain.com(:[0-9]+)?($|/)+ [NC]
RewriteCond %{HTTP_REFERER} !^http://1.2.3.4(:[0-9]+)?($|/)+
RewriteRule \.(jpg|gif)$ http://www.google.com/ [NC,R,L]

[raymor]

In Tommy's example you can hotlink by putting the page in a directory called "yourdomain.com"

No, you can't. Try it. It allows only that which matches
the regex, which says:
^http:// First, http://

([a-z0-9-]+\.)* then allow letters, numbers, and dots (but not slashes or anything else)

yourdomain.com then your domain name.

http://hacker.com/yourdomain.com would not match the
second atom of the regex, which allows only letters, numbers,
and dots, but not the slash that would have to come between
hacker.com and yoursite.com.

[swedguy]

Raymor, the one sparky posted will go through.

[raymor]

Raymor, the one sparky posted will go through.

Who is sparky? The one bad one I see is what Cleo posted,
which includes a bunch of meaningless BS that does nothing.
For example, look at thr last couple of atoms of this line:

RewriteCond %{HTTP_REFERER} !^http://yourdomain.com/.*$ [NC]

The last bit says "anything, then the end of the string".
Well that's pointless, if anything and everything is allowed
all the way to the end all that crap should be left off.
Also that ruleset is quite repetitive, making it terribly inefficient.
Instead the rules should be combined. For example, these two:
RewriteCond %{HTTP_REFERER} !^http://www.yourdomain.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://yourdomain.com/.*$ [NC]

One allows it with a "www" "subdomain", the other allow it without.
They should be combined into one rule that allows it with or without:
RewriteCond %{HTTP_REFERER} !^http://(www\.)+yourdomain.com/.*$ [NC]

As mentioned before, other subdomain besides www are also possible,
so rather than just "www." we allow letters, numbers, and dots:
RewriteCond %{HTTP_REFERER} !^http://([a-z0-9]\.)+yourdomain.com/.*$ [NC]

As mentioned above, the "allow anything at all after the domain name"
part is pointless, as it matches anywhere in the target string,
so we get rid of that:
RewriteCond %{HTTP_REFERER} !^http://([a-z0-9]\.)+yourdomain.com/ [NC]
The only thing left is that there may or may not be a slash,
and only if there is a slash can you have anything else.
This is to avoid allowing http://yourdomain.com.hacker.com
or:
http://yourdomain.comedyhack.com
"Allow only if" requires a bit that looks a little complex:
RewriteCond %{HTTP_REFERER} !^http://([a-z0-9]\.)+yourdomain.com(/.*)?$ [NC]

BTW, when deciding who to listen to on this stuff, whether to
follow the advice of someone who "found something" which "seems to work"
or of someone ellse who seems to actually know what this stuff means,
take a look at the Contributors file for mod_rewrite and see which
of the people posting in this thread helped write the part of Apache that we're dealing with.

[Cleo]

Sparky= cd34

I don't really understand much of this. I just know what has worked for me over the years through much trial and error.

I removed all wildcards from my stuff after getting hit by hotlinjers either using folders with my domain in them or subdomains.

I stated putting these 3 variations in after I found that it was blocking images sometimes when I didn't want it to.
RewriteCond %{HTTP_REFERER} !^http://www.yourdomain.com:80/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://yourdomain.com:80.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.yourdomain.com:80.*$ [NC]

As with anything much testing is always good.

[swedguy]

Raymor,

RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)*yourdomain.com [NC]

There's no trailing slash or checks if Referer is only http://yourdomain.com = you can make yourdomain.com to a sub-domain (http://yourdomain.com.fusker.com).

[raymor]

Sparky= cd34
I stated putting these 3 variations in after I found that it was blocking images sometimes when I didn't want it to.
RewriteCond %{HTTP_REFERER} !^http://www.yourdomain.com:80/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://yourdomain.com:80.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.yourdomain.com:80.*$ [NC]

I used to include the port number, the :80 in my suggested code
years ago. My business partner thought that it wasn't necesary,
so we logged several hundred thousand requests and didn't find
any with the port number, so I took it out. I would agree, though,
that in theory it should be allowed.

[Cleo]

Back in the nineties I did Mac computer consulting and while I was out using clients computers I would try surfing my stuff mostly on Macs but sometimes Windows machines. The port number got put in there after seeing my images blocked if I remember correctly by Macs behind proxy servers, same thing with the trailing slash.

[RawAlex]

remember also you can do http://www.fuskerdomain.com/yourdomain.com/linkonthispage.html and that will get through if you are not looking SPECIFICALLY for the whole http string.

