forked from mariusv/nginx-badbot-blocker
-
Notifications
You must be signed in to change notification settings - Fork 0
/
blacklist.conf
132 lines (126 loc) · 20.3 KB
/
blacklist.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
### This file implements a blacklist for certain user agents and
### referrers. It's a first line of defense. It must be included
### inside an http block.
###
### Author: mariusv
###
### Contributors: mitchellkrogza https://github.com/mitchellkrogza/nginx-badbot-blocker
###
### Last Updated: 2017-01-11
###
### Bad URL Referer lists extracted from:
### https://perishablepress.com/blacklist/ultimate-referrer-blacklist.txt
###
### Tested on: version: nginx/1.10.0 (Ubuntu)
###
### Modifications: - Added to bad_bot list
###
### - Added to bad_referer list (excuse the nasty words)
###
### - Added bad_urls1 bad_urls2 bad_urls3 and bad_urls4
### (Broken up into 4 sections for ease of maintenance)
###
### - Added validate_client (allowing all except Cyveillance IP's)
### (originally from https://github.com/oohnoitz/nginx-blacklist)
###
### I have this set up on my server as /etc/nginx/conf.d/blacklist.conf
### This is loaded and available for any vhost to use in its config
###
### Need I say, please don't just copy and paste this without reviewing what bots and
### referers are being blocked, you may want to exclude certain of them
### Also make SURE to whitelist your own IP's in the geo $bad_referer section.
###
### Note that: 0 = allow 1 = deny
###
### To enable it in a host file the following will go in the server block
### You can use all or just pick the one's you want on a host configuration
### You may also want to {return 444;} which is an Nginx feature that drops the
### connection immediately without even sending headers.
###
### # Block Bad Bots
### # Send 403 Forbidden or 444 Drop Connection
### if ($bad_bot) { return 444; }
### # Block Bad Referers
### # Send 403 Forbidden or 444 Drop Connection
### if ($bad_referer) { return 403; }
### if ($bad_urls1) { return 403; }
### if ($bad_urls2) { return 403; }
### if ($bad_urls3) { return 403; }
### if ($bad_urls4) { return 403; }
### if ($bad_urls5) { return 403; }
### if ($bad_urls6) { return 403; }
### # Block Snoopers
### # Send 444 Connection Closed Without Response
### if ($validate_client) { return 444;}
###
### NOTE: You need to change the hash max values or add them if they are not specified in your nginx.conf file
### This is because the defaults are too small and loading a big file like this into Nginx can cause errors
### Add the following into your nginx.conf file
### server_names_hash_bucket_size 64;
### server_names_hash_max_size 4096;
###
### Make sure to "sudo nginx -t" to check the config
map $http_user_agent $bad_bot {
