diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/README.md b/Engintron_for_cPanel_WHM_Configuration_Example/README.md new file mode 100644 index 000000000..2f6da307a --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/README.md @@ -0,0 +1,67 @@ +### If this helps you [You can buy me a beer](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=BKF9XT6WHATLG):beer: + +# Nginx Bad Bot and User-Agent Blocker, Spam Referrer Blocker, Anti DDOS, Bad IP Blocker and Wordpress Theme Detector Blocker + +# Configuration Example for Engintron for cPanel/WHM + + + + + + +
Nginx Ultimate Bad Bot Spam Referrer Blocker - Nginx Block Bad Bots, Vulnerability Scanners, Malware and Adware, Malicious Sites, Spam Referrers, Bad Referrers, Spam Blocker with DDOS, Wordpress Theme Detector Blocking and Fail2Ban Jail for Repeat Offenders
+ +- This is a copy of an entire /etc/nginx folder from an Engintron/cPanel/WHM configuration. + +- This is merely an example of where to put the required includes into your hosts files. + +- **Do not simply copy and paste this over your entire nginx folder**, use it as a guide only as it requires that you put the correct domain names into your hosts config's and also correct certificate locations. + +- PLEASE Follow the main configuration instructions at https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/blob/master/CONFIGURATION.md + +- If you follow the main configuration instructions all you need to to is make the changes required in your /etc/conf.d/default.conf and /etc/conf.d/default_https.conf files as per this example. + +### Version 2.2017.05 + +##### Created by: https://github.com/mitchellkrogza +##### Copyright Mitchell Krog + + +# MIT License + +## Copyright (c) 2017 Mitchell Krog - mitchellkrog@gmail.com +## https://github.com/mitchellkrogza + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + +##### Some other free projects + +- https://github.com/mitchellkrogza/apache-ultimate-bad-bot-blocker +- https://github.com/mitchellkrogza/Badd-Boyz-Hosts +- https://github.com/mitchellkrogza/fail2ban-useful-scripts +- https://github.com/mitchellkrogza/linux-server-administration-scripts +- https://github.com/mitchellkrogza/Travis-CI-Nginx-for-Testing-Nginx-Configuration +- https://github.com/mitchellkrogza/Travis-CI-for-Apache-For-Testing-Apache-and-PHP-Configurations +- https://github.com/mitchellkrogza/Fail2Ban-Blacklist-JAIL-for-Repeat-Offenders-with-Perma-Extended-Banning +- https://github.com/mariusv/nginx-badbot-blocker + +##### Into Photography? +Come drop by and visit me at https://mitchellkrog.com + +### Coding makes me very thirsty [why not buy me a beer](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=BKF9XT6WHATLG):beer: \ No newline at end of file diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/bots.d/blacklist-user-agents.conf b/Engintron_for_cPanel_WHM_Configuration_Example/bots.d/blacklist-user-agents.conf new file mode 100755 index 000000000..844ffe7f0 --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/bots.d/blacklist-user-agents.conf @@ -0,0 +1,6 @@ +# Add One Entry Per Line - List all the extra bad User-Agents you want to permanently block +# This is for User-Agents that are not included in the main list of the bot blocker +# This allows you finer control of keeping certain bots blocked and automatic updates will +# Never be able to remove this custom list of yours + + "~*mybaduseragentname" 3; \ No newline at end of file diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/bots.d/blockbots.conf b/Engintron_for_cPanel_WHM_Configuration_Example/bots.d/blockbots.conf new file mode 100755 index 000000000..d09b05c73 --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/bots.d/blockbots.conf @@ -0,0 +1,45 @@ +####################################################################### + +# Author: Mitchell Krog - https://github.com/mitchellkrogza/ + +# Include this in a vhost file within a server {} block using and include statement like below + +# server { +# #Config stuff here +# include /etc/nginx/bots.d/blockbots.conf +# include /etc/nginx/bots.d/ddos.conf +# #Other config stuff here +# } + +####################################################################### + +# BOTS +# **** +#limit_conn bot1_connlimit 100; +limit_conn bot2_connlimit 10; +#limit_req zone=bot1_reqlimitip burst=50; +limit_req zone=bot2_reqlimitip burst=10; +if ($bad_bot = '3') { + return 444; + } + +# BAD REFER WORDS +# *************** +if ($bad_words) { + return 444; +} + + +# REFERERS +# ******** +if ($bad_referer) { + return 444; +} + +# IP BLOCKS +# ********* +if ($validate_client) { + return 444; +} + +####################################################################### \ No newline at end of file diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/bots.d/ddos.conf b/Engintron_for_cPanel_WHM_Configuration_Example/bots.d/ddos.conf new file mode 100755 index 000000000..d8e057ae4 --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/bots.d/ddos.conf @@ -0,0 +1,17 @@ +####################################################################### + +# Author: Mitchell Krog - https://github.com/mitchellkrogza/ + +# Include this in a vhost file within a server {} block using and include statement like below + +# server { +# #Config stuff here +# include /etc/nginx/bots.d/blockbots.conf +# include /etc/nginx/bots.d/ddos.conf +# #Other config stuff here +# } + +####################################################################### + +limit_conn addr 200; +limit_req zone=flood burst=200 nodelay; \ No newline at end of file diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/bots.d/whitelist-domains.conf b/Engintron_for_cPanel_WHM_Configuration_Example/bots.d/whitelist-domains.conf new file mode 100755 index 000000000..884bbff95 --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/bots.d/whitelist-domains.conf @@ -0,0 +1,2 @@ +# Add One Entry Per Line - List all the domains of the web sites you run on your Nginx to spare them from referrer checking +"~*mydomain.com" 0; \ No newline at end of file diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/bots.d/whitelist-ips.conf b/Engintron_for_cPanel_WHM_Configuration_Example/bots.d/whitelist-ips.conf new file mode 100755 index 000000000..dfc79dff2 --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/bots.d/whitelist-ips.conf @@ -0,0 +1,2 @@ +# Add One Entry Per Line - Can Include Ranges like 127.0.0.1/32 +127.0.0.1 0; \ No newline at end of file diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/common_https.conf b/Engintron_for_cPanel_WHM_Configuration_Example/common_https.conf new file mode 100755 index 000000000..9069389f9 --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/common_https.conf @@ -0,0 +1,125 @@ +# Common definitions for static content (HTTPS) + +# TLS/SSL common +ssl_session_timeout 1d; +ssl_session_cache shared:SSL:50m; +ssl_session_tickets off; + +# Diffie-Hellman parameter for DHE ciphersuites (2048 bits) +ssl_dhparam /etc/ssl/certs/dhparam.pem; + +# Protocols & Ciphers +ssl_protocols TLSv1 TLSv1.1 TLSv1.2; +ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS'; +ssl_prefer_server_ciphers on; + +# Initialize important variables +set $CACHE_BYPASS_FOR_DYNAMIC 0; +set $CACHE_BYPASS_FOR_STATIC 0; +set $PROXY_DOMAIN_OR_IP $host; +set $PROXY_TO_PORT 8443; +set $SITE_URI "$host$request_uri"; + +# Generic query string to request a page bypassing Nginx's caching entirely for both dynamic & static content +if ($query_string ~* "nocache") { + set $CACHE_BYPASS_FOR_DYNAMIC 1; + set $CACHE_BYPASS_FOR_STATIC 1; +} + +# Proxy requests to "localhost" +if ($host ~* "localhost") { + set $PROXY_DOMAIN_OR_IP "127.0.0.1"; +} + +# Proxy cPanel specific subdomains +if ($host ~* "^webmail\.") { + set $PROXY_DOMAIN_OR_IP "127.0.0.1"; + set $PROXY_TO_PORT 2096; +} +if ($host ~* "^cpanel\.") { + set $PROXY_DOMAIN_OR_IP "127.0.0.1"; + set $PROXY_TO_PORT 2083; +} +if ($host ~* "^whm\.") { + set $PROXY_DOMAIN_OR_IP "127.0.0.1"; + set $PROXY_TO_PORT 2087; +} +if ($host ~* "^webdisk\.") { + set $PROXY_DOMAIN_OR_IP "127.0.0.1"; + set $PROXY_TO_PORT 2078; +} +if ($host ~* "^(cpcalendars|cpcontacts)\.") { + set $PROXY_DOMAIN_OR_IP "127.0.0.1"; + set $PROXY_TO_PORT 2080; +} + +# Set custom rules like domain/IP exclusions or redirects here +include custom_rules; + +location / { + try_files $uri $uri/ @backend; +} + +location @backend { + include proxy_params_common; + # === MICRO CACHING === + # Comment the following line to disable 1 second micro-caching for dynamic HTML content + include proxy_params_dynamic; +} + +# Enable browser cache for static content files (TTL is 1 hour) +location ~* \.(?:json|xml|rss|atom)$ { + include proxy_params_common; + include proxy_params_static; + expires 1h; +} + +# Enable browser cache for CSS / JS (TTL is 30 days) +location ~* \.(?:css|js)$ { + include proxy_params_common; + include proxy_params_static; + expires 30d; +} + +# Enable browser cache for images (TTL is 60 days) +location ~* \.(?:ico|jpg|jpeg|gif|png|webp)$ { + include proxy_params_common; + include proxy_params_static; + expires 60d; +} + +# Enable browser cache for archives, documents & media files (TTL is 60 days) +location ~* \.(?:3gp|7z|avi|bmp|bz2|csv|divx|doc|docx|eot|exe|flac|flv|gz|less|mid|midi|mka|mkv|mov|mp3|mp4|mpeg|mpg|odp|ods|odt|ogg|ogm|ogv|opus|pdf|ppt|pptx|rar|rtf|swf|tar|tbz|tgz|tiff|txz|wav|webm|wma|wmv|xls|xlsx|xz|zip)$ { + set $CACHE_BYPASS_FOR_STATIC 1; + include proxy_params_common; + include proxy_params_static; + expires 60d; +} + +# Enable browser cache for fonts & fix @font-face cross-domain restriction (TTL is 60 days) +location ~* \.