As I said, you can also take steps to block all fusker access from their main sites. If they can't access you from their main sites, they are VERY likely to not list you or have your listing pulled very quickly.

Alex

[cd34]

Who is sparky?
me, but not by choice. |gabbo| renamed me and a general vote assigned the name. I'm in denial and protest.


Also that ruleset is quite repetitive, making it terribly inefficient.
Instead the rules should be combined. For example, these two:
RewriteCond %{HTTP_REFERER} !^http://www.yourdomain.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://yourdomain.com/.*$ [NC]


You might try benchmarking the regexp engine & the fallthrough matches sometime. You may be pleasantly surprised. I do agree with you regarding the trailing match, but, I disagree with your assessment that the regexp engine is a high performance solution that cannot be aided.

[raymor]

me, but not by choice. |gabbo| renamed me and a general vote assigned the name. I'm in denial and protest.



You might try benchmarking the regexp engine & the fallthrough matches sometime. You may be pleasantly surprised. I do agree with you regarding the trailing match, but, I disagree with your assessment that the regexp engine is a high performance solution that cannot be aided.

I do benchmark my code, including my work on mod_rewrite,
before releasing it publically. Perhaps you should benchmark it
before you presume to tell me how my own software works.
Indeed, simply parsing the extra line in the .htaccess uses more
cycles before it even compiles the regex and starts looking for a match.

The directives are read from .htaccess line by line, which means
that each character is checked to see if it's a newline.
It takes an extra 50 character comparisons just to read the line,
even before it's recognized as a condititon at all.
On the other hand the regex engine must make only 2 comparisons
to see whether the next character is a "w" or a "y".
Indeed once your extra regex is compiled it's on the order of 2,000 times slower.

[swedguy]

http://jakarta.apache.org/regexp/applet.html

A nice little tool if you want to test your regexps.

[Cleo]

|popcorn|
When coders disagree…
Seems that there are a lot of ways to do htaccess and the people that really understand this stuff don't even agree on what works best. Personally I'm just going to keep on doing it my way since it seems to work for me.

Back to fucking Fusker and site rippers…
So besides having hotlinking protection in place using whatever flavor of htaccess you feel best with what else can be done?
One Problem seems to be the no referral line that we have in our htaccess.

Site rippers are another big problem with paysite member's areas, at least it was with the one that I manage.
Besides putting in Strongbox what else can we do to block site rippers?

[cd34]

you are correct, your method is faster.

with 20 concurrent threads, 100k requests, no keepalives, .46 seconds faster and 3.4 tps faster.
oddly, at 20/10k/no keepalives, the margin tilts the opposite direction and is just as slim.

Although, I tested Apache2/mpm-prefork, not Apache1. When I benchmarked Apache1.3 last spring, there was a considerable difference edging towards having separate lines. However, with the config file in the virtual host rather than being read from .htaccess, and turning Override's off, it narrows down to .16 seconds faster and less than 1.1 tps faster. Granted this was just a seat-of-the-pants quick benchmark using ab, with all 5 tests run 5 times and the lowest score taken. Each used a referrer that required every rule to be evaluated.

So, current wisdom would suggest this:

Slightly corrected to remove two typos:

RewriteCond %{HTTP_REFERER} !^http://([a-z0-9]+\.)?yourdomain.com(/.*)?$ [NC]

this disallows RFC compliant hostnames that have a - in them, fixing the regexp to allow that makes it a bit more complex since the leading character cannot be a -, but, lets skip that for now and allow - anywhere in the hostname and allow for the port designation which some edge proxy servers like to insert. We might also consider allowing _ which was not in the original specs, but, Microsoft supported it, and it was later adopted. This rule also doesn't allow for the new International characters, but, if someone is using those, they can change the regexp.

RewriteCond %{HTTP_REFERER} !^http://([a-z0-9-]+\.)?yourdomain.com(:[0-9]+)?(/.*)?$ [NC]

This disallows subdomain.subdomain.yourdomain.com, which might be part of the + typo in the earlier post.

RewriteCond %{HTTP_REFERER} !^http://(([a-z0-9-]+\.)+)?yourdomain.com(:[0-9]+)?(/.*)?$ [NC]

So, Raymor, does the above rule seem sufficient for as many cases as possible?

Offhand, I can think of one really simple way to circumvent this -- Firefox pops a warning, but IE seems to have no problem with it.

I've run that rule against a regression test to make sure that it appears to behave exactly the way I would expect and intend it to work and short of the one possible regexp match which could be very easily implemented on fuskers side, it seems fairly complete.

