we are using a plugin that bans IP ( deny host IP ) that does not appear to work.. so we harvest the IP's from drupals
access rules and place them in our root .htaccess.

I thought I'd post with those captured to date ( 5 weeks at the http://www.eaglesnest-2.net site ) to give some a head
start on blocking these moronic posters ( SPAMer or BOTSPAMers)

<Files .htaccess>
order allow,deny
deny from all
</Files>
SetEnvIf User-Agent "Alexibot" getout 
SetEnvIf User-Agent "asterias" getout 
SetEnvIf User-Agent "autoemailspider" getout 
SetEnvIf User-Agent "b2w 0.1" getout 
SetEnvIf User-Agent "BackWeb" getout 
SetEnvIf User-Agent "BackDoorBot 1.0" getout 
SetEnvIf User-Agent "Black Hole" getout 
SetEnvIf User-Agent "BlackWidow" getout 
SetEnvIf User-Agent "BlowFish 1.0" getout 
SetEnvIf User-Agent "CherryPicker 1.0" getout 
SetEnvIf User-Agent "CherryPickerSE 1.0" getout 
SetEnvIf User-Agent "CherryPickerElite 1.0" getout 
SetEnvIf User-Agent "ChinaClaw" getout 
SetEnvIf User-Agent "Collector" getout 
SetEnvIf User-Agent "Copier" getout 
SetEnvIf User-Agent "Crescent" getout 
SetEnvIf User-Agent "Crescent internet toolPak HTTP OLE Control v.1.0" getout 
SetEnvIf User-Agent "Custo" getout 
SetEnvIf User-Agent "DISCo" getout 
SetEnvIf User-Agent "DISCo Pump" getout 
SetEnvIf User-Agent "DISCo Pump 3.1" getout 
SetEnvIf User-Agent "Download Demon" getout 
SetEnvIf User-Agent "Download Wonder" getout 
SetEnvIf User-Agent "Downloader" getout 
SetEnvIf User-Agent "Drip" getout 
SetEnvIf User-Agent "eCatch" getout 
SetEnvIf User-Agent "EirGrabber" getout 
SetEnvIf User-Agent "EmailCollector" getout 
SetEnvIf User-Agent "EmailCollector 1.0" getout 
SetEnvIf User-Agent "EmailSiphon" getout 
SetEnvIf User-Agent "EmailWolf" getout 
SetEnvIf User-Agent "EmailWolf 1.00" getout 
SetEnvIf User-Agent "Express WebPictures" getout 
SetEnvIf User-Agent "ExtractorPro" getout 
SetEnvIf User-Agent "EyeNetIE" getout 
SetEnvIf User-Agent "fileHound" getout 
SetEnvIf User-Agent "Flaming AttackBot" getout 
SetEnvIf User-Agent "FlashGet" getout 
SetEnvIf User-Agent "GetRight" getout 
SetEnvIf User-Agent "GetSmart" getout 
SetEnvIf User-Agent "GetWeb!" getout 
SetEnvIf User-Agent "Go!Zilla" getout 
SetEnvIf User-Agent "Go-Ahead-Got-It" getout 
SetEnvIf User-Agent "gotit" getout 
SetEnvIf User-Agent "Grabber" getout 
SetEnvIf User-Agent "GrabNet" getout 
SetEnvIf User-Agent "Grafula" getout 
SetEnvIf User-Agent "Harvest 1.5" getout 
SetEnvIf User-Agent "HMView" getout 
SetEnvIf User-Agent "HTTrack" getout 
SetEnvIf User-Agent "Image Stripper" getout 
SetEnvIf User-Agent "Image Sucker" getout 
SetEnvIf User-Agent "indy Library" getout 
SetEnvIf User-Agent "interGET" getout 
SetEnvIf User-Agent "internet Ninja" getout 
SetEnvIf User-Agent "Iria" getout 
SetEnvIf User-Agent "JetCar" getout 
SetEnvIf User-Agent "JOC Web Spider" getout 
SetEnvIf User-Agent "JOC" getout 
SetEnvIf User-Agent "JustView" getout 
SetEnvIf User-Agent "larbin" getout 
SetEnvIf User-Agent "lftp" getout 
SetEnvIf User-Agent "LeechFTP" getout 
SetEnvIf User-Agent "likse" getout 
SetEnvIf User-Agent "Magnet" getout 
SetEnvIf User-Agent "Mag-Net" getout 
SetEnvIf User-Agent "Mass Downloader" getout 
SetEnvIf User-Agent "Memo" getout 
SetEnvIf User-Agent "MIDown tool" getout 
SetEnvIf User-Agent "Mirror" getout 
SetEnvIf User-Agent "Mister PiX" getout 
SetEnvIf User-Agent "Navroad" getout 
SetEnvIf User-Agent "NearSite" getout 
SetEnvIf User-Agent "NetAnts" getout 
SetEnvIf User-Agent "NetSpider" getout 
SetEnvIf User-Agent "Net Vampire" getout 
SetEnvIf User-Agent "NetZIP" getout 