default 0;
~*^Lynx 0; # Let Lynx go through
libwww-perl 1;
~*(?i)(80legs|360Spider|Aboundex|Abonti|Acunetix|^AIBOT|^Alexibot|Alligator|AllSubmitter|Apexoo|^asterias|^attach|^BackDoorBot|^BackStreet|^BackWeb|Badass|Bandit|Baid|Baiduspider|^BatchFTP|^Bigfoot|^Black.Hole|^BlackWidow|BlackWidow|^BlowFish|Blow|^BotALot|Buddy|^BuiltBotTough|^Bullseye|^BunnySlippers|BBBike|^Cegbfeieh|^CheeseBot|^CherryPicker|^ChinaClaw|^Cogentbot|CPython|Collector|cognitiveseo|Copier|^CopyRightCheck|^cosmos|^Crescent|CSHttp|^Custo|^Demon|^Devil|^DISCo|^DIIbot|discobot|^DittoSpyder|Download.Demon|Download.Devil|Download.Wonder|^dragonfly|^Drip|^eCatch|^EasyDL|^ebingbong|^EirGrabber|^EmailCollector|^EmailSiphon|^EmailWolf|^EroCrawler|^Exabot|^Express|Extractor|^EyeNetIE|FHscan|^FHscan|^flunky|^Foobot|^FrontPage|GalaxyBot|^gotit|Grabber|^GrabNet|^Grafula|^Harvest|^HEADMasterSEO|^hloader|^HMView|^HTTrack|httrack|HTTrack|htmlparser|^humanlinks|^IlseBot|Image.Stripper|Image.Sucker|imagefetch|^InfoNaviRobot|^InfoTekies|^Intelliseek|^InterGET|^Iria|^Jakarta|^JennyBot|^JetCar|JikeSpider|^JOC|^JustView|^Jyxobot|^Kenjin.Spider|^Keyword.Density|libwww|^larbin|LeechFTP|LeechGet|^LexiBot|^lftp|^libWeb|^likse|^LinkextractorPro|^LinkScan|^LNSpiderguy|^LinkWalker|msnbot|MSIECrawler|MJ12bot|MegaIndex|^Magnet|^Mag-Net|^MarkWatch|Mass.Downloader|masscan|^Mata.Hari|^Memo|^MIIxpc|^NAMEPROTECT|^Navroad|^NearSite|^NetAnts|^Netcraft|^NetMechanic|^NetSpider|^NetZIP|^NextGenSearchBot|^NICErsPRO|^niki-bot|^NimbleCrawler|^Nimbostratus-Bot|^Ninja|^Nmap|nmap|^NPbot|Offline.Explorer|Offline.Navigator|OpenLinkProfiler|^Octopus|^Openfind|^OutfoxBot|Pixray|probethenet|proximic|^PageGrabber|^pavuk|^pcBrowser|^Pockey|^ProPowerBot|^ProWebWalker|^psbot|^Pump|python-requests|^QueryN.Metasearch|^RealDownload|Reaper|^Reaper|^Ripper|Ripper|Recorder|^ReGet|^RepoMonkey|^RMA|scanbot|SEOkicks-Robot|seoscanners|^Stripper|^Sucker|Siphon|Siteimprove|^SiteSnagger|SiteSucker|^SlySearch|^SmartDownload|^Snake|^Snapbot|^Snoopy|Sosospider|^sogou|spbot|^SpaceBison|^spanner|^SpankBot|Spinn4r|^Sqworm|Sqworm|Stripper|Sucker|^SuperBot|SuperHTTP|^SuperHTTP|^Surfbot|^suzuran|^Szukacz|^tAkeOut|^Teleport|^Telesoft|^TurnitinBot|^The.Intraformant|^TheNomad|^TightTwatBot|^Titan|^True_Robot|^turingos|^TurnitinBot|^URLy.Warning|^Vacuum|^VCI|VidibleScraper|^VoidEYE|^WebAuto|^WebBandit|^WebCopier|^WebEnhancer|^WebFetch|^Web.Image.Collector|^WebLeacher|^WebmasterWorldForumBot|WebPix|^WebReaper|^WebSauger|Website.eXtractor|^Webster|WebShag|^WebStripper|WebSucker|^WebWhacker|^WebZIP|Whack|Whacker|^Widow|Widow|WinHTTrack|^WISENutbot|WWWOFFLE|^WWWOFFLE|^WWW-Collector-E|^Xaldon|^Xenu|^Zade|^Zeus|ZmEu|^Zyborg|SemrushBot|^WebFuck|^MJ12bot|^majestic12|^WallpapersHD) 1;