Now, of course we're back to the age old problem of Google/Yahoo's hotlinking image search. By doing the rules this way, we are only allowing the listed domains to be able to hotlink. If the rule is sufficiently loose to allow google/yahoo, a slight url change on fusker's side will make all of this for naught.

[Torn Rose]

slide rulers at twenty paces? |couch|

[raymor]

So, Raymor, does the above rule seem sufficient for as many cases as possible?

Offhand, I can think of one really simple way to circumvent this -- Firefox pops a warning, but IE seems to have no problem with it.


One additional atom I included in my original 1999 regex
but I removed along with the port number was http(s)?
in case
some part of the site used SSL either presently or in the future.
That would cover an additional case, whether or not it's worth including
is another matter.
Additionally I unless you're running a web server on some port other
than port 80 you may want to just say 80 for the port number.
Makes it just a tad faster. Of course that analagous to my subdomain
part, where I chose to allow more than just www.
Another judgement call speed / versus flexibility.

I was thinking that we had taken care of user:pass@host URLs,
but I'm not seeing exactly how just at this moment.
Perhaps the tested browsers wouldn't allow blah.com/
in the authentication part, but treated it as a host/path when
it saw the forward slash (/).
Unless I'm missing something, we actually want to gobble up
anything up to and including @ before going any further:
RewriteCond %{HTTP_REFERER} !^http://(.*@)?([a-z0-9-]+\.)*yourdomain.com(:[0-9]+)?(/.*)?$ [NC]

(([a-z0-9-]+\.)+)? ? :) Maybe ([a-z0-9-]+\.)* ?

For those who don't catch the difference,
I had a typo where I said "optionally with a subdomain"
rather than "optionally with subdomains".
His fix for my typo was to say:
(([a-z0-9-]+\.)+)?
ergo "one or more subdomains, repeated one or zero times"
Simpler, we say "with or without subdomains":
([a-z0-9-]+\.)*

[raymor]

BTW, regarding the hyphen and the multiple subdomains guess
I should have pasted from my own old page from years ago and
I wouldn't have forgotten those:

http://216.239.63.104/search?q=cache:5T0MCW59SDcJ:www.webmastersguide.com/htaccess-cgi/htaccess.htm+webmastersguide+htaccess&hl=en

[RawAlex]

Okay, now that the geeks have had their moment in the sun (hope they don't burn), let's get back to the simple deal:

Program owners that run freehosted galleries: You need to lock up your content.

It's good business, and it is respectful of your affiliates.

Alex

[DangerDave]

if all webmasters protected their images 99% of these cock suckers would be fliping burgers
True IMO - There must/should be a united and concerted response to stoping these thieves.

I read on another board that programs don't necessarily mind fusker grabbing their pictures. Still people are seeing the watermark on these photos, still seeing the URL, maybe they might type in the url and the program would get some type in traffic.
Yet another unproven unsupported theory proposed by those that don't know or are too lazy to care..

I notified one prominent program that their stolen images were being used on a message board just 2 days ago.. and their response(ignorant and ill-informed resonse - IMO) was..

"As our URL's are on the images, and it does not appear to be an entire set, I am inclined to let it go on this instance."


In my mind this makes them part of the problem, and encourages the theft of their content. In fact it is essentially giving me(and others) implied permission to use their content without permission.


Stopping these thieves making money is the only answer.. and AVN/Adbrite hold the key to stopping them. Lack of action on their part will cost YOU money.

DD

[cd34]

So, with that, we have:

RewriteEngine on
# optionally allow empty referrers, remove to disallow empty referrers
RewriteCond %{HTTP_REFERER} !^$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.*@)?([a-z0-9-]+\.)*yourdomain.com(:[0-9]+)?(/.*)?$ [NC]
RewriteRule .*\.(asf|mpg|mpeg|wmv|avi|rm|gif|jpeg|jpg)$ - [NC,F,L]

That basic rule should work in 99% of the situations. I've regression tested it with all of the test-set that I created earlier. I'll run with this on some real world testing on some clients.

Thank you Raymor for helping us come up with a fairly well protected drop-in rule that we can perhaps slap in a faq somewhere for webmasters to somewhat protect themselves. I know the .wmv is somewhat useless, but, it will stop some of the siterippers that do send referrers.

Then maybe we can get the submission pages to link back to a FAQ page at greenguysboard.com and educate the freesite/tgp submitters a bit.

[Tommy]

can you lay that htaccess out like i did (the whole thing)
so us laymen only have to copy and paste

[frankthetank]

So, with that, we have:

RewriteEngine on
# optionally allow empty referrers, remove to disallow empty referrers
RewriteCond %{HTTP_REFERER} !^$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.*@)?([a-z0-9-]+\.)*yourdomain.com(:[0-9]+)?(/.*)?$ [NC]
RewriteRule .*\.(asf|mpg|mpeg|wmv|avi|rm|gif|jpeg|jpg)$ - [NC,F,L]

That basic rule should work in 99% of the situations. I've regression tested it with all of the test-set that I created earlier. I'll run with this on some real world testing on some clients.

Thank you Raymor for helping us come up with a fairly well protected drop-in rule that we can perhaps slap in a faq somewhere for webmasters to somewhat protect themselves. I know the .wmv is somewhat useless, but, it will stop some of the siterippers that do send referrers.

Then maybe we can get the submission pages to link back to a FAQ page at greenguysboard.com and educate the freesite/tgp submitters a bit.


I read the thread carefully and just looked at my stats. So I´m a victim of fusker, too. I tried out cd34 code and it works. My pics are gone from fusker and they can be seen from my domain.

Thank´s all of you... |thumb

[swedguy]

RewriteEngine on
# optionally allow empty referrers, remove to disallow empty referrers
RewriteCond %{HTTP_REFERER} !^$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.*@)?([a-z0-9-]+\.)*yourdomain.com(:[0-9]+)?(/.*)?$ [NC]
RewriteRule .*\.(asf|mpg|mpeg|wmv|avi|rm|gif|jpeg|jpg)$ - [NC,F,L]
It's looking good. I would add a line for the IP too.

RewriteCond %{HTTP_REFERER} !^http://(.*@)?1\.2\.3\.4(:[0-9]+)?(/.*)?$

or

RewriteCond %{HTTP_REFERER} !^http://(.*@)?(([a-z0-9-]+\.)*yourdomain.com|1\.2\.3\.4)(:[0-9]+)?(/.*)?$ [NC]

I just ran a quick test and the latter is slightly faster, but a lot more messy if people should just copy/paste it and replace domain and IP in it.

[Ms Naughty]

OK I'm like Tommy, I really don't understand the code of htaccess...
And I've got a growing collection of different htaccess files saved but now I'm not sure which is the best one to use.

I also found this in my collection, labelled: "Htaccess for site strippers"
So I thought I'd throw it in to further confuse the situation LOL

RewriteCond %{HTTP_USER_AGENT} ^.*WebZIP.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Iria.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Stripper.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Offline.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Copier.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Crawler.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Snagger.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Teleport.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Reaper.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Wget.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Grabber.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Sucker.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Downloader.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Siphon.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Collector.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Mag-Net.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Widow.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Pockey.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*DA.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Snake.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*BackWeb.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*gotit.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Vacuum.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*SmartDownload.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Pump.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*HMView.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Ninja.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*HTTrack.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*JOC.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*likse.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Memo.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*pcBrowser.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*SuperBot.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*leech.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Mirror.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Recorder.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*GrabNet.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Likse.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Navroad.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*attach.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Magnet.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Surfbot.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Bandit.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Ants.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Buddy.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Whacker.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*DISCo\Pump.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Drip.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*EirGrabber.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*ExtractorPro.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*EyeNetIE.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*FlashGet.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*GetRight.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Gets.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Go!Zilla.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Go-Ahead-Got-It.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Grafula.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*IBrowse.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*InterGET.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Internet\Ninja.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*JetCar.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*JustView.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*MIDown\tool.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Mister\PiX.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*NearSite.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*NetSpider.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Offline\Explorer.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*PageGrabber.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Papa\Foto.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Pockey.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*ReGet.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Slurp.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*SpaceBison.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*SuperHTTP.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Teleport.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*WebAuto.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*WebCopier.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*WebFetch.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*WebReaper.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*WebSauger.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*WebStripper.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*WebWhacker.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*WebZIP.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Web\Image\Collector.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Web\Sucker.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Webster.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Wget.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*eCatch.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*ia_archiver.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*lftp.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*tAkeOut.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^.*FileHound.*$

[Chop Smith]

Is someone going to put all of this together for us Htaccess code challenged folks?

[amber438]

RewriteCond %{HTTP_REFERER} !^$ [NC]


This line..for some reason I removed it from my htaccess files. I can not remember why. What does it do?

I share phpadsnew with all my domain ergo I have to list them all to get the ads to show.
I've also added what grandma scrotum has listed so my htaccess is a mile long..
so..how can we shorten it alos getting the most protection possible?

[cd34]

This rule allows empty referrers:

RewriteCond %{HTTP_REFERER} !^$ [NC]

GrandmaScrotum, phew, that ruleset has been floating around the net for a long time, and, its got many common errors. First, there is a space missing before the P, so, it would never match this. The non-anchored match at the front and the floating match to end of string aren't needed either.

RewriteCond %{HTTP_USER_AGENT} ^.*DISCo\Pump.*$ [OR]

Would be better as:

RewriteCond %{HTTP_USER_AGENT} ^DISCo\ Pump [OR]

and I sort of changed these by putting:

RewriteCond %{HTTP_USER_AGENT} ^Mozilla
RewriteRule /* - [L]

In front of your list of rules.

However, I really question whether those rules really do much anymore, since many surfers pretend to be Mozilla anyway.

But, if you were going to do it:

RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} ^Mozilla
RewriteRule /* - [L]

RewriteCond %{HTTP_USER_AGENT} ^Teleport [OR]
RewriteCond %{HTTP_USER_AGENT} ^Internet\ Ninja [OR]
RewriteCond %{HTTP_USER_AGENT} ^Aculinx [OR]
RewriteCond %{HTTP_USER_AGENT} ^Ants [OR]
RewriteCond %{HTTP_USER_AGENT} ^attach [OR]
RewriteCond %{HTTP_USER_AGENT} ^Backstreet [OR]
RewriteCond %{HTTP_USER_AGENT} ^BackWeb [OR]
RewriteCond %{HTTP_USER_AGENT} ^Bandit [OR]
RewriteCond %{HTTP_USER_AGENT} ^Buddy [OR]
RewriteCond %{HTTP_USER_AGENT} ^Burner [OR]
RewriteCond %{HTTP_USER_AGENT} ^Caitoo [OR]
RewriteCond %{HTTP_USER_AGENT} ^Collector [OR]
RewriteCond %{HTTP_USER_AGENT} ^Commander [OR]
RewriteCond %{HTTP_USER_AGENT} ^Copier [OR]
RewriteCond %{HTTP_USER_AGENT} ^Crawler [OR]
RewriteCond %{HTTP_USER_AGENT} ^Curl [OR]
RewriteCond %{HTTP_USER_AGENT} ^DA [OR]
RewriteCond %{HTTP_USER_AGENT} ^Devil [OR]
RewriteCond %{HTTP_USER_AGENT} ^DISCo\ Pump [OR]
RewriteCond %{HTTP_USER_AGENT} ^Down2Web [OR]
RewriteCond %{HTTP_USER_AGENT} ^Downloader [OR]
RewriteCond %{HTTP_USER_AGENT} ^DownloadIt [OR]
RewriteCond %{HTTP_USER_AGENT} ^Drip [OR]
RewriteCond %{HTTP_USER_AGENT} ^Eater [OR]
RewriteCond %{HTTP_USER_AGENT} ^eCatch [OR]
RewriteCond %{HTTP_USER_AGENT} ^Eclipt [OR]
RewriteCond %{HTTP_USER_AGENT} ^EirGrabber [OR]
RewriteCond %{HTTP_USER_AGENT} ^Enterprise [OR]
RewriteCond %{HTTP_USER_AGENT} ^Express [OR]
RewriteCond %{HTTP_USER_AGENT} ^Extractor [OR]
RewriteCond %{HTTP_USER_AGENT} ^EyeNetIE [OR]
RewriteCond %{HTTP_USER_AGENT} ^FairAd\ Client [OR]
RewriteCond %{HTTP_USER_AGENT} ^FileHound [OR]
RewriteCond %{HTTP_USER_AGENT} ^FlashGet [OR]
RewriteCond %{HTTP_USER_AGENT} ^FlashSite [OR]
RewriteCond %{HTTP_USER_AGENT} ^FlipBrowser [OR]
RewriteCond %{HTTP_USER_AGENT} ^Get [OR]
RewriteCond %{HTTP_USER_AGENT} ^Go-Ahead-Got-It [OR]
RewriteCond %{HTTP_USER_AGENT} ^gotit [OR]
RewriteCond %{HTTP_USER_AGENT} ^Go!Zilla [OR]
RewriteCond %{HTTP_USER_AGENT} ^Grabber [OR]
RewriteCond %{HTTP_USER_AGENT} ^Grab [OR]
RewriteCond %{HTTP_USER_AGENT} ^Grafula [OR]
RewriteCond %{HTTP_USER_AGENT} ^Greed [OR]
RewriteCond %{HTTP_USER_AGENT} ^HMView [OR]
RewriteCond %{HTTP_USER_AGENT} ^Hoover [OR]
RewriteCond %{HTTP_USER_AGENT} ^HtGet [OR]
RewriteCond %{HTTP_USER_AGENT} ^HTTrack [OR]