SetEnvIf User-Agent "NICErsPRO" getout 
SetEnvIf User-Agent "Ninja" getout 
SetEnvIf User-Agent "Octopus" getout 
SetEnvIf User-Agent "Offline Explorer" getout 
SetEnvIf User-Agent "Offline Navigator" getout 
SetEnvIf User-Agent "PageGrabber" getout 
SetEnvIf User-Agent "Papa Foto" getout 
SetEnvIf User-Agent "pavuk" getout 
SetEnvIf User-Agent "pcBrowser" getout 
SetEnvIf User-Agent "Pump" getout 
SetEnvIf User-Agent "RealDownload" getout 
SetEnvIf User-Agent "Reaper" getout 
SetEnvIf User-Agent "Recorder" getout 
SetEnvIf User-Agent "ReGet" getout 
SetEnvIf User-Agent "Siphon" getout 
SetEnvIf User-Agent "SiteSnagger" getout 
SetEnvIf User-Agent "SmartDownload" getout 
SetEnvIf User-Agent "Snake" getout 
SetEnvIf User-Agent "SpaceBison" getout 
SetEnvIf User-Agent "Sucker" getout 
SetEnvIf User-Agent "SuperBot" getout 
SetEnvIf User-Agent "SuperHTTP" getout 
SetEnvIf User-Agent "Surfbot" getout 
SetEnvIf User-Agent "tAkeOut" getout 
SetEnvIf User-Agent "Teleport" getout 
SetEnvIf User-Agent "Teleport Pro" getout 
SetEnvIf User-Agent "Teleport Pro/1.29.1718" getout 
SetEnvIf User-Agent "Teleport Pro/1.29.1632" getout 
SetEnvIf User-Agent "Teleport Pro/1.29.1590" getout 
SetEnvIf User-Agent "Teleport Pro/1.29.1616" getout 
SetEnvIf User-Agent "TMCrawler" getout 
SetEnvIf User-Agent "Vacuum" getout 
SetEnvIf User-Agent "VoidEYE" getout 
SetEnvIf User-Agent "WebAuto" getout 
SetEnvIf User-Agent "WebBandit" getout 
SetEnvIf User-Agent "WebBandit 2.1" getout 
SetEnvIf User-Agent "WebBandit 3.50" getout 
SetEnvIf User-Agent "webbandit 4.00.0" getout 
SetEnvIf User-Agent "WebCapture 2.0" getout 
SetEnvIf User-Agent "WebCopier v.2.2" getout 
SetEnvIf User-Agent "WebCopier v3.2a" getout 
SetEnvIf User-Agent "WebCopier" getout 
SetEnvIf User-Agent "WebEMailExtractor 1.0B" getout 
SetEnvIf User-Agent "WebFetch" getout 
SetEnvIf User-Agent "WebGo IS" getout 
SetEnvIf User-Agent "Web Image Collector" getout 
SetEnvIf User-Agent "Web Sucker" getout 
SetEnvIf User-Agent "WebLeacher" getout 
SetEnvIf User-Agent "WebReaper" getout 
SetEnvIf User-Agent "WebSauger" getout 
SetEnvIf User-Agent "Website" getout 
SetEnvIf User-Agent "Website eXtractor" getout 
SetEnvIf User-Agent "Website Quester" getout 
SetEnvIf User-Agent "Webster" getout 
SetEnvIf User-Agent "WebStripper" getout 
SetEnvIf User-Agent "WebWhacker" getout 
SetEnvIf User-Agent "WebZIP" getout 
SetEnvIf User-Agent "WebZip/4.0" getout 
SetEnvIf User-Agent "WebZIP/4.21" getout 
SetEnvIf User-Agent "WebZIP/5.0" getout 
SetEnvIf User-Agent "Wget" getout 
SetEnvIf User-Agent "Wget/1.5.3" getout 
SetEnvIf User-Agent "Wget/1.6" getout 
SetEnvIf User-Agent "Whacker" getout 
SetEnvIf User-Agent "Widow" getout 
SetEnvIf User-Agent "WWW-Collector-E" getout 
SetEnvIf User-Agent "WWWOFFLE" getout 
SetEnvIf User-Agent "Xaldon" getout 
SetEnvIf User-Agent "Xaldon/WebSpider" getout 
SetEnvIf Remote_Host  "xeon.resolve.ru" getout 
SetEnvIf Remote_Host  "resolve.ru" getout 
SetEnvIf Remote_Host  "did.donga.ac.kr" getout 
SetEnvIf Remote_Host  "donga.ac.kr" getout 
SetEnvIf Remote_Host  "upc-h.chello.nl" getout 
SetEnvIf Remote_Host  "chello.nl" getout 
SetEnvIf Remote_Host  "keymachine.de" getout 
SetEnvIf Remote_Host  "wanadoo.fr" getout 
SetEnvIf Remote_Host  "static.theplanet.com" getout 
SetEnvIf Remote_Host  "theplanet.com" getout 
SetEnvIf Remote_Host  "inhoster.com" getout 
SetEnvIf Remote_Host  "dedicatedplace.com" getout 
SetEnvIf Remote_Host  "wbs.co.za" getout 
SetEnvIf Remote_Host  "chello.nl" getout 
SetEnvIf Remote_Host  "auto-insurancedeals-4u.info" getout 