}
## Add here all referrers that are to blocked.
map $http_referer $bad_referer {
default 0;
~(?i)(adcash|advair|allegra|ambien|amoxicillin|adult|anal|asshole|babes|baccarat|betting|bithack|blackjack|cash|casino|celeb|cheap|cialis|craps|credit|click|cunt|deal|debt|drug|diamond|effexor|equity|faxo|finance|fisting|forsale|gambling|gaysex|girl|hardcore|hold-em|holdem|iconsurf|ilovevitaly|insurance|interest|internetsupervision|jewelry|keno|levitra|lipitor|loan|loans|love|makemoneyonline|make-money-online|meds|money|mortgage|myftpupload|nudit|omaha|organic|paxil|pharmacy|pharmacies|phentermine|pheromone|pills|piss|poker|porn|poweroversoftware|refinance|replica|rimming|roulette|screentoolkit|seoexperimenty|sex|snuff|scout|seventwentyfour|slot|slots|syntryx|teen|texas|t0phackteam|tournament|tramadol|tramidol|valtrex|vvakhrin-ws1|viagra|vicodin|webcam|xanax|xnxx|xxxrus|zanax|zippo|zoloft) 1;
}
## Add here all bad referer domains to be blocked - broken up into sections
## Alphabetical A - E (incl numbers)
map $http_referer $bad_urls1 {
default 0;
~(?i)(^http:https://(www\.)?38ha(-|.).*$|^http:https://(www\.)?4free(-|.).*$|^http:https://(www\.)?4hs8(-|.).*$|^http:https://(www\.)?4t(-|.).*$|^http:https://(www\.)?4u(-|.).*$|^http:https://(www\.)?6q(-|.).*$|^http:https://(www\.)?7makemoneyonline(-|.).*$|^http:https://(www\.)?8gold(-|.).*$|^http:https://(www\.)?911(-|.).*$|^http:https://(www\.)?adcash(-|.).*$|^http:https://(www\.)?.*(-|.)?adult(-|.).*$|^http:https://(www\.)?.*(-|.)?acunetix-referrer(-|.).*$|^http:https://(www\.)?abalone(-|.).*$|^http:https://(www\.)?adminshop(-|.).*$|^http:https://(www\.)?adultactioncam(-|.).*$|^http:https://(www\.)?aizzo(-|.).*$|^http:https://(www\.)?alphacarolinas(-|.).*$|^http:https://(www\.)?amateur(-|.).*$|^http:https://(www\.)?amateurxpass(-|.).*$|^http:https://(www\.)?.*(-|.)?anal(-|.).*$|^http:https://(www\.)?ansar-u-deen(-|.).*$|^http:https://(www\.)?atelebanon(-|.).*$|^http:https://(www\.)?beastiality(-|.).*$|^http:https://(www\.)?bestiality(-|.).*$|^http:https://(www\.)?belize(-|.).*$|^http:https://(www\.)?best-deals(-|.).*$|^http:https://(www\.)?bithack(-|.).*$|^http:https://(www\.)?blogincome(-|.).*$|^http:https://(www\.)?bontril(-|.).*$|^http:https://(www\.)?bruce-holdeman(-|.).*$|^http:https://(www\.)?.*(-|.)?blow.?job(-|.).*$|^http:https://(www\.)?buttons-for-website(-|.).*$|^http:https://(www\.)?ca-america(-|.).*$|^http:https://(www\.)?chatt-net(-|.).*$|^http:https://(www\.)?cenokos(-|.).*$|^http:https://(www\.)?cenoval(-|.).*$|^http:https://(www\.)?cityadspix(-|.).*$|^http:https://(www\.)?commerce(-|.).*$|^http:https://(www\.)?condo(-|.).*$|^http:https://(www\.)?conjuratia(-|.).*$|^http:https://(www\.)?consolidate(-|.).