RewriteCond %{HTTP_USER_AGENT} ^IBrowse [OR]
RewriteCond %{HTTP_USER_AGENT} ^iFox98 [OR]
RewriteCond %{HTTP_USER_AGENT} ^IGJpg$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^InterGET [OR]
RewriteCond %{HTTP_USER_AGENT} ^InternetLinkAgent [OR]
RewriteCond %{HTTP_USER_AGENT} ^IPhoto [OR]
RewriteCond %{HTTP_USER_AGENT} ^iwantmy [OR]
RewriteCond %{HTTP_USER_AGENT} ^JetCar [OR]
RewriteCond %{HTTP_USER_AGENT} ^JOC [OR]
RewriteCond %{HTTP_USER_AGENT} ^JustView [OR]
RewriteCond %{HTTP_USER_AGENT} ^Keepoint [OR]
RewriteCond %{HTTP_USER_AGENT} ^leech [OR]
RewriteCond %{HTTP_USER_AGENT} ^lftp [OR]
RewriteCond %{HTTP_USER_AGENT} ^likse [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^Magnet [OR]
RewriteCond %{HTTP_USER_AGENT} ^Mag-Net [OR]
RewriteCond %{HTTP_USER_AGENT} ^Mass\ Downloader [OR]
RewriteCond %{HTTP_USER_AGENT} ^Memo [OR]
RewriteCond %{HTTP_USER_AGENT} ^MemoWeb [OR]
RewriteCond %{HTTP_USER_AGENT} ^MIDown\ tool [OR]
RewriteCond %{HTTP_USER_AGENT} ^Mirror [OR]
RewriteCond %{HTTP_USER_AGENT} ^Mister\ PiX [OR]
RewriteCond %{HTTP_USER_AGENT} ^MSProxy [OR]
RewriteCond %{HTTP_USER_AGENT} ^Navroad [OR]
RewriteCond %{HTTP_USER_AGENT} ^NearSite [OR]
RewriteCond %{HTTP_USER_AGENT} ^NetAnts [OR]
RewriteCond %{HTTP_USER_AGENT} ^NetDrag [OR]
RewriteCond %{HTTP_USER_AGENT} ^NetSpider [OR]
RewriteCond %{HTTP_USER_AGENT} ^Offline [OR]
RewriteCond %{HTTP_USER_AGENT} ^PageGrabber [OR]
RewriteCond %{HTTP_USER_AGENT} ^Papa\ Foto [OR]
RewriteCond %{HTTP_USER_AGENT} ^pcBrowser [OR]
RewriteCond %{HTTP_USER_AGENT} ^PerManSurfer [OR]
RewriteCond %{HTTP_USER_AGENT} ^PlantyNet_WebRo [OR]
RewriteCond %{HTTP_USER_AGENT} ^Pockey [OR]
RewriteCond %{HTTP_USER_AGENT} ^Pump [OR]
RewriteCond %{HTTP_USER_AGENT} ^Reaper [OR]
RewriteCond %{HTTP_USER_AGENT} ^Recorder [OR]
RewriteCond %{HTTP_USER_AGENT} ^ReGet [OR]
RewriteCond %{HTTP_USER_AGENT} ^Retriever [OR]
RewriteCond %{HTTP_USER_AGENT} ^SilentSurf [OR]
RewriteCond %{HTTP_USER_AGENT} ^Siphon [OR]
RewriteCond %{HTTP_USER_AGENT} ^Snagger [OR]
RewriteCond %{HTTP_USER_AGENT} ^Snake [OR]
RewriteCond %{HTTP_USER_AGENT} ^Snarf [OR]
RewriteCond %{HTTP_USER_AGENT} ^Snatcher [OR]
RewriteCond %{HTTP_USER_AGENT} ^SpaceBison [OR]
RewriteCond %{HTTP_USER_AGENT} ^Stripper [OR]
RewriteCond %{HTTP_USER_AGENT} ^Sucker [OR]
RewriteCond %{HTTP_USER_AGENT} ^SuperBot [OR]
RewriteCond %{HTTP_USER_AGENT} ^SuperHTTP [OR]
RewriteCond %{HTTP_USER_AGENT} ^Surfbot [OR]
RewriteCond %{HTTP_USER_AGENT} ^tAkeOut [OR]
RewriteCond %{HTTP_USER_AGENT} ^Vacuum [OR]
RewriteCond %{HTTP_USER_AGENT} ^Vampire [OR]
RewriteCond %{HTTP_USER_AGENT} ^wantmy [OR]
RewriteCond %{HTTP_USER_AGENT} ^Weazel [OR]
RewriteCond %{HTTP_USER_AGENT} ^Web [OR]
RewriteCond %{HTTP_USER_AGENT} ^WFARC [OR]
RewriteCond %{HTTP_USER_AGENT} ^Wget [OR]
RewriteCond %{HTTP_USER_AGENT} ^Whacker [OR]
RewriteCond %{HTTP_USER_AGENT} ^Widow [OR]
RewriteCond %{HTTP_USER_AGENT} ^WWWCopy [OR]
RewriteCond %{HTTP_USER_AGENT} ^WWWoffle
# whatever rule you want here.... block every request with the following rule
RewriteRule .* - [F]