SetEnvIf Remote_Host  "khansrestaurant.com" getout 
SetEnvIf Remote_Host  "vegassportspics.com" getout 
SetEnvIf Remote_Host  "weblinkvalidator.com" getout 
SetEnvIf Remote_Host  "viagrcare.com" getout 
SetEnvIf Remote_Host  "lbcarroll.com" getout 
SetEnvIf Remote_Host  "theonlinecarinsurance.com" getout 
SetEnvIf Remote_Host  "tomscarborough.com" getout 
SetEnvIf Remote_Addr "213.161.92.10" getout 
SetEnvIf Remote_Addr "219.240.12.173" getout 
SetEnvIf Remote_Addr "202.159.212.165" getout 
SetEnvIf Remote_Addr "85.255.117.226" getout 
# block bad-bots using lines written by bad_bot.pl script above 
SetEnvIf Request_URI "^(/403.*\.shtml¦/robots\.txt¦/index\.php)$" allowsome 
IndexIgnore */*
<files *> 
order deny,allow 
deny from env=getout 
allow from env=allowsome 
</files> 
<Files /home/softvis/www/400.shtml>
order allow,deny
allow from all
</Files>
<Files /home/softvis/www/401.shtml>
order allow,deny
allow from all
</Files>
<Files /home/softvis/www/403.shtml>
order allow,deny
allow from all
</Files>
<Files /home/softvis/www/404.shtml>
order allow,deny
allow from all
</Files>
<Files /home/softvis/www/500.shtml>
order allow,deny
allow from all
</Files>
RewriteEngine on
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} .index\.php3*
RewriteCond %{HTTP_REFERER} !.*soft-vision.com.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule (.*) ^http://%{REMOTE_ADDR}/$ [R=301,L]
RewriteEngine on
RewriteBase / 
RewriteCond %{HTTP_USER_AGENT} ^BlackWidow [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Bot\ mailto:craftbot@yahoo.com [OR] 
RewriteCond %{HTTP_USER_AGENT} ^ChinaClaw [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Custo [OR] 
RewriteCond %{HTTP_USER_AGENT} ^DISCo [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Download\ Demon 
RewriteCond %{HTTP_USER_AGENT} ^eCatch [OR] 
RewriteCond %{HTTP_USER_AGENT} ^EmailCollector [OR]
RewriteCond %{HTTP_USER_AGENT} ^EirGrabber [OR] 
RewriteCond %{HTTP_USER_AGENT} ^EmailSiphon [OR] 
RewriteCond %{HTTP_USER_AGENT} ^EmailWolf [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Express\ WebPictures [OR] 
RewriteCond %{HTTP_USER_AGENT} ^ExtractorPro [OR] 
RewriteCond %{HTTP_USER_AGENT} ^EyeNetIE [OR] 
RewriteCond %{HTTP_USER_AGENT} ^FlashGet [OR] 
RewriteCond %{HTTP_USER_AGENT} ^GetRight [OR] 
RewriteCond %{HTTP_USER_AGENT} ^GetWeb! [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Go!Zilla [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Go-Ahead-Got-It [OR] 
RewriteCond %{HTTP_USER_AGENT} ^GrabNet [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Grafula [OR] 
RewriteCond %{HTTP_USER_AGENT} ^HMView [OR] 
RewriteCond %{HTTP_USER_AGENT} ^HTTrack [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} ^Image\ Stripper [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Image\ Sucker [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Indy\ Library [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} ^InterGET [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Internet\ Ninja [OR] 
RewriteCond %{HTTP_USER_AGENT} ^JetCar [OR] 
RewriteCond %{HTTP_USER_AGENT} ^JOC\ Web\ Spider [OR] 
RewriteCond %{HTTP_USER_AGENT} ^larbin [OR] 
RewriteCond %{HTTP_USER_AGENT} ^LeechFTP [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Mass\ Downloader [OR] 
RewriteCond %{HTTP_USER_AGENT} ^MIDown\ tool [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Mister\ PiX [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Navroad [OR] 
RewriteCond %{HTTP_USER_AGENT} ^NearSite [OR] 
RewriteCond %{HTTP_USER_AGENT} ^NetAnts [OR] 