*$|^http:https://(www\.)?coswap(-|.).*$|^http:https://(www\.)?crescentarian(-|.).*$|^http:https://(www\.)?crepesuzette(-|.).*$|^http:https://(www\.)?darodar(-|.).*$|^http:https://(www\.)?dating(-|.).*$|^http:https://(www\.)?devaddict(-|.).*$|^http:https://(www\.)?discount(-|.).*$|^http:https://(www\.)?doobu(-|.).*$|^http:https://(www\.)?domainsatcost(-|.).*$|^http:https://(www\.)?econom.co(-|.).*$|^http:https://(www\.)?edakgfvwql(-|.).*$|^http:https://(www\.)?.*(-|.)?sex(-|.).*$|^http:https://(www\.)?e-site(-|.).*$|^http:https://(www\.)?egygift(-|.).*$|^http:https://(www\.)?empathica(-|.).*$|^http:https://(www\.)?empirepoker(-|.).*$|^http:https://(www\.)?e-poker-2005(-|.).*$|^http:https://(www\.)?escal8(-|.).*$|^http:https://(www\.)?eurip(-|.).*$|^http:https://(www\.)?exitq(-|.).*$|^http:https://(www\.)?eyemagination(-|.).*$) 1;
}
## F - I
map $http_referer $bad_urls2 {
default 0;
~(?i)(^http:https://(www\.)?fastcrawl(-|.).*$|^http:https://(www\.)?fearcrow(-|.).*$|^http:https://(www\.)?ferretsoft(-|.).*$|^http:https://(www\.)?fick(-|.).*$|^http:https://(www\.)?finance(-|.).*$|^http:https://(www\.)?flafeber(-|.).*$|^http:https://(www\.)?fidelityfunding(-|.).*$|^http:https://(www\.)?freakycheats(-|.).*$|^http:https://(www\.)?freeality(-|.).*$|^http:https://(www\.)?fuck(-|.).*$|^http:https://(www\.)?future-2000(-|.).*$|^http:https://(www\.)?.*(-|.)?gay(-|.).*$|^http:https://(www\.)?gobongo.info(-|.).*$|^http:https://(www\.)?gabriola(-|.).*$|^http:https://(www\.)?gallerylisting(-|.).*$|^http:https://(www\.)?gb.com(-|.).*$|^http:https://(www\.)?ghostvisitor(-|.).*$|^http:https://(www\.)?globusy(-|.).*$|^http:https://(www\.)?golf-e-course(-|.).*$|^http:https://(www\.)?gospelcom(-|.).*$|^http:https://(www\.)?gradfinder(-|.).*$|^http:https://(www\.)?hasfun(-|.).*$|^http:https://(www\.)?herbal(-|.).*$|^http:https://(www\.)?hermosa(-|.).*$|^http:https://(www\.)?highprofitclub(-|.).*$|^http:https://(www\.)?hilton(-|.).*$|^http:https://(www\.)?teaminspection(-|.).*$|^http:https://(www\.)?hotel(-|.).*$|^http:https://(www\.)?houseofseven(-|.).*$|^http:https://(www\.)?hurricane(-|.).*$|^http:https://(www\.)?.*(-|.)?incest(-|.).*$|^http:https://(www\.)?iaea(-|.).*$|^http:https://(www\.)?ilovevitality(-|.).*$|^http:https://(www\.)?ime(-|.).*$|^http:https://(www\.)?info(-|.).*$|^http:https://(www\.)?ingyensms(-|.).*$|^http:https://(www\.)?inkjet-toner(-|.).*$|^http:https://(www\.)?isacommie(-|.).*$|^http:https://(www\.)?istarthere(-|.).*$|^http:https://(www\.)?it.tt(-|.).*$|^http:https://(www\.)?italiancharms(-|.).*$|^http:https://(www\.)?iwantu(-|.).*$|^http:https://(www\.)?ilovevitality(-|.).*$|^http:https://(www\.)?iskalko.ru(-|.).*$) 1;
}