[Ms Naughty]

By the way, if that huge "site stripper" htaccess is flawed, please feel free to point that out. As I said, I have no real idea what I'm doing here and I just copied that list from somewhere.
Edit: Woops, looks like I should refresh before I post LOL. Thanks for the info :D

[cd34]

slight leak in the rule, adjusted with yourdomain\.com (thanks Swedguy)

RewriteEngine on
# leave this line in allow empty referrers, remove to disallow empty referrers
RewriteCond %{HTTP_REFERER} !^$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.*@)?([a-z0-9-]+\.)*yourdomain\.com(:[0-9]+)?(/.*)?$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.*@)?1\.2\.3\.4(:[0-9]+)?(/.*)?$
RewriteRule .*\.(asf|mpg|mpeg|wmv|avi|rm|gif|jpeg|jpg|zip)$ - [NC,F,L]

In the last hour, its caught 14683 hotlink requests on one client's machine. Mostly fusker/usefulidiot, but, a few others that were surprising. hotmail, msngroups, a bunch of blogs, a few forums. Overall, it seems to be doing well -- negligable impact on the traffic on the machine though.

[Altheon]

I just tried to fusker my site and it failed so I know this code works:


Options +FollowSymlinks
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain.com(/)?.*$ [NC]
RewriteRule .*\.(gif|jpg|jpeg|bmp|fla|mov|avi|wmv)$ - [F,NC]


If you all see a problem with it please let me know.

Additionally if you want to protect your directory structure from being viewed pop this little bit of code in there:


Options -Indexes


Then you will not have to put an index.html in each directory.

-A

[Wenchy]

Okay, so can someone answer a couple of questions for me, please?

First, I'm working under the assumption that this code...

RewriteEngine on
# leave this line in allow empty referrers, remove to disallow empty referrers
RewriteCond %{HTTP_REFERER} !^$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.*@)?([a-z0-9-]+\.)*yourdomain\.com(:[0-9]+)?(/.*)?$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.*@)?1\.2\.3\.4(:[0-9]+)?(/.*)?$
RewriteRule .*\.(asf|mpg|mpeg|wmv|avi|rm|gif|jpeg|jpg|zip)$ - [NC,F,L]

...is the recommended .htaccess for anti-fuskering my domains? I can/should repeat this line...

RewriteCond %{HTTP_REFERER} !^http://(.*@)?([a-z0-9-]+\.)*yourdomain\.com(:[0-9]+)?(/.*)?$ [NC]

... for each of my domains that I want included.

Second, the code that grandmascrotum put up there a couple of posts... I heard somewhere that that huge string can actually put a load on your server each time a page, any page, is loaded. Any truth to that rumor? And, assuming the rumor is false, is there any clear evidence that using that "collection" in my .htaccess actually does any good these days?

Thanks |thumb

[RawAlex]

Wenchy, I wouldn't put the long list except possibly inside a member's area, or an area that has high quantities of content, or possibly on key personal link areas (where many of your own sites are listed). Otherwise it's a ton of work for very little return, IMHO.

As for the "blocking fusker", the code you listed blocks ALL attempts to reach your images by a third party. If you want to allow things like google or yahoo to index your images, you need to let them in.

The alternate route is to specifically block all access from certain domains. You can do this on a more global level (either at the root level of your webserver, or in the webserver config). This could become a long list, so it really is up to you how you decide to handle it.

Either way, making your sites unfriendly to Fusker is an important move.