(eot|ttf|otf|woff|woff2|svg|svgz)$ { + include proxy_params_common; + include proxy_params_static; + expires 60d; + add_header Access-Control-Allow-Origin *; +} + +# Prevent logging of favicon and robot request errors +location = /favicon.ico { + include proxy_params_common; + include proxy_params_static; + expires 60d; + log_not_found off; +} + +location = /robots.txt { + include proxy_params_common; + include proxy_params_static; + expires 1d; + log_not_found off; +} + +# Deny access to files like .htaccess or .htpasswd +location ~ /\.ht { + deny all; +} diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/conf.d/botblocker-nginx-settings.conf b/Engintron_for_cPanel_WHM_Configuration_Example/conf.d/botblocker-nginx-settings.conf new file mode 100755 index 000000000..f775af218 --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/conf.d/botblocker-nginx-settings.conf @@ -0,0 +1,4 @@ +server_names_hash_bucket_size 64; +server_names_hash_max_size 4096; +limit_req_zone $binary_remote_addr zone=flood:50m rate=90r/s; +limit_conn_zone $binary_remote_addr zone=addr:50m; \ No newline at end of file diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/conf.d/default.conf b/Engintron_for_cPanel_WHM_Configuration_Example/conf.d/default.conf new file mode 100755 index 000000000..72d3ce72b --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/conf.d/default.conf @@ -0,0 +1,150 @@ +# /** +# * @version 1.8.3 +# * @package Engintron for cPanel/WHM +# * @author Fotis Evangelou +# * @url https://engintron.com +# * @copyright Copyright (c) 2010 - 2017 Nuevvo Webware P.C. All rights reserved. +# * @license GNU/GPL license: https://www.gnu.org/copyleft/gpl.html +# */ + +server { + + listen 80 default_server; + #listen [::]:80 ipv6only=on; + + server_name localhost; + + # deny all; # DO NOT REMOVE OR CHANGE THIS LINE - Used when Engintron is disabled to block Nginx from becoming an open proxy + + # Initialize important variables + set $CACHE_BYPASS_FOR_DYNAMIC 0; + set $CACHE_BYPASS_FOR_STATIC 0; + set $PROXY_DOMAIN_OR_IP $host; + set $PROXY_TO_PORT 8080; + set $SITE_URI "$host$request_uri"; + + # Generic query string to request a page bypassing Nginx's caching entirely for both dynamic & static content + if ($query_string ~* "nocache") { + set $CACHE_BYPASS_FOR_DYNAMIC 1; + set $CACHE_BYPASS_FOR_STATIC 1; + } + + # Proxy requests to "localhost" + if ($host ~* "localhost") { + set $PROXY_DOMAIN_OR_IP "127.0.0.1"; + } + + # Proxy cPanel specific subdomains + if ($host ~* "^webmail\.") { + set $PROXY_DOMAIN_OR_IP "127.0.0.1"; + set $PROXY_TO_PORT 2095; + } + if ($host ~* "^cpanel\.") { + set $PROXY_DOMAIN_OR_IP "127.0.0.1"; + set $PROXY_TO_PORT 2082; + } + if ($host ~* "^whm\.") { + set $PROXY_DOMAIN_OR_IP "127.0.0.1"; + set $PROXY_TO_PORT 2086; + } + if ($host ~* "^webdisk\.") { + set $PROXY_DOMAIN_OR_IP "127.0.0.1"; + set $PROXY_TO_PORT 2077; + } + if ($host ~* "^(cpcalendars|cpcontacts)\.") { + set $PROXY_DOMAIN_OR_IP "127.0.0.1"; + set $PROXY_TO_PORT 2079; + } + + # Set custom rules like domain/IP exclusions or redirects here + include custom_rules; + # Includes for Nginx Bad Bot Blocker + include /etc/nginx/bots.d/blockbots.conf; + include /etc/nginx/bots.d/ddos.conf; + + location / { + try_files $uri $uri/ @backend; + } + + location @backend { + include proxy_params_common; + # === MICRO CACHING === + # Comment the following line to disable 1 second micro-caching for dynamic HTML content + include proxy_params_dynamic; + } + + # Enable browser cache for static content files (TTL is 1 hour) + location ~* \.(?:json|xml|rss|atom)$ { + include proxy_params_common; + include proxy_params_static; + expires 1h; + } + + # Enable browser cache for CSS / JS (TTL is 30 days) + location ~* \.(?:css|js)$ { + include proxy_params_common; + include proxy_params_static; + expires 30d; + } + + # Enable browser cache for images (TTL is 60 days) + location ~* \.(?:ico|jpg|jpeg|gif|png|webp)$ { + include proxy_params_common; + include proxy_params_static; + expires 60d; + } + + # Enable browser cache for archives, documents & media files (TTL is 60 days) + location ~* \.(?:3gp|7z|avi|bmp|bz2|csv|divx|doc|docx|eot|exe|flac|flv|gz|less|mid|midi|mka|mkv|mov|mp3|mp4|mpeg|mpg|odp|ods|odt|ogg|ogm|ogv|opus|pdf|ppt|pptx|rar|rtf|swf|tar|tbz|tgz|tiff|txz|wav|webm|wma|wmv|xls|xlsx|xz|zip)$ { + set $CACHE_BYPASS_FOR_STATIC 1; + include proxy_params_common; + include proxy_params_static; + expires 60d; + } + + # Enable browser cache for fonts & fix @font-face cross-domain restriction (TTL is 60 days) + location ~* \.(eot|ttf|otf|woff|woff2|svg|svgz)$ { + include proxy_params_common; + include proxy_params_static; + expires 60d; + add_header Access-Control-Allow-Origin *; + } + + # Prevent logging of favicon and robot request errors + location = /favicon.ico { + include proxy_params_common; + include proxy_params_static; + expires 60d; + log_not_found off; + } + + location = /robots.txt { + include proxy_params_common; + include proxy_params_static; + expires 1d; + log_not_found off; + } + + location = /nginx_status { + stub_status; + access_log off; + log_not_found off; + # Uncomment the following 2 lines to make the Nginx status page private. + # If you do this and you have Munin installed, graphs for Nginx will stop working. + #allow 127.0.0.1; + #deny all; + } + + location = /whm-server-status { + proxy_pass http://127.0.0.1:8080; + # Comment the following 2 lines to make the Apache status page public + allow 127.0.0.1; + deny all; + } + + # Deny access to files like .htaccess or .htpasswd + location ~ /\.ht { + deny all; + } + +} diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/conf.d/default_https.conf b/Engintron_for_cPanel_WHM_Configuration_Example/conf.d/default_https.conf new file mode 100755 index 000000000..f29842088 --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/conf.d/default_https.conf @@ -0,0 +1,53 @@ + +# Default definition block for HTTPS (Generated on 2017.04.15 23:47:42) # +server { + + listen 443 ssl http2 default_server; + #listen [::]:443 ipv6only=on ssl http2 default_server; + server_name localhost; + + # deny all; # DO NOT REMOVE OR CHANGE THIS LINE - Used when Engintron is disabled to block Nginx from becoming an open proxy + + ssl_certificate /var/cpanel/ssl/cpanel/mycpanel.pem; + ssl_certificate_key /var/cpanel/ssl/cpanel/mycpanel.pem; + + include common_https.conf; + # Includes for Nginx Bad Bot Blocker + include /etc/nginx/bots.d/blockbots.conf; + include /etc/nginx/bots.d/ddos.conf; + + location = /nginx_status { + stub_status; + access_log off; + log_not_found off; + # Uncomment the following 2 lines to make the Nginx status page private. + # If you do this and you have Munin installed, graphs for Nginx will stop working. + #allow 127.0.0.1; + #deny all; + } + + location = /whm-server-status { + proxy_pass http://127.0.0.1:8080; + # Comment the following 2 lines to make the Apache status page public + allow 127.0.0.1; + deny all; + } + +} + +# Definition block for domain(s): yourwebsite.com www.yourwebsite.com # +server { + listen 443 ssl http2; + #listen [::]:443 ipv6only=on ssl http2; + server_name yourwebsite.com www.yourwebsite.com; + # deny all; # DO NOT REMOVE OR CHANGE THIS LINE - Used when Engintron is disabled to block Nginx from becoming an open proxy + ssl_certificate /etc/ssl/engintron/???.crt; + ssl_certificate_key /var/cpanel/ssl/installed/keys/???.key; + + include common_https.conf; + # Includes for Nginx Bad Bot Blocker + include /etc/nginx/bots.d/blockbots.conf; + include /etc/nginx/bots.d/ddos.conf; + +} + diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/conf.d/globalblacklist.conf b/Engintron_for_cPanel_WHM_Configuration_Example/conf.d/globalblacklist.conf new file mode 100755 index 000000000..f85b07ddf --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/conf.d/globalblacklist.conf @@ -0,0 +1,5105 @@ +### ********************************** +### THE ULTIMATE NGINX BAD BOT BLOCKER +### ********************************** + +### Version 2.2017.05 + +### This file implements a checklist / blacklist for good user agents, bad user agents and +### bad referrers. It also has whitelisting for your own IP's and known good IP Ranges +### and also has rate limiting functionality for bad bots who you only want to rate limit +### and not actually block out entirely. It is powerful and also flexible. + +### Created By: https://github.com/mitchellkrogza/ +### Copyright Mitchell Krog - + +### Originally Inspired By: +### - https://github.com/mariusv/nginx-badbot-blocker +### - https://github.com/oohnoitz/nginx-blacklist + +### Last Updated +### Mon Apr 17 10:02:09 SAST 2017 +### End Last Updated + +### Generated in +### 0.312251091003 seconds +### End Generated in + +### Tested on: nginx/1.10.0 (Ubuntu 16.04) + +### This list was developed and is in use on a live Nginx server running some very busy web sites. +### It was built from the ground up using real data from daily logs and is updated almost daily. +### It has been extensively tested for false positives and all additions to the lists of bad user agents, +### spam referers, rogue IP address, scanners, scrapers and domain hijacking sites are extensively checked +### before they are added. It is monitored extensively for any false positives. + +### ********* +### Features: +### ********* +### Clear formatting for Ease of Maintenance. +### Alphabetically ordered lists for Ease of Maintenance. +### Extensive Commenting for Ease of Reference. +### Extensive bad_bot list +### Extensive bad_referer list (please excuse the nasty words and domains) +### Simple regex patterns versus complicated messy regex patterns. +### Checks regardless of http / https urls or the lack of any protocol sent. +### IP range blocking / whitelisting. +### Rate Limiting Functions. + +### *** PLEASE READ ALL INLINE NOTES ON TESTING !!!! + +### I have this set up as an include in nginx.conf as +### Include /etc/nginx/conf.d/globalblacklist.conf +### This is loaded and available for any vhost to use in its config +### Each vhost then just needs the include file mentioned below for it to take effect. + +### In Most cases your nginx.conf should already have an include statement as follows +### Include /etc/nginx/conf.d/* +### If that is the case then you can ignore the above include statement as Nginx will +### load anything in the conf.d folder and make it available to all sites. + +### All you then need to do is use the include statements below in the server {} block of a vhost file for it to take effect. +# server { +# #Config stuff here +# include /etc/nginx/bots.d/blockbots.conf +# include /etc/nginx/bots.d/ddos.conf +# #Other config stuff here +# } + +### Need I say, please don't just copy and paste this without reviewing what bots and +### referers are being blocked, you may want to exclude certain of them +### Also make SURE to whitelist your own IP's in the geo $bad_referer section. +### Know why you are using this or why you want to use it before you do, the implications +### are quite severe. + +### *** PLEASE READ INLINE NOTES ON TESTING !!!! + +### Note that: +### 0 = allowed - no limits +### 1 = allowed or rate limited less restrictive +### 2 = rate limited more +### 3 = block completely + +### NEED I say do a "sudo nginx -t" to test the config is okay after adding these +### and if so then "sudo service nginx reload" for it to take effect. + +### *** MAKE SURE TO ADD to your nginx.conf *** +### server_names_hash_bucket_size 64; +### server_names_hash_max_size 4096; +### limit_req_zone $binary_remote_addr zone=flood:50m rate=90r/s; +### limit_conn_zone $binary_remote_addr zone=addr:50m; +### to allow it to load this large set of domains into memory and to set the rate limiting zones for the DDOS filter. + +### ADDING YOUR OWN BAD REFERERS +### Fork your own local copy and then +### Send a Pull Request by following the instructions in the Pull_Requests_Here_Please folder. + + +# ********************************* +# FIRST BLOCK BY USER-AGENT STRINGS +# ********************************* + +# *************** +# PLEASE TEST !!! +# *************** + +# ALWAYS test any User-Agent Strings you add here to make sure you have it right +# Use a Chrome Extension called "User-Agent Switcher for Chrome" where you can create your +# own custom lists of User-Agents and test them easily against your rules below. + +# You can also use Curl to test user-agents as per example below +# curl -I http://www.yourdomain.com -A "GoogleBot" << 200 OK +# curl -I http://www.yourdomain.com -A "80legs" <<< 444 Dropped Connection + +# Here we also allow specific User Agents to come through that we want to allow + +# PLEASE NOTE: In all lists below I use Nginx case-insensitive matching ~* +# This means regardless of how you type the word, upper or lowercase or mixed it will +# be detected by Nginx Regex. Some Names are Capitalised simply for Ease of Reading. +# Especially important for both Googlebot and googlebot to be allowed through no? + +# Now we map all good and bad user agents to a variable called $bad_bot + +map $http_user_agent $bad_bot { + + default 0; + +# *********************************************** +# Allow Good User-Agent Strings We Know and Trust +# *********************************************** + +# START GOOD BOTS ### DO NOT EDIT THIS LINE AT ALL ### + "~*adidxbot" 0; + "~*AdsBot-Google" 0; + "~*aolbuild" 0; + "~*bingbot" 0; + "~*bingpreview" 0; + "~*DoCoMo" 0; + "~*duckduckgo" 0; + "~*facebookexternalhit" 0; + "~*Feedfetcher-Google" 0; + "~*Googlebot" 0; + "~*Googlebot-Image" 0; + "~*Googlebot-Mobile" 0; + "~*Googlebot-News" 0; + "~*Googlebot/Test" 0; + "~*Googlebot-Video" 0; + "~*Google-HTTP-Java-Client" 0; + "~*gsa-crawler" 0; + "~*Jakarta\ Commons" 0; + "~*Kraken/0.1" 0; + "~*LinkedInBot" 0; + "~*Mediapartners-Google" 0; + "~*msnbot" 0; + "~*msnbot-media" 0; + "~*SAMSUNG" 0; + "~*slurp" 0; + "~*teoma" 0; + "~*TwitterBot" 0; + "~*Wordpress" 0; + "~*yahoo" 0; +# END GOOD BOTS ### DO NOT EDIT THIS LINE AT ALL ### + +# ************************************************** +# User-Agent Strings Allowed Throug but Rate Limited +# ************************************************** +# Some people block libwww-perl, it us widely used in many valid (non rogue) agents +# I allow libwww-perl as I use it for monitoring systems with Munin but it is rate limited + +# START ALLOWED BOTS ### DO NOT EDIT THIS LINE AT ALL ### + "~*jetmon" 1; + "~*libwww-perl" 1; + "~*Lynx" 1; + "~*munin" 1; + "~*Wget/1.15" 1; + "~*WordPress" 1; +# END ALLOWED BOTS ### DO NOT EDIT THIS LINE AT ALL ### + +# ************************************************************** +# Rate Limited User-Agents who get a bit aggressive on bandwidth +# ************************************************************** + +# START LIMITED BOTS ### DO NOT EDIT THIS LINE AT ALL ### + "~*Alexa" 2; + "~*archive.org" 2; + "~*Baidu" 2; + "~*FlipboardProxy" 2; + "~*ia_archiver" 2; + "~*Mozilla/4.0" 2; + "~*MSIE\ 7.0" 2; + "~*Presto" 2; + "~*R6_CommentReader" 2; + "~*R6_FeedFetcher" 2; + "~*RPT-HTTPClient" 2; + "~*sfFeedReader/0.9" 2; + "~*Spaidu" 2; + "~*UptimeRobot/2.0" 2; + "~*YandexBot" 2; + "~*YandexImages" 2; +# END LIMITED BOTS ### DO NOT EDIT THIS LINE AT ALL ### + +# ********************************************* +# Bad User-Agent Strings That We Block Outright +# ********************************************* +# This includes: +# Known Vulnerability Scanners (now merged into one section) + +# *********************************************** +# Include your Own Custom List of Bad User Agents +# *********************************************** + +# START BLACKLISTED USER AGENTS ### DO NOT EDIT THIS LINE AT ALL ### + include /etc/nginx/bots.d/blacklist-user-agents.conf; +# END BLACKLISTED USER AGENTS ### DO NOT EDIT THIS LINE AT ALL ### + +# START BAD BOTS ### DO NOT EDIT THIS LINE AT ALL ### + "~*360Spider" 3; + "~*80legs" 3; + "~*Abonti" 3; + "~*Aboundex" 3; + "~*Acunetix" 3; + "~*AhrefsBot" 3; + "~*AIBOT" 3; + "~*AiHitBot" 3; + "~*Aipbot" 3; + "~*Alexibot" 3; + "~*Alligator" 3; + "~*AllSubmitter" 3; + "~*Anarchie" 3; + "~*Apexoo" 3; + "~*ASPSeek" 3; + "~*Asterias" 3; + "~*Attach" 3; + "~*autoemailspider" 3; + "~*BackDoorBot" 3; + "~*BackStreet" 3; + "~*BackWeb" 3; + "~*Badass" 3; + "~*Bandit" 3; + "~*BatchFTP" 3; + "~*Battleztar\ Bazinga" 3; + "~*BBBike" 3; + "~*BDFetch" 3; + "~*BetaBot" 3; + "~*Bigfoot" 3; + "~*Bitacle" 3; + "~*Black\ Hole" 3; + "~*BlackWidow" 3; + "~*BLEXBot" 3; + "~*Blow" 3; + "~*BlowFish" 3; + "~*Boardreader" 3; + "~*Bolt" 3; + "~*BotALot" 3; + "~*Brandprotect" 3; + "~*Brandwatch" 3; + "~*Bubing" 3; + "~*Buddy" 3; + "~*BuiltBotTough" 3; + "~*BuiltWith" 3; + "~*Bullseye" 3; + "~*BunnySlippers" 3; + "~*BuzzSumo" 3; + "~*Calculon" 3; + "~*CazoodleBot" 3; + "~*CCBot" 3; + "~*Cegbfeieh" 3; + "~*CheeseBot" 3; + "~*CherryPicker" 3; + "~*ChinaClaw" 3; + "~*Chlooe" 3; + "~*Claritybot" 3; + "~*Cliqzbot" 3; + "~*Cogentbot" 3; + "~*Collector" 3; + "~*Copier" 3; + "~*CopyRightCheck" 3; + "~*Copyscape" 3; + "~*Cosmos" 3; + "~*Craftbot" 3; + "~*CrazyWebCrawler" 3; + "~*Crescent" 3; + "~*CSHttp" 3; + "~*Curious" 3; + "~*Custo" 3; + "~*DBLBot" 3; + "~*Demon" 3; + "~*Deusu" 3; + "~*Devil" 3; + "~*DIIbot" 3; + "~*Dirbuster" 3; + "~*Disco" 3; + "~*Discobot" 3; + "~*Discoverybot" 3; + "~*DittoSpyder" 3; + "~*DomainAppender" 3; + "~*DomainSigmaCrawler" 3; + "~*Dotbot" 3; + "~*Download\ Demon" 3; + "~*Download\ Devil" 3; + "~*Download\ Wonder" 3; + "~*Dragonfly" 3; + "~*Drip" 3; + "~*DTS\ Agent" 3; + "~*EasyDL" 3; + "~*Ebingbong" 3; + "~*eCatch" 3; + "~*ECCP/1.0" 3; + "~*Ecxi" 3; + "~*EirGrabber" 3; + "~*EMail\ Collector" 3; + "~*EMail\ Extractor" 3; + "~*EMail\ Siphon" 3; + "~*EMail\ Wolf" 3; + "~*EroCrawler" 3; + "~*Evil" 3; + "~*Exabot" 3; + "~*Express\ WebPictures" 3; + "~*Extractor" 3; + "~*ExtractorPro" 3; + "~*EyeNetIE" 3; + "~*Ezooms" 3; + "~*FHscan" 3; + "~*Fimap" 3; + "~*Findxbot" 3; + "~*Firefox/7.0" 3; + "~*FlashGet" 3; + "~*Flunky" 3; + "~*Foobot" 3; + "~*Freeuploader" 3; + "~*FrontPage" 3; + "~*GalaxyBot" 3; + "~*Genieo" 3; + "~*Getintent" 3; + "~*GetRight" 3; + "~*GetWeb" 3; + "~*Gigablast" 3; + "~*Gigabot" 3; + "~*Go-Ahead-Got-It" 3; + "~*Gotit" 3; + "~*GoZilla" 3; + "~*Go!Zilla" 3; + "~*Grabber" 3; + "~*GrabNet" 3; + "~*Grafula" 3; + "~*GrapeFX" 3; + "~*GrapeshotCrawler" 3; + "~*GridBot" 3; + "~*GT::WWW" 3; + "~*GuzzleHttp" 3; + "~*HaosouSpider" 3; + "~*Harvest" 3; + "~*Havij" 3; + "~*Heritrix" 3; + "~*Hloader" 3; + "~*HMView" 3; + "~*HTMLparser" 3; + "~*HTTP::Lite" 3; + "~*HTTrack" 3; + "~*Humanlinks" 3; + "~*Iblog" 3; + "~*IDBot" 3; + "~*Id-search" 3; + "~*IlseBot" 3; + "~*Image\ Fetch" 3; + "~*Image\ Stripper" 3; + "~*Image\ Sucker" 3; + "~*Indy\ Library" 3; + "~*InfoNaviRobot" 3; + "~*InfoTekies" 3; + "~*Intelliseek" 3; + "~*InterGET" 3; + "~*Internet\ Ninja" 3; + "~*InternetSeer" 3; + "~*internetVista\ monitor" 3; + "~*Iria" 3; + "~*IRLbot" 3; + "~*Iskanie" 3; + "~*JamesBOT" 3; + "~*Jbrofuzz" 3; + "~*JennyBot" 3; + "~*JetCar" 3; + "~*JikeSpider" 3; + "~*JOC\ Web\ Spider" 3; + "~*Joomla" 3; + "~*JustView" 3; + "~*Jyxobot" 3; + "~*Kenjin\ Spider" 3; + "~*Keyword\ Density" 3; + "~*Kraken" 3; + "~*Lanshanbot" 3; + "~*Larbin" 3; + "~*LeechFTP" 3; + "~*LeechGet" 3; + "~*LexiBot" 3; + "~*Lftp" 3; + "~*LibWeb" 3; + "~*Libwhisker" 3; + "~*Lightspeedsystems" 3; + "~*Likse" 3; + "~*Linkdexbot" 3; + "~*LinkextractorPro" 3; + "~*LinkpadBot" 3; + "~*LinkScan" 3; + "~*LinksManager" 3; + "~*LinkWalker" 3; + "~*LinqiaMetadataDownloaderBot" 3; + "~*LinqiaRSSBot" 3; + "~*LinqiaScrapeBot" 3; + "~*Lipperhey" 3; + "~*Litemage_walker" 3; + "~*Lmspider" 3; + "~*LNSpiderguy" 3; + "~*Ltx71" 3; + "~*lwp-request" 3; + "~*LWP::Simple" 3; + "~*lwp-trivial" 3; + "~*Magnet" 3; + "~*Mag-Net" 3; + "~*magpie-crawler" 3; + "~*Mail.ru" 3; + "~*Majestic12" 3; + "~*MarkMonitor" 3; + "~*MarkWatch" 3; + "~*Masscan" 3; + "~*Mass\ Downloader" 3; + "~*Mata\ Hari" 3; + "~*Meanpathbot" 3; + "~*MegaIndex.ru" 3; + "~*Metauri" 3; + "~*MFC_Tear_Sample" 3; + "~*Microsoft\ Data\ Access" 3; + "~*Microsoft\ URL\ Control" 3; + "~*MIDown\ tool" 3; + "~*MIIxpc" 3; + "~*Mister\ PiX" 3; + "~*MJ12bot" 3; + "~*Mojeek" 3; + "~*MSFrontPage" 3; + "~*MSIE\ 6.0" 3; + "~*MSIECrawler" 3; + "~*Msrabot" 3; + "~*MS\ Web\ Services\ Client\ Protocol" 3; + "~*Musobot" 3; + "~*Name\ Intelligence" 3; + "~*Nameprotect" 3; + "~*Navroad" 3; + "~*NearSite" 3; + "~*Needle" 3; + "~*Nessus" 3; + "~*NetAnts" 3; + "~*Netcraft" 3; + "~*netEstate\ NE\ Crawler" 3; + "~*NetLyzer" 3; + "~*NetMechanic" 3; + "~*NetSpider" 3; + "~*Nettrack" 3; + "~*Net\ Vampire" 3; + "~*NetZIP" 3; + "~*NextGenSearchBot" 3; + "~*Nibbler" 3; + "~*NICErsPRO" 3; + "~*Niki-bot" 3; + "~*Nikto" 3; + "~*NimbleCrawler" 3; + "~*Ninja" 3; + "~*Nmap" 3; + "~*NPbot" 3; + "~*Nutch" 3; + "~*Octopus" 3; + "~*Offline\ Explorer" 3; + "~*Offline\ Navigator" 3; + "~*Openfind" 3; + "~*OpenLinkProfiler" 3; + "~*Openvas" 3; + "~*OrangeBot" 3; + "~*OrangeSpider" 3; + "~*OutfoxBot" 3; + "~*PageAnalyzer" 3; + "~*Page\ Analyzer" 3; + "~*PageGrabber" 3; + "~*Page\ Grabber" 3; + "~*page\ scorer" 3; + "~*PageScorer" 3; + "~*Panscient" 3; + "~*Papa\ Foto" 3; + "~*Pavuk" 3; + "~*pcBrowser" 3; + "~*PECL::HTTP" 3; + "~*PeoplePal" 3; + "~*PHPCrawl" 3; + "~*Picscout" 3; + "~*Picsearch" 3; + "~*Pimonster" 3; + "~*Pi-Monster" 3; + "~*Pixray" 3; + "~*PleaseCrawl" 3; + "~*Pockey" 3; + "~*POE-Component-Client-HTTP" 3; + "~*Probethenet" 3; + "~*ProPowerBot" 3; + "~*ProWebWalker" 3; + "~*Proximic" 3; + "~*Psbot" 3; + "~*Pump" 3; + "~*PyCurl" 3; + "~*QueryN\ Metasearch" 3; + "~*Qwantify" 3; + "~*RankActiveLinkBot" 3; + "~*Rankivabot" 3; + "~*RealDownload" 3; + "~*Reaper" 3; + "~*Recorder" 3; + "~*RedesScrapy" 3; + "~*ReGet" 3; + "~*RepoMonkey" 3; + "~*Ripper" 3; + "~*RocketCrawler" 3; + "~*Rogerbot" 3; + "~*SBIder" 3; + "~*ScanAlert" 3; + "~*Scanbot" 3; + "~*Scrapy" 3; + "~*Screaming\ Frog\ SEO\ Spider" 3; + "~*ScreenerBot" 3; + "~*Searchestate" 3; + "~*SearchmetricsBot" 3; + "~*Semrush" 3; + "~*SemrushBot" 3; + "~*SEOkicks" 3; + "~*SEOkicks-Robot" 3; + "~*SEOlyticsCrawler" 3; + "~*Seomoz" 3; + "~*SEOprofiler" 3; + "~*SEOstats" 3; + "~*SeznamBot" 3; + "~*Siphon" 3; + "~*SISTRIX" 3; + "~*SISTRIX\ Crawler" 3; + "~*Sitebeam" 3; + "~*SiteExplorer" 3; + "~*Siteimprove" 3; + "~*SiteLockSpider" 3; + "~*SiteSnagger" 3; + "~*SiteSucker" 3; + "~*Site\ Sucker" 3; + "~*Sitevigil" 3; + "~*Slackbot-LinkExpanding" 3; + "~*SlySearch" 3; + "~*SmartDownload" 3; + "~*Snake" 3; + "~*Snapbot" 3; + "~*Snoopy" 3; + "~*SocialRankIOBot" 3; + "~*Sogou\ web\ spider" 3; + "~*Sosospider" 3; + "~*SpaceBison" 3; + "~*Spammen" 3; + "~*SpankBot" 3; + "~*Spanner" 3; + "~*Spbot" 3; + "~*Spinn3r" 3; + "~*SputnikBot" 3; + "~*Sqlmap" 3; + "~*Sqlworm" 3; + "~*Sqworm" 3; + "~*Steeler" 3; + "~*Stripper" 3; + "~*Sucker" 3; + "~*Sucuri" 3; + "~*SuperBot" 3; + "~*SuperHTTP" 3; + "~*Surfbot" 3; + "~*SurveyBot" 3; + "~*Suzuran" 3; + "~*Swiftbot" 3; + "~*Szukacz" 3; + "~*T0PHackTeam" 3; + "~*T8Abot" 3; + "~*tAkeOut" 3; + "~*Teleport" 3; + "~*TeleportPro" 3; + "~*Telesoft" 3; + "~*Telesphoreo" 3; + "~*Telesphorep" 3; + "~*The\ Intraformant" 3; + "~*TheNomad" 3; + "~*TightTwatBot" 3; + "~*Titan" 3; + "~*Toata" 3; + "~*Toweyabot" 3; + "~*Trendictionbot" 3; + "~*True_Robot" 3; + "~*Turingos" 3; + "~*TurnitinBot" 3; + "~*Turnitin\ Bot" 3; + "~*Turnitin\ Robot" 3; + "~*TwengaBot" 3; + "~*Twice" 3; + "~*Typhoeus" 3; + "~*URLy.Warning" 3; + "~*URLy\ Warning" 3; + "~*Vacuum" 3; + "~*Vagabondo" 3; + "~*VB\ Project" 3; + "~*VCI" 3; + "~*VeriCiteCrawler" 3; + "~*VidibleScraper" 3; + "~*VoidEYE" 3; + "~*Voil" 3; + "~*Voltron" 3; + "~*WallpapersHD" 3; + "~*WASALive-Bot" 3; + "~*WBSearchBot" 3; + "~*Webalta" 3; + "~*WebAuto" 3; + "~*Web\ Auto" 3; + "~*WebBandit" 3; + "~*Web\ Bandit" 3; + "~*WebCollage" 3; + "~*Web\ Collage" 3; + "~*WebCopier" 3; + "~*Web\ Copier" 3; + "~*WEBDAV" 3; + "~*WEBDAV\ Client" 3; + "~*WebEnhancer" 3; + "~*Web\ Enhancer" 3; + "~*WebFetch" 3; + "~*Web\ Fetch" 3; + "~*WebFuck" 3; + "~*Web\ Fuck" 3; + "~*WebGo\ IS" 3; + "~*WebImageCollector" 3; + "~*Web\ Image\ Collector" 3; + "~*WebLeacher" 3; + "~*WebmasterWorldForumBot" 3; + "~*webmeup-crawler" 3; + "~*WebPix" 3; + "~*Web\ Pix" 3; + "~*WebReaper" 3; + "~*Web\ Reaper" 3; + "~*WebSauger" 3; + "~*Web\ Sauger" 3; + "~*Webshag" 3; + "~*WebsiteExtractor" 3; + "~*Website\ Extractor" 3; + "~*WebsiteQuester" 3; + "~*Website\ Quester" 3; + "~*Webster" 3; + "~*WebStripper" 3; + "~*Web\ Stripper" 3; + "~*WebSucker" 3; + "~*Web\ Sucker" 3; + "~*WebWhacker" 3; + "~*Web\ Whacker" 3; + "~*WebZIP" 3; + "~*WeSEE" 3; + "~*Whack" 3; + "~*Whacker" 3; + "~*Whatweb" 3; + "~*Widow" 3; + "~*WinHTTrack" 3; + "~*WiseGuys\ Robot" 3; + "~*WISENutbot" 3; + "~*Wonderbot" 3; + "~*Woobot" 3; + "~*Wotbox" 3; + "~*Wprecon" 3; + "~*WPScan" 3; + "~*WWW-Collector-E" 3; + "~*WWW-Mechanize" 3; + "~*WWW::Mechanize" 3; + "~*WWWOFFLE" 3; + "~*Xaldon_WebSpider" 3; + "~*Xaldon\ WebSpider" 3; + "~*Xenu" 3; + "~*Y!J-ASR" 3; + "~*YoudaoBot" 3; + "~*Zade" 3; + "~*Zermelo" 3; + "~*Zeus" 3; + "~*Zgrab" 3; + "~*Zitebot" 3; + "~*ZmEu" 3; + "~*ZumBot" 3; + "~*ZyBorg" 3; +# END BAD BOTS ### DO NOT EDIT THIS LINE AT ALL ### +} + + +# **************************************** +# SECOND BLOCK BY REFERER STRINGS AND URLS +# **************************************** + +# Add here all referrer words and URL's that are to blocked. + +# ***************** +# PLEASE TEST !!!! +# ***************** + +# ALWAYS test referers that you add. This is done manually as follows + +# curl -I http://www.yourdomain.com -e http://anything.adcash.com +# curl -I http://www.yourdomain.com -e http://www.goodwebsite.com/not-adcash +# curl -I http://www.yourdomain.com -e http://www.betterwebsite.com/not/adcash + +# This uses curl to send the referer string to your site and you should see an immediate +# 403 Forbidden Error or No Response at all if you use the 444 error like I do. + +# Because of case-insensitive matching any combination of capitilization in the names +# will all produce a positive hit - make sure you always test thoroughly and monitor logs +# This also does NOT check for a preceding www. nor does it check for it ending in .com +# .net .org or any long string attached at the end. It also does not care if the referer +# was sent with http https or even ftp. + +# REAL WORLD EXAMPLE +# ******************* +# If you were a photographer like me and say took a photo of a "girl" and you then posted +# a blog showing everyone your new photo and your blog slug / permalink was +# http://www.mysite.com/blog/photo-of-girl/ +# You can go and monitor your logs and you will see lots of 444 from other pages on your +# site that have been clicked on sending that page as a referer so in the example below +# you will generate a 403 error. + +# curl --referer http://www.mysite.com/blog/photo-of-girl/ http://www.mysite.com/ + +# So please be careful with these and think carefully before you add new words. +# Remember we are trying to keep out the general riff-raff not kill your web sites. + +# ********************************************************************** +# Now we map all bad referer words below to a variable called $bad_words +# ********************************************************************** + +map $http_referer $bad_words { + default 0; + +# ************************ +# Bad Referer Single Words +# ************************ +# These are Words and Terms often found tagged onto domains or within url query strings. + +# START BAD REFERER WORDS ### DO NOT EDIT THIS LINE AT ALL ### + "~*adultgalls" 1; + "~*advair" 1; + "~*allegra" 1; + "~*allopurinol" 1; + "~*amantadine" 1; + "~*amateurxpass" 1; + "~*ambien" 1; + "~*amitriptyline" 1; + "~*amoxicillin" 1; + "~*anafranil" 1; + "~*asshole" 1; + "~*atenolol" 1; + "~*avalide" 1; + "~*baccarat" 1; + "~*beastiality" 1; + "~*bestiality" 1; + "~*bigblackbooty" 1; + "~*bithack" 1; + "~*blackjack" 1; + "~*blacktits" 1; + "~*blogincome" 1; + "~*blowjob" 1; + "~*bontril" 1; + "~*camgirls" 1; + "~*cephalexin" 1; + "~*cialis" 1; + "~*cookie-law-enforcement" 1; + "~*cunt" 1; + "~*dapoxetine" 1; + "~*diclofenac" 1; + "~*dildos" 1; + "~*effexor" 1; + "~*fluoxetine" 1; + "~*free-share-buttons" 1; + "~*free-social-buttons" 1; + "~*fuck" 1; + "~*fuck-paid-share-buttons" 1; + "~*gaygalls" 1; + "~*gaysex" 1; + "~*getamateurs" 1; + "~*glucophage" 1; + "~*holdem" 1; + "~*hold-em" 1; + "~*hydrochlorothiazide" 1; + "~*iconsurf" 1; + "~*ilovevitaly" 1; + "~*incest" 1; + "~*internetsupervision" 1; + "~*law-enforcement-bot" 1; + "~*law-enforcement-check" 1; + "~*lesbian" 1; + "~*levitra" 1; + "~*lipitor" 1; + "~*livesex" 1; + "~*makemoneyonline" 1; + "~*make-money-online" 1; + "~*medikament" 1; + "~*monetisetrk" 1; + "~*myftpupload" 1; + "~*nudeceleb" 1; + "~*oralsex" 1; + "~*paxil" 1; + "~*phentermine" 1; + "~*prednisone" 1; + "~*pussy" 1; + "~*screentoolkit" 1; + "~*seoexperimenty" 1; + "~*share-buttons" 1; + "~*share-buttons-for-free" 1; + "~*skelaxin" 1; + "~*social-buttons-" 1; + "~*social-traffic-" 1; + "~*suhagra" 1; + "~*syntryx" 1; + "~*t0phackteam" 1; + "~*titten" 1; + "~*tramadol" 1; + "~*tramidol" 1; + "~*trazodone" 1; + "~*valtrex" 1; + "~*viagra" 1; + "~*vibrators" 1; + "~*vicodin" 1; + "~*vvakhrin-ws1" 1; + "~*webfuck" 1; + "~*whipme" 1; + "~*whipping" 1; + "~*xanax" 1; + "~*xxxrus" 1; + "~*zanax" 1; + "~*zeroredirect" 1; + "~*zestoretic" 1; + "~*zithromax" 1; + "~*zoloft" 1; +# END BAD REFERER WORDS ### DO NOT EDIT THIS LINE AT ALL ### +} + +# ************************ +# Bad Referer Domain Names +# ************************ + +# Now a list of bad referer urls these domains or any combination of them ie .com .net +# will be blocked out. Doesn't matter if the protocol is http, https or even ftp + +# This section includes: +# ********************** +# Blocking of SEO company Semalt.com (now merged into this one section) +# MIRAI Botnet Domains Used for Mass Attacks +# Other known bad SEO companies and Ad Hijacking Sites +# Sites linked to malware, adware and ransomware + +# ***************** +# PLEASE TEST !!!! +# ***************** + +# ALWAYS test referers that you add. This is done manually as follows + +# curl -I http://www.yourdomain.com -e http://8gold.com + +# This uses curl to send the referer string to your site and you should see an immediate +# 403 Forbidden Error or No Response at all if you use the 444 error like I do. + +# Because of case-insensitive matching any combination of capitilization +# will all produce a positive hit - make sure you always test. + +# curl -I http://www.yourdomain.com -e http://NOT-8gold.com +# curl -I http://www.yourdomain.com -e http://this.is.not8gOlD.net +# curl -I http://www.yourdomain.com -e ftp://8gold.com +# curl -I http://www.yourdomain.com -e ftp://www.weare8gold.NET +# curl -I http://www.yourdomain.com -e https://subdomain.8gold.com +# curl -I http://www.yourdomain.com -e https://NOT8GolD.org + +# This works exactly like the bad referer word lists above and is very strict !!! +# I have gone for the simple stricter approach which blocks all variants for those +# who just hop out and but another domain name. + +# So if you see a bad referer from wearegoogle.com and you want to block them just add +# them as "~*wearegoogle.com" don't ever go and do something like "~*google(-|.)" you will +# kill all your SEO in a week. Rather also send a Pull Request by following the instructions +# in the Pull_Requests_Here_Please folder. + +# I also include any sites that hotlink images from my sites into the list below. +# There are hundreds of image stealing sites out there so this list WILL grow now doubt. + + +# *********************************************************************** +# Now we map all good & bad referer urls to variable called #bad_referer +# *********************************************************************** + +map $http_referer $bad_referer { + hostnames; + default 0; + +# ************************************ +# GOOD REFERERS - Spared from Checking +# ************************************ + +# Add your own domain names here to spare them from referer checking (one per line) + # Use the new include file method so any further updates will no longer require you to + # have to keep putting your whitelisted domains here when updating. + +# START WHITELISTED DOMAINS ### DO NOT EDIT THIS LINE AT ALL ### + include /etc/nginx/bots.d/whitelist-domains.conf; +# END WHITELISTED DOMAINS ### DO NOT EDIT THIS LINE AT ALL ### + +# START BAD REFERERS ### DO NOT EDIT THIS LINE AT ALL ### + "~*000free.us" 1; + "~*007angels.com" 1; + "~*00author.com" 1; + "~*00go.com" 1; + "~*00it.com" 1; + "~*00webcams.com" 1; + "~*0n-line.tv" 1; + "~*100dollars-seo.com" 1; + "~*101billion.com" 1; + "~*101flag.ru" 1; + "~*101imagedatabase.com" 1; + "~*101lesbian.xyz" 1; + "~*101raccoon.ru" 1; + "~*108shot.com" 1; + "~*10bet.com" 1; + "~*11235813.webzdarma.cz" 1; + "~*11pikachu.ru" 1; + "~*123any.com" 1; + "~*123cha.com" 1; + "~*123kuma.com" 1; + "~*123locker.com" 1; + "~*12bet.com" 1; + "~*12masterov.com" 1; + "~*1314dh.com" 1; + "~*160117rd.xyz" 1; + "~*178evakuator178.ru" 1; + "~*1-99seo.com" 1; + "~*1adult.com" 1; + "~*1bet.com" 1; + "~*1-free-share-buttons.com" 1; + "~*1hwy.com" 1; + "~*1kinobig.ru" 1; + "~*1millionusd.xyz" 1; + "~*1pamm.ru" 1; + "~*1stat.ru" 1; + "~*2015god.org" 1; + "~*202ch.com" 1; + "~*20pascals.nl" 1; + "~*214jaluwobapef.cf" 1; + "~*24videos.tv" 1; + "~*24x7-server-support.site" 1; + "~*256bit.by" 1; + "~*273-fz.ru" 1; + "~*28n2gl3wfyb0.ru" 1; + "~*2ads.co.uk" 1; + "~*2drittel.de" 1; + "~*2itech.ru" 1; + "~*2kata.ru" 1; + "~*2nt.ru" 1; + "~*300richmond.co.nz" 1; + "~*34.gs" 1; + "~*3dracergames.com" 1; + "~*3-letter-domains.net" 1; + "~*3rbseyes.com" 1; + "~*3weekdiet.com" 1; + "~*40cg.com" 1; + "~*45en.ru" 1; + "~*45tahunkhongguan.com" 1; + "~*4istoshop.com" 1; + "~*4kplayer.pl" 1; + "~*4pp13.com" 1; + "~*4rent.ru" 1; + "~*4replicawatch.net" 1; + "~*4ur.click" 1; + "~*4ureyesonly.com" 1; + "~*4webmasters.com" 1; + "~*5000-cotydzien.com" 1; + "~*51.la" 1; + "~*51unlim.ru" 1; + "~*57883.net" 1; + "~*5elementov.ru" 1; + "~*5forex.ru" 1; + "~*5i2.net" 1; + "~*5kstore.com" 1; + "~*5u.com" 1; + "~*6hopping.com" 1; + "~*72-news.com" 1; + "~*76brighton.co.uk" 1; + "~*7fon.ru" 1; + "~*7makemoneyonline.com" 1; + "~*7wind.ru" 1; + "~*7yue.org" 1; + "~*7zap.com" 1; + "~*8558l.jobs.net" 1; + "~*883zy.com" 1; + "~*888.com" 1; + "~*8gold.com" 1; + "~*8si.ru" 1; + "~*8xv8.com" 1; + "~*98oi.ru" 1; + "~*999webdesign.com" 1; + "~*9med.net" 1; + "~*a342ae9750004b14b55f7310eff0ab65.com" 1; + "~*aa08daf7e13b6345e09e92f771507fa5f4.com" 1; + "~*aa14ab57a3339c4064bd9ae6fad7495b5f.com" 1; + "~*aa625d84f1587749c1ab011d6f269f7d64.com" 1; + "~*aa81bf391151884adfa3dd677e41f94be1.com" 1; + "~*aa8780bb28a1de4eb5bff33c28a218a930.com" 1; + "~*aa8b68101d388c446389283820863176e7.com" 1; + "~*aa9bd78f328a6a41279d0fad0a88df1901.com" 1; + "~*aa9d046aab36af4ff182f097f840430d51.com" 1; + "~*aaa38852e886ac4af1a3cff9b47cab6272.com" 1; + "~*aab94f698f36684c5a852a2ef272e031bb.com" 1; + "~*aac500b7a15b2646968f6bd8c6305869d7.com" 1; + "~*aac52006ec82a24e08b665f4db2b5013f7.com" 1; + "~*aad1f4acb0a373420d9b0c4202d38d94fa.com" 1; + "~*aadroid.net" 1; + "~*aarbur.com" 1; + "~*abbanreddy.com" 1; + "~*abbp1.website" 1; + "~*abclauncher.com" 1; + "~*abctoppictures.net" 1; + "~*abc.xyz" 1; + "~*abiente.ru" 1; + "~*abovetherivernc.com" 1; + "~*absolute-s.ru" 1; + "~*abtasty.com" 1; + "~*abusora.com" 1; + "~*abwa.tk" 1; + "~*academia-nsk.org" 1; + "~*acads.net" 1; + "~*acc.eu.org" 1; + "~*acheterviagrafr24.com" 1; + "~*actionnooz.com" 1; + "~*actremage.com" 1; + "~*actulite.com" 1; + "~*adamoads.com" 1; + "~*adcash.com" 1; + "~*adclickservice.com" 1; + "~*adclickthru.net" 1; + "~*add-add.men" 1; + "~*addbin.men" 1; + "~*addblueoff.com.ua" 1; + "~*addray.pro" 1; + "~*addtoadd.men" 1; + "~*adelly.bg" 1; + "~*adf.ly" 1; + "~*adhome.biz" 1; + "~*adidas.frwebs.fr" 1; + "~*adimmix.com" 1; + "~*adktrailmap.com" 1; + "~*adloads.com" 1; + "~*adloads.net" 1; + "~*admanaerofoil.com" 1; + "~*adman.gr" 1; + "~*adman.se" 1; + "~*admatic.com.tr" 1; + "~*adminshop.com" 1; + "~*admitad.com" 1; + "~*adnotbad.com" 1; + "~*adpremium.org" 1; + "~*ads-cool.pro" 1; + "~*adserver-e7.com" 1; + "~*adsfresh.men" 1; + "~*ads.gold" 1; + "~*adsland.men" 1; + "~*ads-seo.men" 1; + "~*adtiger.tk" 1; + "~*adultactioncam.com" 1; + "~*adultfriendfinder.com" 1; + "~*adultfullhd.com" 1; + "~*adultgalls.com" 1; + "~*adultmeetonline.info" 1; + "~*adultnet.in" 1; + "~*adultwebhosting.info" 1; + "~*advancedcleaner.com" 1; + "~*advancedsoftwaresupport.com" 1; + "~*adventureparkcostarica.com" 1; + "~*advocatemsk.ru" 1; + "~*advokateg.ru" 1; + "~*adzpower.com" 1; + "~*aero2.ru" 1; + "~*aerogo.com" 1; + "~*affordablewebsitesandmobileapps.com" 1; + "~*afora.ru" 1; + "~*afslankpillen2017nl.eu" 1; + "~*agahinameh.com" 1; + "~*agardomains.com" 1; + "~*aghanyna.com" 1; + "~*agreda.pluto.ro" 1; + "~*agroeconom.kz" 1; + "~*ahrefs.com" 1; + "~*air-edem.ru" 1; + "~*airmaxshoes-2016.com" 1; + "~*akama.com" 1; + "~*aktivator-windows10.blogspot.com" 1; + "~*akuhni.by" 1; + "~*akusherok.ru" 1; + "~*akvamaster.dp.ua" 1; + "~*alarmobninsk.ru" 1; + "~*albamargroup.com" 1; + "~*alekseevec.ru" 1; + "~*alert-fdm.xyz" 1; + "~*alert-fjg.xyz" 1; + "~*alert-hgd.xyz" 1; + "~*alert-jdh.xyz" 1; + "~*alessandraleone.com" 1; + "~*alfa9.com" 1; + "~*alfa-img.com" 1; + "~*alfa-medosmotr.ru" 1; + "~*alfapro.ru" 1; + "~*alf-img.com" 1; + "~*alibestsale.com" 1; + "~*alienwheel.es" 1; + "~*alienwheels.de" 1; + "~*aliexpresscashback.club" 1; + "~*aliexpress.com" 1; + "~*alif-ba-ta.com" 1; + "~*alive-ua.com" 1; + "~*all4invest.info" 1; + "~*all4invest.ru" 1; + "~*allboard.xobor.de" 1; + "~*allcredits.su" 1; + "~*alldubai.biz" 1; + "~*allforminecraft.ru" 1; + "~*allknow.info" 1; + "~*allkrim.com" 1; + "~*allnews24.in" 1; + "~*allnews.md" 1; + "~*all-number.com" 1; + "~*alloysteel.ru" 1; + "~*allpdfmags.net" 1; + "~*allsilver925.co.il" 1; + "~*all-streaming-media.com" 1; + "~*alltheviews.com" 1; + "~*allwidewallpapers.com" 1; + "~*allwomen.info" 1; + "~*aloofly.com" 1; + "~*alot.com" 1; + "~*alphacarolinas.com" 1; + "~*alphaforum.ru" 1; + "~*alphahoverboards.com" 1; + "~*alpharma.net" 1; + "~*alveris.ru" 1; + "~*alyeskaresort.com" 1; + "~*am15.net" 1; + "~*amanda-porn.ga" 1; + "~*amateurgalls.com" 1; + "~*amazon-seo-service.com" 1; + "~*amehdaily.com" 1; + "~*amoi.tn" 1; + "~*amospalla.es" 1; + "~*ample-awards-today.us" 1; + "~*am-se.com" 1; + "~*amt-k.ru" 1; + "~*amyfoxfitness.com" 1; + "~*anal-acrobats.com" 1; + "~*analytics-ads.xyz" 1; + "~*anapa-inns.ru" 1; + "~*an-donut.com" 1; + "~*android4fun.org" 1; + "~*androids-store.com" 1; + "~*android-style.com" 1; + "~*android-systems.ru" 1; + "~*android-vsem.org" 1; + "~*animali.deagostinipassion.it" 1; + "~*animebox.com.ua" 1; + "~*anime.dougasouko.com" 1; + "~*anlimebel.kiev.ua" 1; + "~*anonymizeme.pro" 1; + "~*anticrawler.org" 1; + "~*anti-virus-removal.info" 1; + "~*aosheng-tech.com" 1; + "~*apartmentbay.ru" 1; + "~*apartmentratings.com" 1; + "~*apartment.ru" 1; + "~*apiadanaknet-a.akamaihd.net" 1; + "~*apiallgeniusinfo-a.akamaihd.net" 1; + "~*apiappenableinfo-a.akamaihd.net" 1; + "~*apibatbrowsecom-a.akamaihd.net" 1; + "~*apibetweenlinesn-a.akamaihd.net" 1; + "~*apibrowsesmartne-a.akamaihd.net" 1; + "~*apidiamondatanet-a.akamaihd.net" 1; + "~*apifasterlightin-a.akamaihd.net" 1; + "~*apiholdingmypage-a.akamaihd.net" 1; + "~*apiitsthirteende-a.akamaihd.net" 1; + "~*apilinkswiftco-a.akamaihd.net" 1; + "~*apimegabrowsebiz-a.akamaihd.net" 1; + "~*apimossnetinfo-a.akamaihd.net" 1; + "~*apimountainbikei-a.akamaihd.net" 1; + "~*apioasisspacenet-a.akamaihd.net" 1; + "~*apioutoboxnet-a.akamaihd.net" 1; + "~*apiportalmorecom-a.akamaihd.net" 1; + "~*apishops.ru" 1; + "~*apispringsmartne-a.akamaihd.net" 1; + "~*apiwebwebgetcom-a.akamaihd.net" 1; + "~*apiwoodensealcom-a.akamaihd.net" 1; + "~*apper.de" 1; + "~*appfixing.space" 1; + "~*appiq.mobi" 1; + "~*appleid-verification.com" 1; + "~*app-ready.xyz" 1; + "~*approved.su" 1; + "~*appsaurus.com" 1; + "~*apxeo.info" 1; + "~*aquarium-pro.ru" 1; + "~*arabgirls.adultgalls.com" 1; + "~*arabsexxxtube.com" 1; + "~*arabseyes.com" 1; + "~*aramaicmedia.org" 1; + "~*arate.ru" 1; + "~*arcadepages.com" 1; + "~*arcadeplayhouse.com" 1; + "~*architecturebest.com" 1; + "~*arclk.net" 1; + "~*arenanews.com.ua" 1; + "~*arendakvartir.kz" 1; + "~*arendas.net" 1; + "~*arenda-yeisk.ru" 1; + "~*arendovalka.xyz" 1; + "~*arkartex.ru" 1; + "~*arraty.altervista.org" 1; + "~*artdeko.info" 1; + "~*artefakct.com" 1; + "~*artpicso.com" 1; + "~*aruplighting.com" 1; + "~*as5000.com" 1; + "~*asacopaco.tk" 1; + "~*asia-forum.ru" 1; + "~*asmxsatadriverin.aircus.com" 1; + "~*asophoto.com" 1; + "~*asrv-a.akamaihd.net" 1; + "~*asrv-a.akamoihd.net" 1; + "~*asrvrep-a.akamaihd.net" 1; + "~*asrvvv-a.akamaihd.net" 1; + "~*asseenontvonline.ru" 1; + "~*asseenontv.ru" 1; + "~*astrochicks.com" 1; + "~*atlant-auto.info" 1; + "~*atlasvkusov.ru" 1; + "~*atleticpharm.org" 1; + "~*atley.eu.pn" 1; + "~*atmagroup.ru" 1; + "~*audiobangout.com" 1; + "~*ausergrubhof.info" 1; + "~*australia-opening-times.com" 1; + "~*auto4style.ru" 1; + "~*autoblogger24.info" 1; + "~*autobudpostach.club" 1; + "~*autogrep.ru" 1; + "~*autoloans.com" 1; + "~*autolombard-krasnodar.ru" 1; + "~*auto-moto-elektronika.cz" 1; + "~*autonew.biz" 1; + "~*autoplate.info" 1; + "~*autorn.ru" 1; + "~*auto.rusvile.lt" 1; + "~*autotop.com.ua" 1; + "~*autotrends.today" 1; + "~*autoua.top" 1; + "~*autovideobroadcast.com" 1; + "~*autowebmarket.com.ua" 1; + "~*auto-zapchasti.org" 1; + "~*availit.weebly.com" 1; + "~*avek.ru" 1; + "~*aviapanda.ru" 1; + "~*aviav.co" 1; + "~*aviav.eu" 1; + "~*aviav.org" 1; + "~*aviav.ru" 1; + "~*aviav.ru.com" 1; + "~*avirasecureserver.com" 1; + "~*avitocars.ru" 1; + "~*avkzarabotok.com" 1; + "~*avkzarabotok.info" 1; + "~*avon-severozapad.ru" 1; + "~*avon-ukraine.com" 1; + "~*avramstroy.ru" 1; + "~*avtoarenda.by" 1; + "~*avtocredit-legko.ru" 1; + "~*avtointeres.ru" 1; + "~*avtolombard-krasnodar.com" 1; + "~*avtolombard-krasnodar.ru" 1; + "~*avtovolop.ru" 1; + "~*awency.com" 1; + "~*axbocz.net" 1; + "~*ayakino.net" 1; + "~*ayanaspa.com" 1; + "~*ayerbo.xhost.ro" 1; + "~*azadnegar.com" 1; + "~*azartmix.com" 1; + "~*azartniy-bonus.com" 1; + "~*azazaporn.com" 1; + "~*azazu.ru" 1; + "~*azbaseimages.net" 1; + "~*azbukadiets.ru" 1; + "~*azbukafree.com" 1; + "~*azbuka-mo.ru" 1; + "~*azlex.uz" 1; + "~*azte.ch" 1; + "~*babespcs.com" 1; + "~*babieca.com" 1; + "~*bablonow.ru" 1; + "~*backgroundpictures.net" 1; + "~*backlink4u.net" 1; + "~*backlinkwatch.com" 1; + "~*backuperwebcam.weebly.com" 1; + "~*baersaratov.ru" 1; + "~*bag77.ru" 1; + "~*bagcionderlab.com" 1; + "~*baixar-musicas-gratis.com" 1; + "~*baksman.com" 1; + "~*baladur.ru" 1; + "~*bala.getenjoyment.net" 1; + "~*balitouroffice.com" 1; + "~*balkanfarma.org" 1; + "~*balkanfarma.ru" 1; + "~*balois.worldbreak.com" 1; + "~*bambi.ck.ua" 1; + "~*bamo.xsl.pt" 1; + "~*banan.tv" 1; + "~*bangla-chat-uk-paralud.ga" 1; + "~*bankcrediti.ru" 1; + "~*bankiem.pl" 1; + "~*bankofthewext.com" 1; + "~*bannerbank.ru" 1; + "~*bannerspace.com" 1; + "~*bannerswap.com" 1; + "~*bannertesting.com" 1; + "~*bard-real.com.ua" 1; + "~*barnfurnituremart.com" 1; + "~*basedecor.ru" 1; + "~*bashtime.ru" 1; + "~*basisches-wasser.net" 1; + "~*batanga.net" 1; + "~*battlecarnival.su" 1; + "~*bausparen.bz.it" 1; + "~*bazaronline24.ru" 1; + "~*bbtec.net" 1; + "~*bdsmgalls.net" 1; + "~*beachpics.com" 1; + "~*beamfall.info" 1; + "~*beauby.ru" 1; + "~*beauty-bracelet.com" 1; + "~*beauty-clinic.ru" 1; + "~*beauty-things.com" 1; + "~*becuo.com" 1; + "~*belinvestdom.by" 1; + "~*bensbargains.net" 1; + "~*berdasovivan.ru" 1; + "~*berlininsl.com" 1; + "~*berrymall.ru" 1; + "~*best-businessman.ru" 1; + "~*bestbuy.ca" 1; + "~*bestchoice.cf" 1; + "~*best-coupon-offer.com" 1; + "~*bestcurs.org" 1; + "~*bestdooz.com" 1; + "~*bestempresas.es" 1; + "~*bestimagecoollibrary.com" 1; + "~*bestkfiledxd.cf" 1; + "~*bestmarriages.com" 1; + "~*bestmobilityscooterstoday.com" 1; + "~*bestofferswalkmydogouteveryday.gq" 1; + "~*bestofpicture.com" 1; + "~*bestofupload.info" 1; + "~*bestplacetobuyeriacta.jw.lt" 1; + "~*bestpriceninja.com" 1; + "~*best-seo-offer.com" 1; + "~*best-seo-software.xyz" 1; + "~*best-seo-solution.com" 1; + "~*bestssaker.com" 1; + "~*bestwebsiteawards.com" 1; + "~*bestwebsitesawards.com" 1; + "~*betonka.pro" 1; + "~*bet-prognoz.com" 1; + "~*betterscooter.com" 1; + "~*betune.onlinewebshop.net" 1; + "~*betwinservice.com" 1; + "~*beyan.host.sk" 1; + "~*bezcmexa.ru" 1; + "~*bezsporno.ru" 1; + "~*beztuberkuleza.ru" 1; + "~*bidbuy.co.kr" 1; + "~*bidr.trellian.com" 1; + "~*bif-ru.info" 1; + "~*bigames.online" 1; + "~*bigcities.org" 1; + "~*biglistofwebsites.com" 1; + "~*bigpenisguide.com" 1; + "~*biketank.ga" 1; + "~*bikini-image.com" 1; + "~*billiard-classic.com.ua" 1; + "~*bimatoprost-careprost.com" 1; + "~*bimatoprost-careprost.com.ua" 1; + "~*binaryoptionscops.info" 1; + "~*bingo8888.com" 1; + "~*binomo.kz" 1; + "~*bioca.org" 1; + "~*bio-japan.net" 1; + "~*bio-market.kz" 1; + "~*bioscorp.ru" 1; + "~*bio.trade-jp.net" 1; + "~*birzha-truda.eu" 1; + "~*bitcoinpile.com" 1; + "~*bitcoins-live.ru" 1; + "~*bitporno.sx" 1; + "~*bizcheapjerseyswholesalechina.com" 1; + "~*biznesluxe.ru" 1; + "~*biznesrealnost.ru" 1; + "~*biznesschat.net" 1; + "~*bizru.info" 1; + "~*bkns.vn" 1; + "~*blackhatworth.com" 1; + "~*blackle.com" 1; + "~*blackwitchcraft.ru" 1; + "~*blagovest-med.ru" 1; + "~*blavia.00author.com" 1; + "~*bleacherreport.com" 1; + "~*blockworld.ru" 1; + "~*blog.f00kclan.de" 1; + "~*bloggedporn.com" 1; + "~*bloggen.be" 1; + "~*bloggers.nl" 1; + "~*blogig.org" 1; + "~*blog.koorg.ru" 1; + "~*blogos.kz" 1; + "~*blogporn.in" 1; + "~*blogqpot.com" 1; + "~*blog.remote-computer.de" 1; + "~*blogs.rediff.com" 1; + "~*blogster.com" 1; + "~*blogtotal.de" 1; + "~*blog.yam.com" 1; + "~*bluejays-jerseys.us" 1; + "~*bluerobot.info" 1; + "~*board.f00d.de" 1; + "~*bobba.dzaba.com" 1; + "~*bodybuilding-shop.biz" 1; + "~*boleznikogi.com" 1; + "~*bolezniorganov.ru" 1; + "~*bolitgorlo.net" 1; + "~*bombla.org" 1; + "~*bongiornos.info" 1; + "~*bonux.nextview.ru" 1; + "~*boobsimge.com" 1; + "~*bookmaker-bet.com" 1; + "~*bookmark4you.com" 1; + "~*boole.onlinewebshop.net" 1; + "~*boostmyppc.com" 1; + "~*bosman.pluto.ro" 1; + "~*bouda.kvalitne.cz" 1; + "~*bpro1.top" 1; + "~*brains2.biz" 1; + "~*brainsandeggs.blogspot.com" 1; + "~*brainxs.us" 1; + "~*braip.com.br" 1; + "~*brakehawk.com" 1; + "~*brandov.ru" 1; + "~*break-the-chains.com" 1; + "~*breastaugmentation.co.za" 1; + "~*brendbutik.ru" 1; + "~*brewdom.ru" 1; + "~*brg8.com" 1; + "~*bristolhostel.com" 1; + "~*bristolhotel.com" 1; + "~*bristolhotel.com.ua" 1; + "~*brk-rti.ru" 1; + "~*brokergid.ru" 1; + "~*bronzeaid-a.akamaihd.net" 1; + "~*brothers-smaller.ru" 1; + "~*browsepulse-a.akamaihd.net" 1; + "~*brus.city" 1; + "~*brus-vsem.ru" 1; + "~*bscodecs.com" 1; + "~*b-styles.xyz" 1; + "~*btvn.ru" 1; + "~*buchananshardware.com" 1; + "~*budpost.com.ua" 1; + "~*bugof.gq" 1; + "~*buigas.00it.com" 1; + "~*builtwith.com" 1; + "~*bum.com.ru" 1; + "~*bupropion-sr-150-mg.us" 1; + "~*buqayy0.livejournal.com" 1; + "~*buqyxa.rincian.info" 1; + "~*burger-imperia.com" 1; + "~*burkesales.com" 1; + "~*burn-fat.ga" 1; + "~*businesxxl.com" 1; + "~*buttons-for-website.com" 1; + "~*buttons-for-your-website.com" 1; + "~*buyantiviralwp.com" 1; + "~*buy-cheap-online.info" 1; + "~*buy-cheap-pills-order-online.com" 1; + "~*buyessay3.blogspot.ru" 1; + "~*buyessaynow.biz" 1; + "~*buyessayonline19.blogspot.ru" 1; + "~*buy-forum.ru" 1; + "~*buyfriend.ru" 1; + "~*buyhoverboard.com" 1; + "~*buyk.host.sk" 1; + "~*buy-loft.ru" 1; + "~*buynorxx.com" 1; + "~*buypanicdisorderpill.com" 1; + "~*buypillsorderonline.com" 1; + "~*buypuppies.ca" 1; + "~*buyscabiescream.com" 1; + "~*buytizanidineonline.blogspot.com" 1; + "~*buytizanidineonlinenoprescription.blogspot.com" 1; + "~*buyviagraa.blogspot.com" 1; + "~*buzzonclick.com" 1; + "~*buzzsumo.com" 1; + "~*buzzurl.jp" 1; + "~*bycontext.com" 1; + "~*byme.se" 1; + "~*bytimedance.ru" 1; + "~*bzero1jewelry.net" 1; + "~*cablecar.us" 1; + "~*cacheimages.com" 1; + "~*cactussoft.biz" 1; + "~*cakics.com" 1; + "~*calc-for-credit.ru" 1; + "~*calcularpagerank.com" 1; + "~*californianews.cf" 1; + "~*callejondelpozo.es" 1; + "~*call-of-duty.info" 1; + "~*calstaterealty.us" 1; + "~*calvet.altervista.org" 1; + "~*candcstuccoandstone.com" 1; + "~*candelluxsklep.pl" 1; + "~*candiceloves.us" 1; + "~*cand.jp" 1; + "~*candycrushshop.com" 1; + "~*candy-glam-hp.com" 1; + "~*candypeople.se" 1; + "~*candytiner.com" 1; + "~*canoncdriverq3.pen.io" 1; + "~*canphotograph.com" 1; + "~*canrole.com" 1; + "~*canyougethighofftizanidine.blogspot.com" 1; + "~*canzoni.ru" 1; + "~*capture-room.com" 1; + "~*carabela.com.do" 1; + "~*carapics.com" 1; + "~*cardiosport.com.ua" 1; + "~*cardsharp1.ru" 1; + "~*cardul.ru" 1; + "~*carfax.com.ua" 1; + "~*carloans.com" 1; + "~*carsdined.org" 1; + "~*carsoncitypizza.com" 1; + "~*carson.getenjoyment.net" 1; + "~*carsplate.com" 1; + "~*cartechnic.ru" 1; + "~*casablancamanor.co.za" 1; + "~*cashkitten-a.akamaihd.net" 1; + "~*cashonads.com" 1; + "~*casinorewards.info" 1; + "~*castingbank.ru" 1; + "~*catalogs-parts.com" 1; + "~*cayado.snn.gr" 1; + "~*cbb1smartlist12.click" 1; + "~*cbcseward.com" 1; + "~*cbox.ws" 1; + "~*cbys.tk" 1; + "~*cdncash.com" 1; + "~*cdncash.net" 1; + "~*cdncash.org" 1; + "~*celebsopics.com" 1; + "~*cellfun.mobi" 1; + "~*c-english.ru" 1; + "~*cenokos.ru" 1; + "~*cenoval.ru" 1; + "~*centraletermice.us" 1; + "~*centrdebut.ru" 1; + "~*centre-indigo.org.ua" 1; + "~*centrumcoachingu.com" 1; + "~*cercacamion.it" 1; + "~*cezartabac.ro" 1; + "~*cfjump.com" 1; + "~*cfsrating.sonicwall.com" 1; + "~*cgi2.nintendo.co.jp" 1; + "~*chastnoeporno.com" 1; + "~*chat.ru" 1; + "~*chatseo.com" 1; + "~*chcu.net" 1; + "~*cheapestjerseys-wholesale.com" 1; + "~*cheapjerseysa.com" 1; + "~*cheapjerseysap.com" 1; + "~*cheapjerseysbizwholesale.us" 1; + "~*cheapjerseysfootballshop.com" 1; + "~*cheap-pills-norx.com" 1; + "~*cheatcode-lita12.rhcloud.com" 1; + "~*checkm8.com" 1; + "~*checkpagerank.net" 1; + "~*checktext.org" 1; + "~*chee-by.biz" 1; + "~*cheerlemage.com" 1; + "~*chelnytruck.ru" 1; + "~*chelyabinsk.xrus.org" 1; + "~*cherrypointplace.ca" 1; + "~*cherubinimobili.it" 1; + "~*chiblackhawks-jerseys.com" 1; + "~*chimiver.info" 1; + "~*chinacheapelitejerseys.com" 1; + "~*chinaelitecheapjerseys.com" 1; + "~*chinajerseyswholesalecoupons.com" 1; + "~*chinese-amezon.com" 1; + "~*chiptuninger.com" 1; + "~*chlooe.com" 1; + "~*chocolateslim-original.com" 1; + "~*chocoslim.pro" 1; + "~*choosecuisine.com" 1; + "~*cialisovercounteratwalmartusa.com" 1; + "~*cialiswithoutadoctor.net" 1; + "~*ciekawinki.pl" 1; + "~*cigarpass.com" 1; + "~*cinemaenergy-hd.ru" 1; + "~*ciproandtizanidine.blogspot.com" 1; + "~*citizenclsdriveri7.pen.io" 1; + "~*cityadspix.com" 1; + "~*ci.ua" 1; + "~*civilwartheater.com" 1; + "~*clarithromycin500mg.com" 1; + "~*clash-clans.ru" 1; + "~*classicakuhni.ru" 1; + "~*classiquebijoux.ru" 1; + "~*claytransformations.info" 1; + "~*clevernt.com" 1; + "~*clgrmgds.com" 1; + "~*clicksor.com" 1; + "~*clicksor.net" 1; + "~*clinchimage.com" 1; + "~*clipartnew.com" 1; + "~*clips.ua.ac.be" 1; + "~*clksite.com" 1; + "~*clmforexeu.com" 1; + "~*club-musics.ru" 1; + "~*club-samodelkin.ru" 1; + "~*cmd.kz" 1; + "~*cmhomestayagency.com" 1; + "~*cntravelre.com" 1; + "~*cobaltpro.ru" 1; + "~*cocyq.inwtrade.com" 1; + "~*coderstate.com" 1; + "~*codq.info" 1; + "~*codysbbq.com" 1; + "~*cognitiveseo.com" 1; + "~*coldfilm.ru" 1; + "~*collegeessay19.blogspot.ru" 1; + "~*cometorussia.net" 1; + "~*comissionka.net" 1; + "~*community.allhiphop.com" 1; + "~*com-onlinesupport.host" 1; + "~*com-onlinesupport.site" 1; + "~*compliance-checker.info" 1; + "~*com-secure.download" 1; + "~*com-supportcenter.website" 1; + "~*concealthyself.com" 1; + "~*conciergegroup.org" 1; + "~*confib.ifmo.ru" 1; + "~*connectionstrenth.com" 1; + "~*conocer-sanabria.com" 1; + "~*constantaservice.net" 1; + "~*construmac.com.mx" 1; + "~*contextualyield.com" 1; + "~*cookielawblog.wordpress.com" 1; + "~*cookingmeat.ru" 1; + "~*coolbar.pro" 1; + "~*coolgramgoods.com" 1; + "~*coolingoods.com" 1; + "~*coolinstagoods.com" 1; + "~*cool-wedding.net" 1; + "~*coop-gamers.ru" 1; + "~*copblock.org" 1; + "~*copyrightclaims.org" 1; + "~*cosmetic.donna7753191.ru" 1; + "~*countbertwistdisp26.soup.io" 1; + "~*counter.yadro.ru" 1; + "~*country-chic.ru" 1; + "~*covadhosting.biz" 1; + "~*covetnica.com" 1; + "~*cowblog.fr" 1; + "~*cpabegins.ru" 1; + "~*craftburg.ru" 1; + "~*crafthubs.com" 1; + "~*cranly.net" 1; + "~*crazyboost.pro" 1; + "~*crd.clan.su" 1; + "~*creams.makeforum.eu" 1; + "~*creditmoney.com.ua" 1; + "~*crest3d.ru" 1; + "~*crest-poloski.ru" 1; + "~*crests.com" 1; + "~*crests.org" 1; + "~*crirussian.ru" 1; + "~*crystalslot.com" 1; + "~*cscwtalkto.site" 1; + "~*cubook.supernew.org" 1; + "~*cubs-jerseys.us" 1; + "~*culturevie.info" 1; + "~*curatorimages.com" 1; + "~*custodieva.ru" 1; + "~*customboxes4less.com" 1; + "~*customcatchcan.com" 1; + "~*customchocolate.business-for-home.com" 1; + "~*customcollegeessays.net" 1; + "~*custom-electric-guitar.com" 1; + "~*customergrowthsystems.com" 1; + "~*customerguru.in" 1; + "~*custom-product-labels.com" 1; + "~*customsua.com.ua" 1; + "~*cutalltheshit.com" 1; + "~*cvety24.by" 1; + "~*cxpromote.com" 1; + "~*cyclobenzaprinevstizanidine.blogspot.com" 1; + "~*cymbaltaandtizanidine.blogspot.com" 1; + "~*cyprusbuyproperties.com" 1; + "~*cyse.tk" 1; + "~*czat.wp.pl" 1; + "~*dailyrank.net" 1; + "~*dailystrength.org" 1; + "~*dalavia.ru" 1; + "~*damedingel.ya.ru" 1; + "~*dame-ns.kz" 1; + "~*danashop.ru" 1; + "~*danceuniverse.ru" 1; + "~*dangphoto.trade" 1; + "~*danschawbel.com" 1; + "~*daptravel.com" 1; + "~*darkbooks.org" 1; + "~*darmebel.com.ua" 1; + "~*darodar.com" 1; + "~*dataloading.net" 1; + "~*data.vtc.pw" 1; + "~*dating-time-now.com" 1; + "~*datsun-do.com" 1; + "~*davebestdeals.com" 1; + "~*daydream-studio.ru" 1; + "~*daymusam.com" 1; + "~*day-news.info" 1; + "~*dbmkfhqk.bloger.index.hr" 1; + "~*ddlmega.net" 1; + "~*ddospanel.com" 1; + "~*ddpills.com" 1; + "~*deadlinkchecker.com" 1; + "~*dealighted.com" 1; + "~*dealitright.click" 1; + "~*dealwifi.com" 1; + "~*dear-diary.ru" 1; + "~*decenttools.com" 1; + "~*decorationspcs.com" 1; + "~*dekoration.us" 1; + "~*dekorkeramik.ru" 1; + "~*delayreferat.ru" 1; + "~*delfin-aqua.com.ua" 1; + "~*demenageur.com" 1; + "~*dengi-pod-zalog-nedvizhimosti.ru" 1; + "~*deniven.1bb.ru" 1; + "~*den-noch24.ru" 1; + "~*depositfiles-porn.ga" 1; + "~*descargar-musica-gratis.net" 1; + "~*designdevise.com" 1; + "~*design-ideas.info" 1; + "~*design-lands.ru" 1; + "~*destinationrealestate.com" 1; + "~*detalizaciya-tut.biz" 1; + "~*detective01.ru" 1; + "~*detki-opt.ru" 1; + "~*detskie-konstruktory.ru" 1; + "~*detskie-zabavi.ru" 1; + "~*devochki.top" 1; + "~*de.zapmeta.com" 1; + "~*dfiles.me" 1; + "~*dfwu1013.info" 1; + "~*dfwu1019.info" 1; + "~*diarioaconcagua.com" 1; + "~*dickssportinggoods.com" 1; + "~*diegolopezcastan.com" 1; + "~*diesel-parts28.ru" 1; + "~*dieswaene.com" 1; + "~*diffbot.com" 1; + "~*digest-project.ru" 1; + "~*digilander.libero.it" 1; + "~*digitalfaq.com" 1; + "~*digital-sale.su" 1; + "~*digital-video-processing.com" 1; + "~*dikx.gdn" 1; + "~*diminishedvalueoforegon.com" 1; + "~*dimkino.ru" 1; + "~*dinkolove.ya.ru" 1; + "~*dipstar.org" 1; + "~*directrev.com" 1; + "~*discountliv.com" 1; + "~*discovertreasure-a.akamaihd.net" 1; + "~*discovertreasurenow.com" 1; + "~*distver.ru" 1; + "~*diy-handmade-ideas.com" 1; + "~*djekxa.ru" 1; + "~*djonwatch.ru" 1; + "~*djstools.com" 1; + "~*dktr.ru" 1; + "~*dkvorota.ru" 1; + "~*dlya-android.org" 1; + "~*dms-sw.ru" 1; + "~*dnepr-avtospar.com.ua" 1; + "~*dnepropetrovsk.mistr-x.org" 1; + "~*dneprsvet.com.ua" 1; + "~*docstoc.com" 1; + "~*doctissimo.fr" 1; + "~*doctormakarova.ru" 1; + "~*dodlive.mil" 1; + "~*doeco.ru" 1; + "~*dogbreedspicture.net" 1; + "~*dogoimage.com" 1; + "~*dogsrun.net" 1; + "~*dojki-hd.com" 1; + "~*dokfilms.net" 1; + "~*doktoronline.no" 1; + "~*dokumentalkino.net" 1; + "~*domain2008.com" 1; + "~*domainsatcost.com" 1; + "~*domain-submit.info" 1; + "~*domain-tracker.com" 1; + "~*domcran.net" 1; + "~*domik-derevne.ru" 1; + "~*dominateforex.ml" 1; + "~*domination.ml" 1; + "~*dominterior.org" 1; + "~*domoysshop.ru" 1; + "~*domznaniy.ru" 1; + "~*donna7753191.ru" 1; + "~*donvito.unas.cz" 1; + "~*doska-vsem.ru" 1; + "~*dostavka-v-krym.com" 1; + "~*dostavka-v-ukrainu.ru" 1; + "~*dosug-lux.ru" 1; + "~*dotnetdotcom.org" 1; + "~*downloader12.ru" 1; + "~*downloadkakaotalk.com" 1; + "~*downloadmefiranaratb1972.xpg.com.br" 1; + "~*download-of-the-warez.blogspot.com" 1; + "~*downtuptv.gq" 1; + "~*doxyporno.com" 1; + "~*drillsaw.ru" 1; + "~*driving.kiev.ua" 1; + "~*droidlook.net" 1; + "~*drugspowerstore.com" 1; + "~*drugstoreforyou.com" 1; + "~*drupa.com" 1; + "~*druzhbany.ru" 1; + "~*druzhininevgeniy63.blogspot.com" 1; + "~*dstroy.su" 1; + "~*dustyorate.com" 1; + "~*dvd-famille.com" 1; + "~*dvervmoskvu.ru" 1; + "~*dvr.biz.ua" 1; + "~*dvrlists.com" 1; + "~*dyshagi.ru" 1; + "~*eandsgallery.com" 1; + "~*eaplay.ru" 1; + "~*earl-brown.info" 1; + "~*eas-seo.com" 1; + "~*easycommerce.cf" 1; + "~*easync.io" 1; + "~*easyshoppermac.com" 1; + "~*easytuningshop.ru" 1; + "~*eat.besplatno-skachat-washington.bid" 1; + "~*e-avon.ru" 1; + "~*e-buyeasy.com" 1; + "~*e-collantes.com" 1; + "~*e-commerce-seo1.com" 1; + "~*e-commerce-seo.com" 1; + "~*ecomp3.ru" 1; + "~*econom.co" 1; + "~*ecookna.com.ua" 1; + "~*ecxtracking.com" 1; + "~*edelstahlschornstein-123.de" 1; + "~*editmedios.com" 1; + "~*ed-shop01.ru" 1; + "~*edshopping.net" 1; + "~*education-cz.ru" 1; + "~*efkt.jp" 1; + "~*egovaleo.it" 1; + "~*egvar.net" 1; + "~*ekaterinburg.xrus.org" 1; + "~*ekobata.ru" 1; + "~*ekspertmed.com" 1; + "~*ekto.ee" 1; + "~*e-kwiaciarz.pl" 1; + "~*eldiariodeguadalajara.com" 1; + "~*electricwheelchairsarea.com" 1; + "~*electronicadirect.com" 1; + "~*electro-prom.com" 1; + "~*elektir.ru" 1; + "~*elektrischezi.canalblog.com" 1; + "~*elektrischeziga.livejournal.com" 1; + "~*elektrischezigarette1.blog.pl" 1; + "~*elektrischezigarette1.onsugar.com" 1; + "~*elektrischezigarette2.devhub.com" 1; + "~*elektrischezigarette2.onsugar.com" 1; + "~*elektrischezigarettekaufen2.cowblog.fr" 1; + "~*elektrischezigaretten1.blogse.nl" 1; + "~*elektrischezigaretten2.beeplog.com" 1; + "~*elektronischezigarette2.mex.tl" 1; + "~*elektronischezigarettekaufen1.beeplog.com" 1; + "~*elektronischezigarettekaufen1.myblog.de" 1; + "~*elektronischezigarettekaufen2.tumblr.com" 1; + "~*elektronischezi.livejournal.com" 1; + "~*elektrozigarette1.dreamwidth.org" 1; + "~*elektrozigarette2.webs.com" 1; + "~*elektrozigarette2.wordpressy.pl" 1; + "~*elektrozigarettekaufen1.devhub.com" 1; + "~*elektrozigarettekaufen2.blogse.nl" 1; + "~*elektrozigaretten1.postbit.com" 1; + "~*elektrozigaretten1.tumblr.com" 1; + "~*elektrozigaretten1.webs.com" 1; + "~*elektrozigaretten2.yn.lt" 1; + "~*elidelcream.weebly.com" 1; + "~*elitedollars.com" 1; + "~*elitepcgames.com" 1; + "~*elitesportsadvisor.com" 1; + "~*elkacentr.ru" 1; + "~*elmacho.xyz" 1; + "~*el-nation.com" 1; + "~*eloconcream.blogspot.com" 1; + "~*eloxal.ru" 1; + "~*elvel.com.ua" 1; + "~*embedle.com" 1; + "~*empathica.com" 1; + "~*empirepoker.com" 1; + "~*empis.magix.net" 1; + "~*encodable.com" 1; + "~*energydiet24.ru" 1; + "~*energydiet-info.ru" 1; + "~*energy-ua.com" 1; + "~*enginebay.ru" 1; + "~*englate.com" 1; + "~*englishdictionaryfree.com" 1; + "~*englishgamer.com" 1; + "~*enternet.ee" 1; + "~*envaseslotusama.com" 1; + "~*enviromusic.net" 1; + "~*eonpal.com" 1; + "~*epngo.bz" 1; + "~*e-poker-2005.com" 1; + "~*eralph.tk" 1; + "~*erank.eu" 1; + "~*erectile.bid" 1; + "~*eredijovon.com" 1; + "~*ereko.ru" 1; + "~*eropornosex.ru" 1; + "~*erot.co" 1; + "~*erotikstories.ru" 1; + "~*errorfixing.space" 1; + "~*es5.com" 1; + "~*escortplius.com" 1; + "~*escort-russian.com" 1; + "~*eshop4u.jp" 1; + "~*eshop.md" 1; + "~*esnm.ru" 1; + "~*este-line.com.ua" 1; + "~*estibot.com" 1; + "~*eu-cookie-law.blogspot.com" 1; + "~*eu-cookie-law.info" 1; + "~*eupornstar.info" 1; + "~*euromasterclass.ru" 1; + "~*euronis-free.com" 1; + "~*europages.com.ru" 1; + "~*europeanwatches.ru" 1; + "~*eurosamodelki.ru" 1; + "~*euroskat.ru" 1; + "~*evaashop.ru" 1; + "~*evehemming.blogspot.com.au" 1; + "~*event-tracking.com" 1; + "~*everflora.ru" 1; + "~*evidencecleanergold.com" 1; + "~*evrotekhservis.ru" 1; + "~*excaliburfilms.com" 1; + "~*exchangeit.gq" 1; + "~*exchanges-bet.com" 1; + "~*executehosting.com" 1; + "~*exmasters.com" 1; + "~*exonline.info" 1; + "~*expdom.com" 1; + "~*expertblog.info" 1; + "~*expertnaya-ocenka.ru" 1; + "~*exportshop.us" 1; + "~*expresstoplivo.ru" 1; + "~*extads.net" 1; + "~*extener.org" 1; + "~*extrabot.com" 1; + "~*extractorandburner.com" 1; + "~*extremal-blog.com" 1; + "~*extremez.net" 1; + "~*extstat.com" 1; + "~*eyelike.com.ua" 1; + "~*eyemagination.com" 1; + "~*eyes-on-you.ga" 1; + "~*eyessurgery.ru" 1; + "~*ez8motelseaworldsandiego.com" 1; + "~*ezigarettekaufen1.hpage.com" 1; + "~*ezigarettekaufen2.blox.pl" 1; + "~*ezigarettekaufen2.mpbloggar.se" 1; + "~*ezigarettekaufen2.yolasite.com" 1; + "~*ezigarettekaufen.myblog.de" 1; + "~*ezigarettenkaufen1.deviantart.com" 1; + "~*ezigarettenkaufen1.pagina.gr" 1; + "~*ezigarettenkaufen2.dreamwidth.org" 1; + "~*ezigarettenshop1.yolasite.com" 1; + "~*ezigarettenshop2.myblog.de" 1; + "~*ezigarettenshop2.postbit.com" 1; + "~*ezigaretteshop2.mywapblog.com" 1; + "~*ezigaretteshop2.vefblog.net" 1; + "~*ezigaretteshop.webs.com" 1; + "~*ezofest.sk" 1; + "~*f00kclan.de" 1; + "~*f012.de" 1; + "~*f07.de" 1; + "~*f0815.de" 1; + "~*f5mtrack.com" 1; + "~*fable.in.ua" 1; + "~*failingmarriege.blogspot.com" 1; + "~*falcoware.com" 1; + "~*family1st.ca" 1; + "~*familyholiday.ml" 1; + "~*familyphysician.ru" 1; + "~*famix.xyz" 1; + "~*fandlr.com" 1; + "~*fanoboi.com" 1; + "~*fanpagerobot.com" 1; + "~*fantasticpixcool.com" 1; + "~*farm26.ru" 1; + "~*farmingworm.com" 1; + "~*fashionindeed.ml" 1; + "~*fashion-mk.net" 1; + "~*fashion-stickers.ru" 1; + "~*fastcrawl.com" 1; + "~*fast-wordpress-start.com" 1; + "~*fatmaelgarny.com" 1; + "~*favorcosmetics.com" 1; + "~*favoritemoney.ru" 1; + "~*favornews.com" 1; + "~*faz99.com" 1; + "~*fba-mexico.com" 1; + "~*fdzone.org" 1; + "~*fealq.com" 1; + "~*fearcrow.com" 1; + "~*feel-planet.com" 1; + "~*feeriaclub.ru" 1; + "~*fefo.gdn" 1; + "~*femdom.twiclub.in" 1; + "~*femmesdenudees.com" 1; + "~*fenoyl.batcave.net" 1; + "~*ferieboligkbh.dk" 1; + "~*fermersovet.ru" 1; + "~*ferretsoft.com" 1; + "~*fetishinside.com" 1; + "~*fidelityfunding.com" 1; + "~*fifa-coins.online" 1; + "~*filesmonster.porn" 1; + "~*filesvine.com" 1; + "~*filkhbr.com" 1; + "~*filmbokep69.com" 1; + "~*filmetricsasia.com" 1; + "~*filmfanatic.com" 1; + "~*filmgo.ru" 1; + "~*filmidivx.com" 1; + "~*film-one.ru" 1; + "~*fil.ru" 1; + "~*filunika.com.ru" 1; + "~*financehint.eu" 1; + "~*financeloan.us" 1; + "~*financepoints.eu" 1; + "~*financetip.eu" 1; + "~*find1friend.com" 1; + "~*findacheaplawyers.com" 1; + "~*findclan.org" 1; + "~*findpik.com" 1; + "~*findthe.pet" 1; + "~*finstroy.net" 1; + "~*finteks.ru" 1; + "~*finuse.com" 1; + "~*fireads.men" 1; + "~*firesub.pl" 1; + "~*firma-legion.ru" 1; + "~*fishingwholesale.us" 1; + "~*fitnesspiks.com" 1; + "~*fitness-video.net" 1; + "~*fiuxy.com" 1; + "~*fiverr.com" 1; + "~*fix-website-errors.com" 1; + "~*flash4fun.com" 1; + "~*flashbannernow.com" 1; + "~*flavors.me" 1; + "~*flex4launch.ru" 1; + "~*flipper.top" 1; + "~*f-loaded.de" 1; + "~*floating-share-buttons.com" 1; + "~*flooringinstallation-edmonton.com" 1; + "~*floridahuntingfishingadventures.com" 1; + "~*floridamhca.org" 1; + "~*florida-tourism.net" 1; + "~*flowecs.com" 1; + "~*flowersbazar.com" 1; + "~*flowwwers.com" 1; + "~*flprog.com" 1; + "~*flytourisme.org" 1; + "~*flzhiguan.com" 1; + "~*fm-upgrade.ru" 1; + "~*folowsite.com" 1; + "~*f-online.de" 1; + "~*footbalive.org" 1; + "~*forensicpsychiatry.ru" 1; + "~*forex21.ru" 1; + "~*forexgb.ru" 1; + "~*forex-indextop20.ru" 1; + "~*forex.osobye.ru" 1; + "~*forex-procto.ru" 1; + "~*forexunion.net" 1; + "~*forminecrafters.ru" 1; + "~*formseo.com" 1; + "~*forms-mtm.ru" 1; + "~*forpostlock.ru" 1; + "~*forsex.info" 1; + "~*fortawesome.github.io" 1; + "~*forum20.smailik.org" 1; + "~*forum.doctissimo.fr" 1; + "~*forum-engineering.ru" 1; + "~*forum.poker4life.ru" 1; + "~*forumprofi.de" 1; + "~*forums.toucharcade.com" 1; + "~*forum.tvmir.org" 1; + "~*foto-sisek.porngalleries.top" 1; + "~*foto-telok.net" 1; + "~*fototravel.eu" 1; + "~*fotoxxxru.com" 1; + "~*foxinsocks.ru" 1; + "~*foxtechfpv.com" 1; + "~*foxydeal.com" 1; + "~*freakycheats.com" 1; + "~*freecamdollars.com" 1; + "~*free-floating-buttons.com" 1; + "~*freejabs.com" 1; + "~*freelotto.com" 1; + "~*freemags.cc" 1; + "~*freenode.info" 1; + "~*freenom.link" 1; + "~*freeseedsonline.com" 1; + "~*free-share-buttons.blogspot.com" 1; + "~*free-share-buttons.com" 1; + "~*free-share-buttons.top" 1; + "~*freesitetest.com" 1; + "~*free-social-buttons.com" 1; + "~*free-stock-illustration.com" 1; + "~*freetangodownload.com" 1; + "~*freeuploader.com" 1; + "~*freeuploader.ml" 1; + "~*free-video-tool.com" 1; + "~*freewebs.com" 1; + "~*freewhatsappload.com" 1; + "~*freshberry.com.ua" 1; + "~*freshmac.space" 1; + "~*freshsuperbloop.com" 1; + "~*freshwallpapers.info" 1; + "~*frivgame250.com" 1; + "~*fr.netlog.com" 1; + "~*front.ru" 1; + "~*front.to" 1; + "~*frvo.alptandem.ru" 1; + "~*fsalas.com" 1; + "~*fspys.pl" 1; + "~*ftns.ru" 1; + "~*fuel-gas.com" 1; + "~*fugarif.ga" 1; + "~*fullfileaccess.com" 1; + "~*fun2cell.net" 1; + "~*fungamelands.com" 1; + "~*fungirlsgames.net" 1; + "~*funnypica.com" 1; + "~*funponsel.com" 1; + "~*funtoonez.com" 1; + "~*futbolkisales.ru" 1; + "~*fx-brokers-review.com" 1; + "~*fxgallery.com" 1; + "~*fxtips.ru" 1; + "~*fym.com.ru" 1; + "~*g33.org" 1; + "~*g7m.pl" 1; + "~*gabeshop.ru" 1; + "~*gael-s.ru" 1; + "~*gagrasector.ru" 1; + "~*galaxy-family.ru" 1; + "~*galaxyflowers.ru" 1; + "~*galeon.com" 1; + "~*gallerily.com" 1; + "~*galleryawesome.com" 1; + "~*gallerylisting.com" 1; + "~*gallictures.com" 1; + "~*gamblingnerd.com" 1; + "~*game-mmorpg.net" 1; + "~*gameonasia.com" 1; + "~*gameplexcity.com" 1; + "~*gamerextra.com" 1; + "~*gamerscorps.com" 1; + "~*games.kolossale.ru" 1; + "~*game-top.su" 1; + "~*gamevalue7.weebly.com" 1; + "~*gamewrath.com" 1; + "~*gaming-journal.com" 1; + "~*gardene.ru" 1; + "~*gay.adultgalls.com" 1; + "~*gay-file.com" 1; + "~*gaygalls.net" 1; + "~*gaytube.com" 1; + "~*gazobeton-p.com.ua" 1; + "~*gazoblok.net.ua" 1; + "~*gazporno.com" 1; + "~*gaz-voshod.ru" 1; + "~*gcup.ru" 1; + "~*gdcentre.ru" 1; + "~*gdebestkupit.ru" 1; + "~*ge0ip.com" 1; + "~*ge0ip.net" 1; + "~*ge0ip.org" 1; + "~*geckoandfly.com" 1; + "~*gelezki.com" 1; + "~*gemara.com" 1; + "~*gembird.com" 1; + "~*generalporn.org" 1; + "~*genericlowlatencyasiodriverhq.aircus.com" 1; + "~*generic-pills-online.com" 1; + "~*genericviagrasildenafiled.net" 1; + "~*generousdeal-a.akamaihd.net" 1; + "~*gentamicineyedrops.blogspot.com" 1; + "~*geoads.com" 1; + "~*germes-trans.com" 1; + "~*get-free-traffic-now.com" 1; + "~*getlamborghini.ga" 1; + "~*getmiro.com" 1; + "~*getmyads24.com" 1; + "~*getoutofdebtfree.org" 1; + "~*getpopunder.com" 1; + "~*getrichquickly.info" 1; + "~*get-seo-domain.com" 1; + "~*get-your-social-buttons.info" 1; + "~*gfaq.ru" 1; + "~*gg-arena.ru" 1; + "~*ggiaro.com" 1; + "~*gg.zzyjxs.com" 1; + "~*ghazel.ru" 1; + "~*ghernnqr.skyrock.com" 1; + "~*gheus.altervista.org" 1; + "~*ghostvisitor.com" 1; + "~*gifspics.com" 1; + "~*gigablast.com" 1; + "~*gilsonchiro.xyz" 1; + "~*girlgamerdaily.com" 1; + "~*girlporn.ru" 1; + "~*girlsatgames.ru" 1; + "~*girlspicsa.com" 1; + "~*given2.com" 1; + "~*gk-atlant.info" 1; + "~*gkvector.ru" 1; + "~*glall.ru" 1; + "~*glass-msk.ru" 1; + "~*glavprofit.ru" 1; + "~*glcomputers.ru" 1; + "~*glicol.kz" 1; + "~*global-ics.co.za" 1; + "~*globalscam.ga" 1; + "~*globalsurfari.com" 1; + "~*globatur.ru" 1; + "~*globetrotting-culture.ru" 1; + "~*glopages.ru" 1; + "~*gne8.com" 1; + "~*go2album.com" 1; + "~*go2jump.org" 1; + "~*go2mike.ru" 1; + "~*gobongo.info" 1; + "~*goforexvps.com" 1; + "~*gogalleryawesome.com" 1; + "~*gogps.me" 1; + "~*gojiberriess.apishops.ru" 1; + "~*gok-kasten.net" 1; + "~*goldandcard.ru" 1; + "~*golden-catalog.pro" 1; + "~*goldenggames.com" 1; + "~*golden-praga.ru" 1; + "~*goldpanningtools.com" 1; + "~*golmau.host.sk" 1; + "~*gonextmedia.com" 1; + "~*good-mummy.ru" 1; + "~*goodnightjournal.com" 1; + "~*goodprotein.ru" 1; + "~*googglet.com" 1; + "~*googlefeud.com" 1; + "~*google-liar.ru" 1; + "~*googlemare.com" 1; + "~*googst2.ru" 1; + "~*goo.ne.jp" 1; + "~*gopixdatabase.com" 1; + "~*gopro-online.info" 1; + "~*gorabagrata.ru" 1; + "~*goroda-vsego-mira.ru" 1; + "~*gorodservis.ru" 1; + "~*gosreg.amchs.ru" 1; + "~*gotomontenegro.net" 1; + "~*gotorussia.com" 1; + "~*gotwebsite1.com" 1; + "~*gourcy.altervista.org" 1; + "~*gox.com.ua" 1; + "~*gpirate.com" 1; + "~*gq-catalog.gq" 1; + "~*grand-chlen.ru" 1; + "~*graphicwe.org" 1; + "~*graphid.com" 1; + "~*gratuitbaise.com" 1; + "~*greatfind-a.akamaihd.net" 1; + "~*greatgrace.ru" 1; + "~*greatzip.com" 1; + "~*greendream.com.ua" 1; + "~*green-tea.tv" 1; + "~*gribkovye-zabolevaniya.com" 1; + "~*gribokstop.com" 1; + "~*grizzlysgrill.com" 1; + "~*groupmoney.ru" 1; + "~*growmyfunds.ca" 1; + "~*growshop.es" 1; + "~*grupografico-pilar.com.ar" 1; + "~*gsasearchengineranker.pw" 1; + "~*gsasearchengineranker.site" 1; + "~*gsasearchengineranker.space" 1; + "~*gsasearchengineranker.top" 1; + "~*gsasearchengineranker.xyz" 1; + "~*gsbs.com.ua" 1; + "~*gsmlab.pl" 1; + "~*gsmtlf.ru" 1; + "~*g.starmoe.xyz" 1; + "~*gstatey.net" 1; + "~*gta-club.ru" 