I’ve been the victim of a massive spam bot attack for about a month now. Basically, a vast network of “zombie” computers (i.e., computers that have been taken over by viruses, worms, or other bad software) have been hitting my blog trying to posts comments. I tried several courses of action: moving over to WordPress, installing plug-ins for WordPress that supposedly stop spammers, and messing with my htaccess file. Unfortunately, though each of those step helped a bit, the spam bots still got through and I was exceeding my daily CPU limit set by my web hosting company.

More Googling has finally led me to a solution that works. I put the following text in my htaccess file in my www directory. (htacess files apply automatically to subfolders.) I hope this entry can help others who are in my situation overcome their spam bots as well.

#from http://multifinanceit.com/htaccess.txt
#These lines block agents commonly used to harvest URLs and email addresses.
#One of the uses of such agents is to gather URLs for subseqent referral spamming
#by a large number of hosts. Thus, preventing their access may, by itself, decrease
#the amount of referral spam you receive.
RewriteCond %{HTTP_USER_AGENT} ^Microsoft\ URL\ Control.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^Mozilla/4\.0\ .*Win\ 9x\ 4\.90.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*Indy\ Library.*$ [NC,OR]

#These lines block bots that use your bandwidth for their own commercial reasons.
RewriteCond %{HTTP_USER_AGENT} ^abot.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^aipbot.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^Linkwalker$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*nameprotect.*$ [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*TurnitinBot.*$ [NC,OR]


Of note is that the comments that spam bots tried to leave never made it through the content filtering system (either under Movable Type or WordPress). So hitting my blog was really useless for them, yet they still continued to try anyway…