RewriteCond %{HTTP_USER_AGENT} ^NetSpider [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Net\ Vampire [OR] 
RewriteCond %{HTTP_USER_AGENT} ^NetZIP [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Octopus [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Offline\ Explorer [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Offline\ Navigator [OR] 
RewriteCond %{HTTP_USER_AGENT} ^PageGrabber [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Papa\ Foto [OR] 
RewriteCond %{HTTP_USER_AGENT} ^pavuk [OR] 
RewriteCond %{HTTP_USER_AGENT} ^pcBrowser [OR] 
RewriteCond %{HTTP_USER_AGENT} ^RealDownload [OR] 
RewriteCond %{HTTP_USER_AGENT} ^ReGet [OR] 
RewriteCond %{HTTP_USER_AGENT} ^SiteSnagger [OR] 
RewriteCond %{HTTP_USER_AGENT} ^SmartDownload [OR] 
RewriteCond %{HTTP_USER_AGENT} ^SuperBot [OR] 
RewriteCond %{HTTP_USER_AGENT} ^SuperHTTP [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Surfbot [OR] 
RewriteCond %{HTTP_USER_AGENT} ^tAkeOut [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Teleport\ Pro [OR] 
RewriteCond %{HTTP_USER_AGENT} ^VoidEYE [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Web\ Image\ Collector [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Web\ Sucker [OR] 
RewriteCond %{HTTP_USER_AGENT} ^WebAuto [OR] 
RewriteCond %{HTTP_USER_AGENT} ^WebCopier [OR] 
RewriteCond %{HTTP_USER_AGENT} ^WebFetch [OR] 
RewriteCond %{HTTP_USER_AGENT} ^WebGo\ IS [OR] 
RewriteCond %{HTTP_USER_AGENT} ^WebLeacher [OR] 
RewriteCond %{HTTP_USER_AGENT} ^WebReaper [OR] 
RewriteCond %{HTTP_USER_AGENT} ^WebSauger [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Website\ eXtractor [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Website\ Quester [OR] 
RewriteCond %{HTTP_USER_AGENT} ^WebStripper [OR] 
RewriteCond %{HTTP_USER_AGENT} ^WebWhacker [OR] 
RewriteCond %{HTTP_USER_AGENT} ^WebZIP [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Wget [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Widow [OR] 
RewriteCond %{HTTP_USER_AGENT} ^WWWOFFLE [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Xaldon\ WebSpider [OR] 
RewriteCond %{HTTP_USER_AGENT} ^Zeus 
RewriteRule ^.* - [F,L]
RewriteCond %{HTTP_REFERER} ^http://www.iaea.org$
RewriteRule !^http://[^/.]\.your-site.com.* - [F] 
RewriteEngine on
RewriteCond %{HTTP_REFERER} (sleep-?deprivation) [NC,OR]
RewriteCond %{HTTP_REFERER} (sleep-?disorders) [NC,OR]
RewriteCond %{HTTP_REFERER} (insomnia) [NC,OR]
RewriteCond %{HTTP_REFERER} (phentermine) [NC,OR]
RewriteCond %{HTTP_REFERER} (phentemine) [NC,OR]
RewriteCond %{HTTP_REFERER} (vicodin) [NC,OR]
RewriteCond %{HTTP_REFERER} (hydrocodone) [NC,OR]
RewriteCond %{HTTP_REFERER} (levitra) [NC,OR]
RewriteCond %{HTTP_REFERER} (hgh-) [NC,OR]
RewriteCond %{HTTP_REFERER} (-hgh) [NC,OR]
RewriteCond %{HTTP_REFERER} (ultram-) [NC,OR]
RewriteCond %{HTTP_REFERER} (-ultram) [NC,OR]
RewriteCond %{HTTP_REFERER} (cialis) [NC,OR]
RewriteCond %{HTTP_REFERER} (soma-) [NC,OR]
RewriteCond %{HTTP_REFERER} (-soma) [NC,OR]
RewriteCond %{HTTP_REFERER} (diazepam) [NC,OR]
RewriteCond %{HTTP_REFERER} (gabapentin) [NC,OR]
RewriteCond %{HTTP_REFERER} (celebrex) [NC,OR]
RewriteCond %{HTTP_REFERER} (viagra) [NC,OR]
RewriteCond %{HTTP_REFERER} (fioricet) [NC,OR]
RewriteCond %{HTTP_REFERER} (ambien) [NC,OR]
RewriteCond %{HTTP_REFERER} (valium) [NC,OR]
RewriteCond %{HTTP_REFERER} (zoloft) [NC,OR]
RewriteCond %{HTTP_REFERER} (finasteride) [NC,OR]
RewriteCond %{HTTP_REFERER} (lamisil) [NC,OR]
RewriteCond %{HTTP_REFERER} (meridia) [NC,OR]
RewriteCond %{HTTP_REFERER} (allegra) [NC,OR]
RewriteCond %{HTTP_REFERER} (diflucan) [NC,OR]
RewriteCond %{HTTP_REFERER} (zovirax) [NC,OR]
RewriteCond %{HTTP_REFERER} (valtrex) [NC,OR]
RewriteCond %{HTTP_REFERER} (lipitor) [NC,OR]
RewriteCond %{HTTP_REFERER} (proscar) [NC,OR]
RewriteCond %{HTTP_REFERER} (acyclovir) [NC,OR]
RewriteCond %{HTTP_REFERER} (sildenafil) [NC,OR]
RewriteCond %{HTTP_REFERER} (tadalafil) [NC,OR]
RewriteCond %{HTTP_REFERER} (xenical) [NC,OR]
RewriteCond %{HTTP_REFERER} (melatonin) [NC,OR]
RewriteCond %{HTTP_REFERER} (xanax) [NC,OR]
RewriteCond %{HTTP_REFERER} (herbal) [NC,OR]
RewriteCond %{HTTP_REFERER} (drugs) [NC,OR]
RewriteCond %{HTTP_REFERER} (lortab) [NC,OR]
RewriteCond %{HTTP_REFERER} (adipex) [NC,OR]
RewriteCond %{HTTP_REFERER} (propecia) [NC,OR]
RewriteCond %{HTTP_REFERER} (carisoprodol) [NC,OR]
RewriteCond %{HTTP_REFERER} (tramadol) [NC]
RewriteCond %{HTTP_REFERER} (porno) [NC,OR]
RewriteCond %{HTTP_REFERER} (shemale) [NC,OR]
RewriteCond %{HTTP_REFERER} (gangbang) [NC,OR]
RewriteCond %{HTTP_REFERER} (-cock) [NC,OR]
RewriteCond %{HTTP_REFERER} (-anal) [NC,OR]
RewriteCond %{HTTP_REFERER} (-orgy) [NC,OR]
RewriteCond %{HTTP_REFERER} (cock-) [NC,OR]
RewriteCond %{HTTP_REFERER} (anal-) [NC,OR]
RewriteCond %{HTTP_REFERER} (orgy-) [NC,OR]
RewriteCond %{HTTP_REFERER} (singles-?christian) [NC,OR]
RewriteCond %{HTTP_REFERER} (dating-?christian) [NC,OR]
RewriteCond %{HTTP_REFERER} (cumeating) [NC,OR]
RewriteCond %{HTTP_REFERER} (cream-?pies) [NC,OR]
RewriteCond %{HTTP_REFERER} (cumsucking) [NC,OR]
RewriteCond %{HTTP_REFERER} (cumswapping) [NC,OR]
RewriteCond %{HTTP_REFERER} (cumfilled) [NC,OR]
RewriteCond %{HTTP_REFERER} (cumdripping) [NC,OR]
RewriteCond %{HTTP_REFERER} (krankenversicherung) [NC,OR]
RewriteCond %{HTTP_REFERER} (cumpussy) [NC,OR]
RewriteCond %{HTTP_REFERER} (suckingcum) [NC,OR]
RewriteCond %{HTTP_REFERER} (drippingcum) [NC,OR]
RewriteCond %{HTTP_REFERER} (pussycum) [NC,OR]
RewriteCond %{HTTP_REFERER} (swappingcum) [NC,OR]
RewriteCond %{HTTP_REFERER} (eatingcum) [NC,OR]
RewriteCond %{HTTP_REFERER} (cum-) [NC,OR]
RewriteCond %{HTTP_REFERER} (-cum) [NC,OR]
RewriteCond %{HTTP_REFERER} (sperm) [NC,OR]
RewriteCond %{HTTP_REFERER} (christian-?dating) [NC,OR]
RewriteCond %{HTTP_REFERER} (jewish-?singles) [NC,OR]
RewriteCond %{HTTP_REFERER} (sex-?meetings) [NC,OR]
RewriteCond %{HTTP_REFERER} (swinging) [NC,OR]
RewriteCond %{HTTP_REFERER} (swingers) [NC,OR]
RewriteCond %{HTTP_REFERER} (personals) [NC,OR]
RewriteCond %{HTTP_REFERER} (sleeping) [NC,OR]
RewriteCond %{HTTP_REFERER} (libido) [NC,OR]
RewriteCond %{HTTP_REFERER} (grannies) [NC,OR]
RewriteCond %{HTTP_REFERER} (mature) [NC,OR]
RewriteCond %{HTTP_REFERER} (enhancement) [NC,OR]
RewriteCond %{HTTP_REFERER} (sexual) [NC,OR]
RewriteCond %{HTTP_REFERER} (gay-?teen) [NC,OR]
RewriteCond %{HTTP_REFERER} (teen-?chat) [NC,OR]
RewriteCond %{HTTP_REFERER} (gay-?chat) [NC,OR]
RewriteCond %{HTTP_REFERER} (adult-?finder) [NC,OR]
RewriteCond %{HTTP_REFERER} (adult-?friend) [NC,OR]
RewriteCond %{HTTP_REFERER} (friend-?finder) [NC,OR]
RewriteCond %{HTTP_REFERER} (friend-?adult) [NC,OR]
RewriteCond %{HTTP_REFERER} (finder-?adult) [NC,OR]
RewriteCond %{HTTP_REFERER} (finder-?friend) [NC,OR]
RewriteCond %{HTTP_REFERER} (discrete-?encounters) [NC,OR]
RewriteCond %{HTTP_REFERER} (cheating-?wives) [NC,OR]
RewriteCond %{HTTP_REFERER} (housewives) [NC,OR]
RewriteCond %{HTTP_REFERER} (\-sex\.) [NC,OR]
RewriteCond %{HTTP_REFERER} (xxx) [NC,OR]
RewriteCond %{HTTP_REFERER} (snowballing) [NC]
RewriteCond %{HTTP_REFERER} (fat-) [NC,OR]
RewriteCond %{HTTP_REFERER} (-fat) [NC,OR]
RewriteCond %{HTTP_REFERER} (diet) [NC,OR]
