How does Semalt spam referrers bypass Nginx rules?

Question

Here is the way I use to block spam referrers such as Semalt and others from hitting my website.

Under the Server directive I have the following (Not complete referrers list):

if ($http_referer ~ "7makemoneyonline\.com|semalt\.com|Get-Free-Traffic-Now\.com) { 
       return 403;
}

This rule doesn't seem to work and I'm still getting hits from them. This is not related to Google Analytics in which I create a filter, I know that. But, this is not the case, I see these referrers in my logs everyday and they are able to access my website, so actual requests are made to my server by these spammers. How can they bypass Nginx rules? I verified the above code and put my other website to the list, then I referred myself to the first website and got blocked. So how it's working for me and not for them? Are there alternative Nginx rules that work better?

Thank you.

Answer 1

Without seeing the actual log file entries, it's hard to tell where the pattern mismatch is occuring. To start, I would recommend using the case insensitive pattern match ~* instead of simply ~. You should be able to get away with not escaping the period/dot in Nginx. And you can decrease the specificity to make your pattern cast a wider net. Matching "get-free-traffic" will suffice in matching "get-free-traffic-now.com" and other variations "get-free-traffic-now.net", "get-free-traffic-today.com", etc

if ($http_referer ~* 7makemoneyonline|semalt.com|get-free-traffic) {
  return 403;   
}