## J - P
map $http_referer $bad_urls3 {
default 0;
~(?i)(^http:https://(www\.)?jfcadvocacy(-|.).*$|^http:https://(www\.)?jmhic(-|.).*$|^http:https://(www\.)?juris(-|.).*$|^http:https://(www\.)?kylos(-|.).*$|^http:https://(www\.)?laser-eye(-|.).*$|^http:https://(www\.)?leathertree(-|.).*$|^http:https://(www\.)?lillystar(-|.).*$|^http:https://(www\.)?linkerdome(-|.).*$|^http:https://(www\.)?livenet(-|.).*$|^http:https://(www\.)?low-limit(-|.).*$|^http:https://(www\.)?lowest-price(-|.).*$|^http:https://(www\.)?luxup.ru(-|.).*$|^http:https://(www\.)?macsurfer(-|.).*$|^http:https://(www\.)?mall.uk(-|.).*$|^http:https://(www\.)?maloylawn(-|.).*$|^http:https://(www\.)?marketing(-|.).*$|^http:https://(www\.)?.*(-|.)?mature(-|.).*$|^http:https://(www\.)?mcdortaklar(-|.).*$|^http:https://(www\.)?mediavisor(-|.).*$|^http:https://(www\.)?medications(-|.).*$|^http:https://(www\.)?mirror.sytes(-|.).*$|^http:https://(www\.)?mp3(-|.).*$|^http:https://(www\.)?(-|.)musicbox1(-|.).*$|^http:https://(www\.)?myftpupload(-|.).*$|^http:https://(www\.)?naked(-|.).*$|^http:https://(www\.)?netdisaster(-|.).*$|^http:https://(www\.)?netfirms(-|.).*$|^http:https://(www\.)?newtruths(-|.).*$|^http:https://(www\.)?no-limit(-|.).*$|^http:https://(www\.)?nude(-|.).*$|^http:https://(www\.)?nudeceleb(-|.).*$|^http:https://(www\.)?nutzu(-|.).*$|^http:https://(www\.)?odge(-|.).*$|^http:https://(www\.)?oiline(-|.).*$|^http:https://(www\.)?onlinegamingassoc(-|.).*$|^http:https://(www\.)?outpersonals(-|.).*$|^http:https://(www\.)?o-o-6-o-o.ru(-|.).*$|^http:https://(www\.)?o-o-8-o-o.ru(-|.).*$|^http:https://(www\.)?pagetwo(-|.).*$|^http:https://(www\.)?paris(-|.).*$|^http:https://(www\.)?passions(-|.).*$|^http:https://(www\.)?peblog(-|.).*$|^http:https://(www\.)?peng(-|.).*$|^http:https://(www\.)?perfume-cologne(-|.).*$|^http:https://(www\.)?personal(-|.).*$|^http:https://(www\.)?php-soft(-|.).*$|^http:https://(www\.)?pisoc(-|.).*$|^http:https://(www\.)?pisx(-|.).*$|^http:https://(www\.)?popwow(-|.).*$|^http:https://(www\.)?porn(-|.).*$|^http:https://(www\.)?prescriptions(-|.).*$|^http:https://(www\.)?priceg(-|.).*$|^http:https://(www\.)?.*(-|.)?pus*y(-|.).*$|^http:https://(www\.)?printdirectforless(-|.).*$|^http:https://(www\.)?ps2cool(-|.).*$|^http:https://(www\.)?psnarones(-|.).*$|^http:https://(www\.)?psxtreme(-|.).*$) 1;
}
## Q - Z
map $http_referer $bad_urls4 {
default 0;
~(?i)(^http:https://(www\.)?quality-traffic(-|.).*$|^http:https://(www\.)?registrarprice(-|.).*$|^http:https://(www\.)?reliableresults(-|.).*$|^http:https://(www\.)?rimpim(-|.).*$|^http:https://(www\.)?ro7kalbe(-|.).*$|^http:https://(www\.)?rohkalby(-|.).*$|^http:https://(www\.)?ronnieazza(-|.).*$|^http:https://(www\.)?rulo.biz(-|.).*$|^http:https://(www\.)?responsinator(-|.).*$|^http:https://(www\.)?s5(-|.).*$|^http:https://(www\.)?samiuls(-|.).*$|^http:https://(www\.)?savefrom(-|.).*$|^http:https://(www\.)?savetubevideo.com(-|.).*$|^http:https://(www\.)?screentoolkit.com(-|.).*$|^http:https://(www\.)?searchedu(-|.).*$|^http:https://(www\.)?semalt.com(-|.).*$|^http:https://(www\.)?seoexperimenty(-|.).*$|^http:https://(www\.)?seventwentyfour(-|.).*$|^http:https://(www\.)?seventwentyfour.*$|^http:https://(www\.)?sex(-|.).*$|^http:https://(www\.)?sexsearch(-|.).*$|^http:https://(www\.)?sexsq(-|.).*$|^http:https://(www\.)?shoesdiscount(-|.).*$|^http:https://(www\.)?site-4u(-|.).*$|^http:https://(www\.)?site5(-|.).*$|^http:https://(www\.)?slatersdvds(-|.).*$|^http:https://(www\.)?slftsdybbg.ru(-|.).*$|^http:https://(www\.)?sml338(-|.).*$|^http:https://(www\.)?sms(-|.).*$|^http:https://(www\.)?smsportali(-|.).*$|^http:https://(www\.)?socialseet.ru(-|.).*$|^http:https://(www\.)?software(-|.).*$|^http:https://(www\.)?sortthemesitesby(-|.).*$|^http:https://(www\.)?spears(-|.).*$|^http:https://(www\.)?spoodles(-|.).*$|^http:https://(www\.)?sportsparent(-|.).*$|^http:https://(www\.)?srecorder(-|.).*$|^http:https://(www\.)?stmaryonline(-|.).*$|^http:https://(www\.)?superiends.org(-|.).*$|^http:https://(www\.)?strip(-|.).*$|^http:https://(www\.)?suttonjames(-|.).*$|^http:https://(www\.)?talk.uk-yankee(-|.).*$|^http:https://(www\.)?tecrep-inc(-|.).*$|^http:https://(www\.)?teen(-|.).*$|^http:https://(www\.)?terashells(-|.).*$|^http:https://(www\.)?thatwhichis(-|.).*$|^http:https://(www\.)?thorcarlson(-|.).*$|^http:https://(www\.)?.*(-|.)?tits(-|.).*$|^http:https://(www\.)?.*(-|.)?titten(-|.).*$|^http:https://(www\.)?tmsathai(-|.).*$|^http:https://(www\.)?traffixer(-|.).*$|^http:https://(www\.)?tranny(-|.).*$|^http:https://(www\.)?valeof(-|.).*$|^http:https://(www\.)?video(-|.).*$|^http:https://(www\.)?vinhas(-|.).*$|^http:https://(www\.)?vixen1(-|.).*$|^http:https://(www\.)?vpshs(-|.).*$|^http:https://(www\.)?vrajitor(-|.).*$|^http:https://(www\.)?vodkoved.ru(-|.).*$|^http:https://(www\.)?w3md(-|.).*$|^http:https://(www\.)?websocial.me(-|.).*$|^http:https://(www\.)?webdevsquare(-|.).*$|^http:https://(www\.)?whois(-|.).*$|^http:https://(www\.)?withdrawal(-|.).*$|^http:https://(www\.)?worldemail(-|.).*$|^http:https://(www\.)?wslp24(-|.).*$|^http:https://(www\.)?ws-op(-|.).*$|^http:https://(www\.)?xnxx(-|.).*$|^http:https://(www\.)?xopy(-|.).*$|^http:https://(www\.)?xxx(-|.).*$|^http:https://(www\.)?yelucie(-|.).*$|^http:https://(www\.)?youradulthosting(-|.).*$|^http:https://(www\.)?ykecwqlixx.ru(-|.).*$|^http:https://(www\.)?yougetsignal.com(-|.).*$|^http:https://(www\.)?(-|.)zindagi(-|.).*$) 1;
}
## Domains Linked to Yontoo Browser Malware and a Few Other New Ones
## Have split this into it's own section to keep lines shorter NOTE: changes to instructions
## adding if ($bad_urls5) and if ($bad_urls6) to your site(s) config.
map $http_referer $bad_urls5 {
default 0;
~(?i)(^http:https://(www\.)?101raccoon.ru(-|.).*$|^http:https://(www\.)?28n2gl3wfyb0.ru(-|.).*$|^http:https://(www\.)?627ad6438b58439cad1fc8cf6d67a92e.com(-|.).*$|^http:https://(www\.)?6ab9743d0152486387559b4abaa02ada.com(-|.).*$|^http:https://(www\.)?a342ae9750004b14b55f7310eff0ab65.com(-|.).*$|^http:https://(www\.)?aa08daf7e13b6345e09e92f771507fa5f4.com(-|.).*$|^http:https://(www\.)?aa14ab57a3339c4064bd9ae6fad7495b5f.com(-|.).*$|^http:https://(www\.)?aa625d84f1587749c1ab011d6f269f7d64.com(-|.).*$|^http:https://(www\.)?aa81bf391151884adfa3dd677e41f94be1.com(-|.).*$|^http:https://(www\.)?aa8780bb28a1de4eb5bff33c28a218a930.com(-|.).*$|^http:https://(www\.)?aa8b68101d388c446389283820863176e7.com(-|.).*$|^http:https://(www\.)?aa9bd78f328a6a41279d0fad0a88df1901.com(-|.).*$|^http:https://(www\.)?aa9d046aab36af4ff182f097f840430d51.com(-|.).*$|^http:https://(www\.)?aaa38852e886ac4af1a3cff9b47cab6272.com(-|.).*$|^http:https://(www\.)?aab94f698f36684c5a852a2ef272e031bb.com(-|.).*$|^http:https://(www\.)?aac500b7a15b2646968f6bd8c6305869d7.com(-|.).*$|^http:https://(www\.)?aac52006ec82a24e08b665f4db2b5013f7.com(-|.).*$|^http:https://(www\.)?aad1f4acb0a373420d9b0c4202d38d94fa.com(-|.).*$|^http:https://(www\.)?asrv-a.akamoihd.net(-|.).*$|^http:https://(www\.)?asrvrep-a.akamaihd.net(-|.).*$|^http:https://(www\.)?bestpriceninja.com(-|.).*$|^http:https://(www\.)?bronzeaid-a.akamaihd.net(-|.).*$|^http:https://(www\.)?browsepulse-a.akamaihd.net(-|.).*$|^http:https://(www\.)?cashkitten-a.akamaihd.net(-|.).*$|^http:https://(www\.)?coolbar.pro(-|.).*$) 1;
}
map $http_referer $bad_urls6 {
default 0;
~(?i)(^http:https://(www\.)?davebestdeals.com(-|.).*$|^http:https://(www\.)?discovertreasure-a.akamaihd.net(-|.).*$|^http:https://(www\.)?discovertreasurenow.com(-|.).*$|^http:https://(www\.)?foxydeal.com(-|.).*$|^http:https://(www\.)?gameonasia.com(-|.).*$|^http:https://(www\.)?gameplexcity.com(-|.).*$|^http:https://(www\.)?gamerextra.com(-|.).*$|^http:https://(www\.)?gamerscorps.com(-|.).*$|^http:https://(www\.)?gamewrath.com(-|.).*$|^http:https://(www\.)?generousdeal-a.akamaihd.net(-|.).*$|^http:https://(www\.)?girlgamerdaily.com(-|.).*$|^http:https://(www\.)?hdapp1008-a.akamaihd.net(-|.).*$|^http:https://(www\.)?highstairs-a.akamaihd.net(-|.).*$|^http:https://(www\.)?hotshoppymac.com(-|.).*$|^http:https://(www\.)?matchpal-a.akamaihd.net(-|.).*$|^http:https://(www\.)?mecash.ru(-|.).*$|^http:https://(www\.)?monarchfind-a.akamaihd.net(-|.).*$|^http:https://(www\.)?myshopmatemac.com(-|.).*$|^http:https://(www\.)?nottyu.xyz(-|.).*$|^http:https://(www\.)?onlinemegax.com(-|.).*$|^http:https://(www\.)?outrageousdeal-a.akamaihd.net(-|.).*$|^http:https://(www\.)?pijoto.net(-|.).*$|^http:https://(www\.)?recordpage-a.akamaihd.net(-|.).*$|^http:https://(www\.)?resultshub-a.akamaihd.net(-|.).*$|^http:https://(www\.)?rvzr-a.akamaihd.net(-|.).*$|^http:https://(www\.)?savingsslider-a.akamaihd.net(-|.).*$|^http:https://(www\.)?searchinterneat-a.akamaihd.net(-|.).*$|^http:https://(www\.)?searchwebknow-a.akamaihd.net(-|.).*$|^http:https://(www\.)?seeresultshub-a.akamaihd.net(-|.).*$|^http:https://(www\.)?shoppytoolmac.com(-|.).*$|^http:https://(www\.)?skytraf.xyz(-|.).*$|^http:https://(www\.)?splendorsearch-a.akamaihd.net(-|.).*$|^http:https://(www\.)?strongsignal-a.akamaihd.net(-|.).*$|^http:https://(www\.)?surfbuyermac.com(-|.).*$|^http:https://(www\.)?treasuretrack-a.akamaihd.net(-|.).*$|^http:https://(www\.)?webshoppermac.com(-|.).*$|^http:https://(www\.)?pospr.waw.pl(-|.).*$|^http:https://(www\.)?abclauncher.com(-|.).*$|^http:https://(www\.)?alert-fjg.xyz(-|.).*$|^http:https://(www\.)?analytics-ads.xyz(-|.).*$|^http:https://(www\.)?bamo.xsl.pt(-|.).*$|^http:https://(www\.)?compliance-olga.top(-|.).*$|^http:https://(www\.)?digital-video-processing.com(-|.).*$|^http:https://(www\.)?eu-cookie-law.info(-|.).*$|^http:https://(www\.)?findpik.com(-|.).*$|^http:https://(www\.)?forum20.smailik.org(-|.).*$|^http:https://(www\.)?free-share-buttons.top(-|.).*$|^http:https://(www\.)?free-social-buttons2.xyz(-|.).*$|^http:https://(www\.)?free-social-buttons3.xyz(-|.).*$|^http:https://(www\.)?free-social-buttons4.xyz(-|.).*$|^http:https://(www\.)?free-social-buttons5.xyz(-|.).*$|^http:https://(www\.)?front.to(-|.).*$|^http:https://(www\.)?infokonkurs.ru(-|.).*$|^http:https://(www\.)?mapquestz.us(-|.).*$|^http:https://(www\.)?quick-offer.com(-|.).*$|^http:https://(www\.)?rank-checker.online(-|.).*$|^http:https://(www\.)?rankchecker.online(-|.).*$|^http:https://(www\.)?rapidokbrain.com(-|.).*$|^http:https://(www\.)?real-time-analytics.com(-|.).*$|^http:https://(www\.)?sharebutton.net(-|.).*$|^http:https://(www\.)?sharebutton.org(-|.).*$|^http:https://(www\.)?shemale-sex.net(-|.).*$|^http:https://(www\.)?site-speed-check.site(-|.).*$|^http:https://(www\.)?site-speed-checker.site(-|.).*$|^http:https://(www\.)?trafficmania.com(-|.).*$|^http:https://(www\.)?website-speed-up.site(-|.).*$|^http:https://(www\.)?website-speed-up.top(-|.).*$|^http:https://(www\.)?xn--80aagddcgkbcqbad7amllnejg6dya.xn--p1ai(-|.).*$|^http:https://(www\.)?xn--80aikhbrhr.net(-|.).*$|^http:https://(www\.)?pila.pl(-|.).*$|^http:https://(www\.)?dytohqka.su(-|.).*$|^http:https://(www\.)?fqvjhqciw.net.ru(-|.).*$|^http:https://(www\.)?wycjrqzy.ua(-|.).*$|^http:https://(www\.)?0ca29773681c7e82.com(-|.).*$|^http:https://(www\.)?intervsem.ru(-|.).*$|^http:https://(www\.)?candy-glam-hp.com(-|.).*$|^http:https://(www\.)?thecoolimages.net(-|.).*$|^http:https://(www\.)?rebuildermedical.com(-|.).*$|^http:https://(www\.)?gaygalls.net(-|.).*$|^http:https://(www\.)?keywordteam.net(-|.).*$|^http:https://(www\.)?netfacet.net(-|.).*$|^http:https://(www\.)?pattersonsweb.com(-|.).*$|^http:https://(www\.)?trapit.com.gg(-|.).*$) 1;
}
## Add here all hosts that should be spared any referrer checking.
## Whitelist all your own IPs in this section, each IP followed by a 0;
geo $bad_referer {
127.0.0.1 0;
111.111.111.111 0;
}
# Geo directive to deny certain ip addresses
geo $validate_client {
default 0;
# Cyveillance
38.100.19.8/29 1;
38.100.21.0/24 1;
38.100.41.64/26 1;
38.105.71.0/25 1;
38.105.83.0/27 1;
38.112.21.140/30 1;
38.118.42.32/29 1;
65.213.208.128/27 1;
65.222.176.96/27 1;
65.222.185.72/29 1;
}