RewriteCond %{HTTP_REFERER} (pills) [NC,OR]
RewriteCond %{HTTP_REFERER} (weight) [NC,OR]
RewriteCond %{HTTP_REFERER} (supplement) [NC]
RewriteCond %{HTTP_REFERER} (poker) [NC,OR]
RewriteCond %{HTTP_REFERER} (casino) [NC,OR]
RewriteCond %{HTTP_REFERER} (blackjack) [NC]
RewriteCond %{HTTP_REFERER} (mortgage) [NC,OR]
RewriteCond %{HTTP_REFERER} (refinancing) [NC,OR]
RewriteCond %{HTTP_REFERER} (cash-?advance) [NC,OR]
RewriteCond %{HTTP_REFERER} (cash-?money) [NC,OR]
RewriteCond %{HTTP_REFERER} (pay-?day) [NC]
RewriteCond %{HTTP_USER_AGENT} (Program\ Shareware|Fetch\ API\ Request) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} (Microsoft\ URL\ Control) [NC]
RewriteCond %{HTTP_REFERER} (netwasgroup\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (nic4u\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (wear4u\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (foxmediasolutions\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (liveplanets\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (aeterna-tech\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (continentaltirebowl\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (chemsymphony\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (infolibria\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (globaleducationeurope\.net) [NC,OR]
RewriteCond %{HTTP_REFERER} (soma\.125mb\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (mitglied\.lycos\.de) [NC,OR]
RewriteCond %{HTTP_REFERER} (foxmediasolutions\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (jroundup\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (feathersandfurvanlines\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (conecrusher\.org) [NC,OR]
RewriteCond %{HTTP_REFERER} (sbj-broadcasting\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (edthompson\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (codychesnutt\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (artsmallforsenate\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (axionfootwear\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (protzonbeer\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (candiria\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (bigsitecity\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (coresat\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (istarthere\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (amateurvoetbal\.net) [NC,OR]
RewriteCond %{HTTP_REFERER} (alleghanyeda\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (xadulthosting\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (datashaping\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (zick\.biz) [NC,OR]
RewriteCond %{HTTP_REFERER} (newprinceton\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (dvdsqueeze\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (xopy\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (webdevboard\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (devaddict\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (eaton-inc\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (whiteguysgroup\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (guestbookz\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (webdevsquare\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (indfx\.net) [NC,OR]
RewriteCond %{HTTP_REFERER} (snap\.to) [NC,OR]
RewriteCond %{HTTP_REFERER} (2y\.net) [NC,OR]
RewriteCond %{HTTP_REFERER} (astromagia\.info) [NC,OR]
RewriteCond %{HTTP_REFERER} (free-?sms) [NC]
RewriteRule .* - [F]

