Question

一些日志

46.196.164.146 - - [21/Feb/2015:20:05:45 +0300] "GET / HTTP/1.1" 200 10930 "http://22on8mj7w7wpcc.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0" "-"
78.171.167.204 - - [21/Feb/2015:20:05:45 +0300] "GET / HTTP/1.1" 200 10931 "http://y707yvc8a.net/" "Opera/9.80 (Windows NT 6.1; WOW64; U; Edition Romania Local; ru) Presto/2.10.289 Version/8.09" "-"
78.171.167.204 - - [21/Feb/2015:20:05:45 +0300] "GET / HTTP/1.1" 200 10930 "http://87rk11k0.ua/" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0" "-"
78.174.146.52 - - [21/Feb/2015:20:05:45 +0300] "GET / HTTP/1.1" 200 10931 "http://8811mm213kc34.org/" "Mozilla/5.0 (Windows NT 5.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0" "-"
176.43.210.33 - - [21/Feb/2015:20:05:45 +0300] "GET / HTTP/1.1" 200 10930 "http://qh0lx1wqp17.ru/" "Mozilla/5.0 (Windows NT 5.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0" "-"

用户代理随机更改。在nginx conf中有什么办法吗

if (preg_match('/\d{3}/', $invalid_referer)) {
    return 403;
}

Answer 1

在这种情况下你应该只做一个重写规则：

if ($http_referer ~* ".*[0-9]{2}.*") {
    return 403;
}

Http Flood vs Nginx。如何检查$ http_referer是否超过2位数？

1 个答案: