How to forbid requests for a specific URL? - regex

Question

Via Apache, is it possible to exclude access to my site if a particular page request www.mysite.com/this_page/ is made? The referrer IP address changes.
I realize that I can "catch" this request in my code and give back an error page, but I'd prefer for the request to never make it to my actual code. I can also just remove the page, but then my site would return its "page not found" page. So, still a page.
My host is Webfaction and I use Django. So it's Apache.
The reason is that I am seeing some weird activity to this particular page. For the curious, I am getting requests for this page about 20 times a day in bursts of 1-3 requests in 2 seconds. The IP addresses are Ukrainian. The referrers are mostly various Ukrainian websites, which seem real enough, but they do not contain an actual link to my webpage.

Answer 1

I don't think blocking a whole country is a good idea, but here's how to do it.
First, get a list of CIDRs of the country in question. For most countries, it will be a large list. One place to get that would be http://www.find-ip-address.org/ip-country/. Then, merely put those into an .htaccess or Apache config file:
<Location /this_page>
order allow, deny
deny from 5.1.0.0/19
deny from 5.22.156.0/22
deny from 5.34.176.0/21
deny from 5.53.112.0/21
deny from 5.56.24.0/21
deny from 5.57.64.0/21
deny from 5.58.0.0/16
deny from 5.83.16.0/21
deny from 5.104.32.0/19
deny from 5.105.0.0/16
#...
</Location>
(Leading whitespace is optional, .htaccess files don't need Location tags if you're happy blocking the whole directory.)
The above config keys on the client IP rather than the IP of the host of the referring link. That part is much harder to do, though perhaps keying on the Ukrainian TLD would be sufficient:
RewriteEngine on
RewriteCond %{HTTP_REFERER} ^https?://[^:/?#]*\.ua[:/?#]
RewriteRule ^/this_page - [F,L]
(Note that %{HTTP_REFERER} has no double Rs. The spec was misspelled, my config above was not.)
If you're getting slammed by high volume, you might want to consider dropping the connections at the firewall level rather than Apache. Again, that would be by client rather than by referrer.