<Files *>
order deny,allow
deny from .inhoster.com
deny from .layeredtech.com
deny from .svservers.com
deny from .fastmarket.com
deny from .jesex.info
deny from .keymachine.de
deny from .intercage.com
deny from .area4.spcsdns.net
deny from .spcsdns.net
allow from all
</Files>

deny from .inhoster.com
deny from .layeredtech.com
deny from .svservers.com
deny from .fastmarket.com
deny from .jesex.info
deny from .keymachine.de
deny from .intercage.com
deny from 85.255.116.238
deny from 66.227.36.185
deny from 69.46.16.231
deny from 242.63.232.72
deny from 195.225.177.8
deny from 85.255.119.
deny from 85.255.119.130
deny from 85.255.119.75
deny from 66.36.243.202
deny from 66.235.180.27
deny from 209.160.73.144
deny from 66.235.160.14
deny from 211.231.187.49
deny from 212.138.64.*
deny from 24.92.103.19
deny from 219.133.40.202
deny from 61.152.100.5
deny from 66.225.219.9
deny from 65.254.38.6
deny from 216.32.85.242
deny from 66.225.229.175
deny from 196.3.81.130
deny from 69.25.212.153
deny from 60.208.64.177
deny from 72.232.191.50
deny from 88.86.110.41
deny from 62.94.10.135
deny from 66.36.241.186
deny from 72.21.34.34
deny from 206.53.51.93
deny from 82.103.143.253
deny from 83.104.88.156
deny from 83.104.88.160
deny from 83.104.88.192
deny from 83.104.89.0
deny from 83.104.90.0
deny from 83.104.90.128
deny from 91.76.67.110
deny from 211.220.195.27
deny from 81.177.22.111
deny from 211.43.222.21
deny from 211.52.78.2
deny from 203.113.60.73
deny from 202.149.208.72
deny from 202.179.137.200
deny from 219.249.160.91
deny from 211.75.142.99
deny from 212.175.149.23
deny from 211.41.249.126
deny from 220.225.87.44
deny from 128.241.20.196
deny from 203.93.254.43
deny from 69.25.165.22
deny from 69.25.164.145
deny from 66.79.160.0
deny from 66.79.191.0
deny from 66.79.167.128
deny from 63.92.244.43
deny from 69.46.20.87
deny from 216.246.78.192
deny from 89.97.244.74
deny from 62.141.48.94
deny from 66.232.124.248
deny from 88.191.254.2
deny from 206.53.51.128
deny from 218.80.198.230
deny from 202.96.1.225
deny from 210.213.113.42
deny from 222.223.173.76
deny from 221.194.134.130
deny from 69.142.236.73
deny from 71.231.202.10
deny from 72.38.178.74
deny from 74.192.199.151
deny from 75.15.205.218
deny from 201.83.50.108
deny from 81.25.36.186
deny from 75.15.205.218
deny from 218.53.228.12
deny from 74.192.199.151
deny from 60.197.187.8
deny from 72.38.178.74
deny from 60.197.187.8
deny from 71.231.202.10
deny from 69.142.236.73
deny from 60.197.187.8
deny from 218.53.228.12
deny from 152.2.9.218
deny from 217.20.163.50
deny from 203.146.129.225
deny from 82.42.84.32
deny from 24.141.26.117
deny from 58.73.52.33
deny from 217.195.94.196
deny from 221.132.135.77
deny from 70.188.230.36
deny from 59.93.198.244
deny from 59.94.251.177
deny from 24.138.22.170	
deny from 80.216.155.77
deny from 24.125.252.13
deny from 222.92.69.125
deny from 213.114.18.63
deny from 89.100.13.2
deny from 221.249.22.27
deny from 81.167.226.14
deny from 206.116.207.46
deny from 213.89.81.172
deny from 210.205.176.173 
deny from 83.136.241.122 
deny from 121.72.242.133 
deny from 80.216.155.77 
deny from 87.51.84.4 
deny from 77.239.6.153 
deny from 12.217.122.106 
deny from 61.175.220.20 
deny from 201.208.234.107 
deny from 59.25.30.250 
deny from 210.216.14.150 
deny from 85.214.77.184 
deny from 122.0.34.138 
deny from 85.10.128.6 
deny from 221.249.22.27 
deny from 80.238.64.205 
deny from 213.200.183.88 
deny from 193.232.119.173 
deny from 200.89.23.3 
deny from 58.241.178.139 
deny from 222.66.48.253 
deny from 218.58.136.18 
deny from  81.0.247.125 
deny from  87.236.197.249 
deny from  218.13.50.94 
deny from  218.56.144.42 
deny from  62.231.243.136 
deny from  61.88.176.209 
deny from  220.215.177.251 
deny from  122.210.100.214 
deny from  142.161.2.190 
deny from  72.174.135.40 
deny from  210.70.109.225 
deny from  61.139.94.199 
deny from  220.130.196.70 
deny from  68.36.148.71 
deny from  69.143.90.208 
deny from  193.251.181.135 
deny from  76.171.16.198 
deny from  62.216.199.222 
deny from  71.56.73.134 
deny from  222.113.4.155 
deny from  62.178.176.253 
deny from  218.74.122.100 
deny from  58.247.2.108 
deny from  69.112.241.185 
deny from  68.61.47.7 
deny from  85.168.116.188 
deny from  68.82.180.64 
deny from  62.231.243.138 
deny from  66.16.125.33 
deny from  61.152.145.19 
deny from  62.231.243.137 
deny from  196.204.195.42 
deny from  58.80.25.18 
deny from  121.140.251.55 
deny from  66.232.112.180 
deny from  74.194.13.132 
deny from  210.221.146.126 
deny from  66.190.200.68 
deny from  67.186.71.84 
deny from  61.4.232.28 
deny from  58.61.153.104 
deny from  67.83.98.15 
deny from  205.251.52.72 
deny from  70.135.8.109 
deny from  24.254.37.164 
deny from  74.78.12.28 
deny from  72.213.164.69 
deny from  69.143.176.17 
deny from  69.247.233.251 
deny from  76.211.218.120 
deny from  85.105.26.154 
deny from  88.191.30.55 
deny from  208.127.133.102 
deny from  67.83.28.26 
deny from  218.250.104.62 
deny from  218.250.104.62 
deny from  199.89.182.5 
deny from  59.95.129.225 
deny from  201.21.116.190 
deny from  72.39.128.65 
deny from  59.95.129.225 
deny from  201.83.50.108