Alex
Alex

[Wenchy]

Thanks, Alex; sounds like excellent advice.

I'd prefer to allow google, yahoo, etc., and logic dictates I do that by using...

RewriteCond %{HTTP_REFERER} !^http://(.*@)?([a-z0-9-]+\.)*yourdomain\.com(:[0-9]+)?(/.*)?$ [NC]

... and replacing "yourdomain" with the appropriate SE domain.

Back in the day I was the victim of a hotlinker (japanese, I think) and it cost me a fortune in BW. I'm on a mad quest to prevent a repeat of those events whenever and by what ever means possible. I prefer to only have my nightmares when I'm sleeping |shocking|

Appreciate the assistance! |cool|

[raymor]

That long anti-ripper .htaccess is bad/wrong
in at least a couple ways. All of those rules will
impact performance. Even with all of those rules,
though, it's not nearly complete, so it won't block
more than half of the rippers.
The first rule of security is to disallow everything
that isn't specifically allowed.
That .htaccess violates that rule, leading to
the two problems I mentioned.
Rather, it would be better to list the 3 or 4 user agents
that are allowed and disallow everything else.
You'd allow IE, the Gecko browsers (Mozilla, Firefox and Safari are all Gecko and
thus would probably use just one rule),
Opera and perhaps you'd come up with a couple more.
Anything besides IE, Firefox, Safari, Mozilla, and Opera would be redirected.
Of course you may wish to also allow the main SE spiders.

This also has the inherent flaw that you're
assuming one thing based on another thing,
and in fact based on what the user tells you.
The major rippers will let the user set the User-agent
however they want, so just because it
SAYS it's IE doesn't mean that it is.
In fact several rippers are IE based and will therefore report as IE.
On the other hand some people using IE, Mozilla, or Firefox set their user-agent
to something else, such as "None of Your Business Version 0".
But in fact it's not the software name that you're
concerned with, it's a particular BEHAVIOR of the software.
So why not blocked based on that behavior?
That's what Strongbox does. Strongbox blocks
anyone who goes ripping your site, blindly following every single link.
On the other hand it does not block any browser where
the user actually clicks on the links.
THAT is what you really want to block, so that's
what Strongbox looks at, rather than the reported
name of the software.

[airdick]

As for the "blocking fusker", the code you listed blocks ALL attempts to reach your images by a third party. If you want to allow things like google or yahoo to index your images, you need to let them in.


Alex

I have always denied hotlinking and never added any special rules to allow google or yahoo, but I have images that are indexed in images.google.com and images.yahoo.com. My thumbnails that appear on those sites are not hotlinked -they are hosted on google & yahoo's servers and each thumb links to the page that that it was taken from, much like a thumbnail tgp.

[kalle7]

Just checked and found some of my stuff in fusker. Updated htaccess file uploaded and no more fusker! Nice |thumb

[frankthetank]

That´s what you get when you "fusker" the url "fusker.leww.com":

That URL has been banned for illegal content, on the owners request, or because it is a members only page!

maybe the guy now has realized that he is a thief... :D :D :D

[jmf000]

I just wonder would the condition
RewriteCond %{HTTP_REFERER} !^http://([-a-z0-9A-Z]+\.)*yourdomain\.com(/|$|:[0-9])
work faster than
RewriteCond %{HTTP_REFERER} !^http://(([a-z0-9-]+\.)+)?yourdomain.com(:[0-9]+)?(/.*)?$ [NC]
since it is unlikely subdomains contain uppercases.
I hope it will provide adequate security.
And by the way as I recall Domains are case sensitive (potentially).


And one more clue : I would not place .htaccess with such antihotlinking technics in the root of domain. Instead I would place it in the subdirectory(ies) under which "real heavy" content resides. So leachers still could see your hosted banners linked to sponsors but not actual images/video.

Thanks for your time.

[Verbal]

Rather, it would be better to list the 3 or 4 user agents that are allowed and disallow everything else.


This is some sound advice right here, instead of maintaining a huge blocked list. |thumb

[jmf000]

IMHO it is not important to pay attention to user agents at all.
1)Absolutely everyone who uses "teleporting" soft is able and does impersonate their kind of "browser" as "IE" or alike.
2)Surfers from leeching sources are using usual browser soft like IE or Opera and sequently not differ in this way from others.
3)Many new SEs started today, so you either have to include them all in your allowed browsers list or will loose their traffic.
4)Either black list or allowable list is larger is a kind of question.
I think it is waste of time to pay attention on user browser. Though you can exclude "TELEPORT" and very few other "defaults".

Thanks.