Comments

yelvington’s picture

I've stopped using .htaccess to block IP addresses and moved that to iptables, so no system resources are consumed by these morons.

Here are some additional .htaccess rules you can try:

RedirectMatch /forum/ http://www.fbi.gov
RedirectMatch /phpbb/ http://www.fbi.gov
RedirectMatch /phpbb2/ http://www.fbi.gov

RedirectMatch /_vti_bin/ http://www.microsoft.com
RedirectMatch /scripts/ http://www.microsoft.com
RedirectMatch /MSADC/ http://www.microsoft.com
RedirectMatch /c/ http://www.microsoft.com
RedirectMatch /d/ http://www.microsoft.com
RedirectMatch /_mem_bin/ http://www.microsoft.com
RedirectMatch /msadc/ http://www.microsoft.com
RedirectMatch /MSOffice/ http://www.microsoft.com

### Block fake referrers
RewriteCond %{HTTP_REFERER} (8k\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (8m\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (4t\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (send-?free) [NC,OR]
RewriteCond %{HTTP_REFERER} (canadianlabels) [NC,OR]
RewriteCond %{HTTP_REFERER} (s5\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (crepesuzette) [NC,OR]
RewriteCond %{HTTP_REFERER} (mortgage) [NC,OR]
RewriteCond %{HTTP_REFERER} (fidelityfunding) [NC,OR]
RewriteCond %{HTTP_REFERER} (houseofsevengables) [NC,OR]
RewriteCond %{HTTP_REFERER} (casino) [NC,OR]
RewriteCond %{HTTP_REFERER} (cialis) [NC,OR]
RewriteCond %{HTTP_REFERER} (viagra) [NC,OR]
RewriteCond %{HTTP_REFERER} (gambling) [NC,OR]
RewriteCond %{HTTP_REFERER} (credit-?card) [NC,OR]
RewriteCond %{HTTP_REFERER} (istarthere\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (gambling) [NC,OR]
RewriteCond %{HTTP_REFERER} (poker) [NC,OR]
RewriteCond %{HTTP_REFERER} (mediavisor) [NC,OR]
RewriteCond %{HTTP_REFERER} (texas-?hold-?em) [NC,OR]
RewriteCond %{HTTP_REFERER} (commerce\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (istarthere\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (datashaping\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (newprinceton\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (xopy\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (webdevboard\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (devaddict\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (whiteguysgroup\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (guestbookz\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (webdevsquare\.com) [NC,OR]
RewriteCond %{HTTP_REFERER} (singles-?christian) [NC,OR]
RewriteCond %{HTTP_REFERER} (dating-?christian) [NC,OR]
RewriteCond %{HTTP_REFERER} (christian-?dating) [NC,OR]
RewriteCond %{HTTP_REFERER} (jewish-?singles) [NC,OR]
RewriteCond %{HTTP_REFERER} (sex-?meetings) [NC,OR]
RewriteCond %{HTTP_REFERER} (swinging) [NC,OR]
RewriteCond %{HTTP_REFERER} (swingers) [NC,OR]
RewriteCond %{HTTP_REFERER} (personals) [NC,OR]
RewriteCond %{HTTP_REFERER} (sleeping) [NC,OR]
RewriteCond %{HTTP_REFERER} (sleep-?disorders) [NC,OR]
RewriteCond %{HTTP_REFERER} (insomnia) [NC,OR]
RewriteCond %{HTTP_REFERER} (libido) [NC,OR]
RewriteCond %{HTTP_REFERER} (herbal) [NC,OR]
RewriteCond %{HTTP_REFERER} (enhancement) [NC,OR]
RewriteCond %{HTTP_REFERER} (sexual) [NC,OR]
RewriteCond %{HTTP_REFERER} (herbal-?sleep-?aid) [NC,OR]
RewriteCond %{HTTP_REFERER} (gabapentin) [NC,OR]
RewriteCond %{HTTP_REFERER} (melatonin) [NC,OR]
RewriteCond %{HTTP_REFERER} (sleep-?deprivation) [NC,OR]
RewriteCond %{HTTP_REFERER} (adult-?finder) [NC,OR]
RewriteCond %{HTTP_REFERER} (adult-?friend) [NC,OR]
RewriteCond %{HTTP_REFERER} (friend-?finder) [NC,OR]
RewriteCond %{HTTP_REFERER} (friend-?adult) [NC,OR]
RewriteCond %{HTTP_REFERER} (finder-?adult) [NC,OR]
RewriteCond %{HTTP_REFERER} (finder-?friend) [NC,OR]
RewriteCond %{HTTP_REFERER} (discrete-?encounters) [NC,OR]
RewriteCond %{HTTP_REFERER} (cheating-?wives) [NC,OR]
RewriteCond %{HTTP_REFERER} (housewives) [NC]
RewriteRule \.*$ - [F,L]

yelvington’s picture

I notice the original poster blocking wget:
SetEnvIf User-Agent "Wget" getout
SetEnvIf User-Agent "Wget/1.5.3" getout
SetEnvIf User-Agent "Wget/1.6" getout

If you are using wget in a cron process to hit your cron.php file, don't block it.

joessoft’s picture

It's not a wget block.. ( note all of the call )

It's a User-Agent that fell for our trap and captured Wget (User/Agent) in log - tiss a bad bot for sure.

you will note it changed it's name twice above.

joessoft’s picture

we love .htaccess ...

thanks for your send - will look it over.

joe
http://www.eaglesnest-2.net

bomber23’s picture

cool

You have just used your one-time login link. It is no longer necessary to use this link to login. Please change your password.
http://drupal.org/user/170923/edit
http://drupal.org/user/170923/edit
http://drupal.org/user/170923/edit
http://drupal.org/u