1; + "~*gta-top.ru" 1; + "~*gtopstats.com" 1; + "~*guardlink.org" 1; + "~*guitar-master.org" 1; + "~*gungamesz.com" 1; + "~*guod.me" 1; + "~*guruofcasino.com" 1; + "~*gwebtools.com" 1; + "~*gwebtools.com.br" 1; + "~*gwhwpxbw.bloger.index.hr" 1; + "~*gyffu.com" 1; + "~*h2monline.com" 1; + "~*hacktougroup.ru" 1; + "~*hahashka.ru" 1; + "~*haikuware.com" 1; + "~*handicapbathtubarea.com" 1; + "~*handicapvansarea.com" 1; + "~*handicapvantoday.com" 1; + "~*handmadepics.net" 1; + "~*handsandlegs.ru" 1; + "~*hanink.biz.ly" 1; + "~*hasfun.com" 1; + "~*hauleddes.com" 1; + "~*havepussy.com" 1; + "~*hayate.biz" 1; + "~*hazardky.net" 1; + "~*hd720kino.ru" 1; + "~*hdapp1008-a.akamaihd.net" 1; + "~*hd-film.pl" 1; + "~*hd-filmy.net" 1; + "~*hdfreeporno.net" 1; + "~*hdimagegallery.net" 1; + "~*hdimagelib.com" 1; + "~*hdmoviecamera.net" 1; + "~*hdmoviecams.com" 1; + "~*hdpixent.com" 1; + "~*hdpixion.com" 1; + "~*hdseriale.pl" 1; + "~*hdwalls.xyz" 1; + "~*hdxnxxtube.mobi" 1; + "~*healbio.ru" 1; + "~*healgastro.com" 1; + "~*healing-dysplasia.ru" 1; + "~*healmytrauma.info" 1; + "~*heartofbeijing.blogspot.com" 1; + "~*heatpower.ru" 1; + "~*hebr.myddns-flir.com" 1; + "~*helicalpile.us" 1; + "~*hellokittyimg.com" 1; + "~*helpmymacfaster.trade" 1; + "~*helvetia.com.ua" 1; + "~*hem.passagen.se" 1; + "~*herehloadibs.cf" 1; + "~*hermesbirkinhandbagoutlets.com" 1; + "~*herokuapp.com" 1; + "~*hetmanship.xyz" 1; + "~*hidefiles.org" 1; + "~*hidemyass.com" 1; + "~*hifidesign.ru" 1; + "~*highland-homes.com" 1; + "~*highstairs-a.akamaihd.net" 1; + "~*histats.com" 1; + "~*historichometeam.com" 1; + "~*hitsbox.info" 1; + "~*hiwibyh.bugs3.com" 1; + "~*hjaoopoa.top" 1; + "~*hkdiiohi.skyrock.com" 1; + "~*hledejvshopech.cz" 1; + "~*hmmm.cz" 1; + "~*hmywwogw.bloger.index.hr" 1; + "~*hobild.net" 1; + "~*hol.es" 1; + "~*holidaypics.org" 1; + "~*hollywoodactress.info" 1; + "~*homeandhealth.ru" 1; + "~*homedecorpicture.us" 1; + "~*homedo.fabpage.com" 1; + "~*homegardenlova.com" 1; + "~*homeinns.com" 1; + "~*homelygarden.com" 1; + "~*homemade.gq" 1; + "~*home.myplaycity.com" 1; + "~*hoporno.com" 1; + "~*horoshieokna.com" 1; + "~*horseimg.com" 1; + "~*hostcritique.com" 1; + "~*hoste.octopis.com" 1; + "~*hostingclub.lk" 1; + "~*hosting-tracker.com" 1; + "~*hostnow.men" 1; + "~*host-protection.com" 1; + "~*hostsshop.ru" 1; + "~*hotblog.top" 1; + "~*hotchatdate.com" 1; + "~*hotdl.in" 1; + "~*hotenergy.ru" 1; + "~*hothor.se" 1; + "~*hotloans.ru" 1; + "~*hotshoppymac.com" 1; + "~*houdom.net" 1; + "~*housediz.com" 1; + "~*housekuba.org" 1; + "~*housemilan.ru" 1; + "~*houseofgaga.ru" 1; + "~*houseofrose.com" 1; + "~*house.sieraddns.com" 1; + "~*houston-vikings.com" 1; + "~*hoverboard360.at" 1; + "~*hoverboard360.de" 1; + "~*hoverboard360.es" 1; + "~*hoverboard360.nl" 1; + "~*hoverboard360.se" 1; + "~*hoverboardforsaledirect.com" 1; + "~*howlongdoestizanidinestayinyoursystem.blogspot.com" 1; + "~*howmuchdoestizanidinecost.blogspot.com" 1; + "~*howopen.ru" 1; + "~*hplaserjetpdriver8y.pen.io" 1; + "~*hptwaakw.blog.fc2.com" 1; + "~*hscsscotland.com" 1; + "~*hspline.com" 1; + "~*htmlcorner.com" 1; + "~*hubbble.com" 1; + "~*huhn.altervista.org" 1; + "~*hully.altervista.org" 1; + "~*humanorightswatch.org" 1; + "~*hundejo.com" 1; + "~*husky-shop.cz" 1; + "~*hustoon.over-blog.com" 1; + "~*hvd-store.com" 1; + "~*hydropump.su" 1; + "~*hyiphunter.org" 1; + "~*hyipmanager.in" 1; + "~*hystersister.com" 1; + "~*i4track.net" 1; + "~*iamsport.org" 1; + "~*ibb.com.ua" 1; + "~*icaseclub.ru" 1; + "~*ico.re" 1; + "~*ictizanidinehcl4mg.blogspot.com" 1; + "~*idc.com.ua" 1; + "~*idealtits.net" 1; + "~*ideaspicz.com" 1; + "~*idegenvezeto.eu" 1; + "~*ideibiznesa2015.ru" 1; + "~*ideoworld.org" 1; + "~*ie.57883.net" 1; + "~*ifirestarter.ru" 1; + "~*iflycapetown.co.za" 1; + "~*ifmo.ru" 1; + "~*igadgetsworld.com" 1; + "~*igrovyeavtomaty777.ru" 1; + "~*igru-xbox.net" 1; + "~*iinstalll-fii1leis.jus0wil.pp.ua" 1; + "~*iklysha.ml" 1; + "~*ilikevitaly.com" 1; + "~*ilmen.net" 1; + "~*ilovevitaly.com" 1; + "~*ilovevitaly.ru" 1; + "~*imabase.com" 1; + "~*imagecoolpub.com" 1; + "~*imagerydatabase.com" 1; + "~*images-graphics-pics.com" 1; + "~*imediadesk.com" 1; + "~*imgarcade.com" 1; + "~*imgata.com" 1; + "~*imgresult.com" 1; + "~*iminent.com" 1; + "~*imitex-plus.ru" 1; + "~*immobiliaremassaro.com" 1; + "~*imperia31.ru" 1; + "~*imperiafilm.ru" 1; + "~*import-sales.com" 1; + "~*impresagaia.it" 1; + "~*inbabes.sexushost.com" 1; + "~*inboundlinks.win" 1; + "~*inboxdollars.com" 1; + "~*incolors.club" 1; + "~*increasewwwtraffic.info" 1; + "~*indetiske.ya.ru" 1; + "~*indiakino.net" 1; + "~*indiasourcemart.in" 1; + "~*indo-export.ru" 1; + "~*inductionc2oktop.com" 1; + "~*infazavr.ru" 1; + "~*infobabki.ru" 1; + "~*infokonkurs.ru" 1; + "~*informatiecentro.be" 1; + "~*infostatsvc.com" 1; + "~*infowarcraft.ru" 1; + "~*inmate-locator.us" 1; + "~*innodgfdriverhm.aircus.com" 1; + "~*insomniagamingfestival.com" 1; + "~*insta-add.pro" 1; + "~*intelhdgraphicsgtdrive6w.metroblog.com" 1; + "~*interesnie-faktu.ru" 1; + "~*interfucks.net" 1; + "~*interior-stickers.ru" 1; + "~*intermesh.net" 1; + "~*internet-apteka.ru" 1; + "~*internetartfair.com" 1; + "~*intervsem.ru" 1; + "~*intimshop-fantasy.ru" 1; + "~*investingclub.ru" 1; + "~*invest-pamm.ru" 1; + "~*investpamm.ru" 1; + "~*investsuccess.org" 1; + "~*investyb.com" 1; + "~*investzalog.ru" 1; + "~*invivo.hu" 1; + "~*inzn.ru" 1; + "~*io9.com" 1; + "~*iomoio.net" 1; + "~*iopeninghours.co.uk" 1; + "~*iplogger.org" 1; + "~*iplusbit.blogspot.co.za" 1; + "~*ipostroika.ru" 1; + "~*iptool.xyz" 1; + "~*iqbazar.ru" 1; + "~*iqoption-bin.com" 1; + "~*iqoption.com" 1; + "~*iqoption.pro" 1; + "~*iqs.biz.ua" 1; + "~*iradiology.ru" 1; + "~*irunfar.com" 1; + "~*i-service.kz" 1; + "~*isistaylorporn.info" 1; + "~*iskalko.ru" 1; + "~*islandminingsupply.wordpress.com" 1; + "~*isoveti.ru" 1; + "~*ispaniya-costa-blanca.ru" 1; + "~*istanbulit.com" 1; + "~*istizanidineacontrolledsubstance.blogspot.com" 1; + "~*istizanidineanarcoticdrug.blogspot.com" 1; + "~*istizanidineanopiate.blogspot.com" 1; + "~*istizanidinelikexanax.blogspot.com" 1; + "~*istmira.ru" 1; + "~*istock-mebel.ru" 1; + "~*itbc.kiev.ua" 1; + "~*itis4you.com" 1; + "~*it-max.com.ua" 1; + "~*itrevolution.cf" 1; + "~*itronics.ca" 1; + "~*itsdp3.com" 1; + "~*itservicesthatworkforyou.com" 1; + "~*ix20.ru" 1; + "~*izhevsk.xrus.org" 1; + "~*izismile.com" 1; + "~*izoll.ru" 1; + "~*jamiembrown.com" 1; + "~*janettabridal.com" 1; + "~*japfm.com" 1; + "~*jasonpartington.com" 1; + "~*javatex.co.id" 1; + "~*javitas.info" 1; + "~*javrip.net" 1; + "~*jaxcube.info" 1; + "~*jennyfire.ru" 1; + "~*jerseychinabizwholesale.com" 1; + "~*jerseychinabizwholesale.us" 1; + "~*jerseysbizwholesalecheap.com" 1; + "~*jerseyschinabizwholesale.us" 1; + "~*jerseyswholesalechinalimited.com" 1; + "~*jerseywholesalebizchina.com" 1; + "~*jerseywholesalechinabiz.com" 1; + "~*jerseywholesaleelitestore.com" 1; + "~*jjbabskoe.ru" 1; + "~*joingames.org" 1; + "~*jongose.ninja" 1; + "~*journalhome.com" 1; + "~*jpcycles.com" 1; + "~*j-times.ru" 1; + "~*juliadiets.com" 1; + "~*juliaworld.net" 1; + "~*jumptap.com" 1; + "~*jus0wil.pp.ua" 1; + "~*justdating.online" 1; + "~*kaac.ru" 1; + "~*kabbalah-red-bracelets.com" 1; + "~*kadashihotel.com" 1; + "~*kalb.ru" 1; + "~*kamagragelusa.net" 1; + "~*kambasoft.com" 1; + "~*kamen-e.ru" 1; + "~*kamorel.com" 1; + "~*kanimage.com" 1; + "~*karachev-city.ru" 1; + "~*karadene.com" 1; + "~*karusel-market.ru" 1; + "~*kashubadesign.ru" 1; + "~*katjimej.blog.fc2.com" 1; + "~*katushka.net" 1; + "~*kazan.xrus.org" 1; + "~*kazinogames.lv" 1; + "~*kaz.kz" 1; + "~*kazrent.com" 1; + "~*ketoanhanoi.info" 1; + "~*ketrzyn.pl" 1; + "~*keywordhut.com" 1; + "~*keywordsking.com" 1; + "~*keywords-monitoring-success.com" 1; + "~*keywords-monitoring-your-success.com" 1; + "~*keyword-suggestions.com" 1; + "~*keywordsuggest.org" 1; + "~*keywordteam.net" 1; + "~*kfon.eu" 1; + "~*kidd.reunionwatch.com" 1; + "~*kiev.ua" 1; + "~*kihi.gdn" 1; + "~*kiinomaniak.pl" 1; + "~*kinobaks.com" 1; + "~*kinobest.pl" 1; + "~*kinocccp.net" 1; + "~*kinofak.net" 1; + "~*kino-filmi.com" 1; + "~*kinoflux.net" 1; + "~*kino-fun.ru" 1; + "~*kinogolos.ru" 1; + "~*kinogonew.ru" 1; + "~*kinohall.ru" 1; + "~*kinohit1.ru" 1; + "~*kino-key.info" 1; + "~*kinomaniatv.pl" 1; + "~*kinoplen.ru" 1; + "~*kinopolet.net" 1; + "~*kino-rating.ru" 1; + "~*kinostorm.net" 1; + "~*kinotorka.ru" 1; + "~*kiprinform.com" 1; + "~*kiwe-analytics.com" 1; + "~*kiwi237au.tk" 1; + "~*kladrus.ru" 1; + "~*kletkimehan.ru" 1; + "~*kmd-pto.ru" 1; + "~*kmgamex.cf" 1; + "~*kndxbkdx.bloger.index.hr" 1; + "~*knigonosha.net" 1; + "~*knogg.net" 1; + "~*kochanelli.com" 1; + "~*kol-energo.ru" 1; + "~*koleso24.com.ua" 1; + "~*kollesa.ru" 1; + "~*kolotiloff.ru" 1; + "~*komp-pomosch.ru" 1; + "~*komputernaya-pomosh-moscow.ru" 1; + "~*komputers-best.ru" 1; + "~*kongoultry.net" 1; + "~*kongruan.com" 1; + "~*konkursov.net" 1; + "~*konoplisemena.com" 1; + "~*konteiner24.com" 1; + "~*konturkrasoty.ru" 1; + "~*koopilka.com" 1; + "~*koptims.tiu.ru" 1; + "~*koronirealestate.gr" 1; + "~*kosova.de" 1; + "~*kosynka-games.ru" 1; + "~*kovesszucs.atw.hu" 1; + "~*krafte.ru" 1; + "~*kraljeva-sutjeska.com" 1; + "~*krasivoe-hd.com" 1; + "~*krasivoe-hd.net" 1; + "~*krasivye-devushki.net" 1; + "~*krasnodar-avtolombards.ru" 1; + "~*krasnodar.ru" 1; + "~*krasnodar.xrus.org" 1; + "~*kredit-pod-zalog-krasnodar.ru" 1; + "~*krynica.info" 1; + "~*ks1234.com" 1; + "~*ktotut.net" 1; + "~*kumuk.info" 1; + "~*kung-fu-ru.com" 1; + "~*kupit-adenu.ru" 1; + "~*kursy-ege.ru" 1; + "~*kustanay.kz" 1; + "~*kutikomi.net" 1; + "~*kvartira-sutochno.com" 1; + "~*kvartir-remont.biz" 1; + "~*kvartiry-remont.ucoz.ru" 1; + "~*kw21.org" 1; + "~*kwzf.net" 1; + "~*labplus.ru" 1; + "~*labvis.host.sk" 1; + "~*ladov.ru" 1; + "~*la-fa.ru" 1; + "~*lafourmiliaire.com" 1; + "~*lakesimg.com" 1; + "~*lampokrat.ws" 1; + "~*lanadelreyfans.us" 1; + "~*lanasshop.ru" 1; + "~*lancheck.net" 1; + "~*landreferat.ru" 1; + "~*languagecode.com" 1; + "~*lankarns.com" 1; + "~*laparfumotec.com" 1; + "~*lapitec.eu" 1; + "~*laptoper.net" 1; + "~*larchik.net" 1; + "~*larutti.ru" 1; + "~*laudit.ru" 1; + "~*law-check-eight.xyz" 1; + "~*law-check-nine.xyz" 1; + "~*law-check-seven.xyz" 1; + "~*law-check-two.xyz" 1; + "~*laxdrills.com" 1; + "~*layola.biz.tc" 1; + "~*lazy-z.com" 1; + "~*leadwayau.com" 1; + "~*leboard.ru" 1; + "~*ledis.top" 1; + "~*ledpolice.ru" 1; + "~*legalrc.biz" 1; + "~*lego4x4.ru" 1; + "~*legoimg.com" 1; + "~*lenvred.org" 1; + "~*lernur.net" 1; + "~*lesbian.xyz" 1; + "~*lescinq.com" 1; + "~*letolove.ru" 1; + "~*letto.by" 1; + "~*levaquin750mg.blogspot.com" 1; + "~*lexaprogeneric.link" 1; + "~*lezbiyanki.net" 1; + "~*lflash.ru" 1; + "~*lida-ru.com" 1; + "~*lider-zhaluzi.kiev.ua" 1; + "~*li-er.ru" 1; + "~*life.biz.ua" 1; + "~*lifebyleese.com" 1; + "~*life-instyle.com" 1; + "~*light.ifmo.ru" 1; + "~*lightinghomes.net" 1; + "~*likesdesign.com" 1; + "~*likesuccess.com" 1; + "~*liky.co.ua" 1; + "~*limads.men" 1; + "~*limtu.ifmo.ru" 1; + "~*lincolntheatre.com" 1; + "~*linerdrilling.com" 1; + "~*linkarena.com" 1; + "~*linkbolic.com" 1; + "~*linkrr.com" 1; + "~*liquimondo.com" 1; + "~*lirunet.ru" 1; + "~*lisque.batcave.net" 1; + "~*littleberry.ru" 1; + "~*liupis.com" 1; + "~*livefixer.com" 1; + "~*liveinternet.ru" 1; + "~*liverpool.gsofootball.com" 1; + "~*live-sexchat.ru" 1; + "~*liveshoppersmac.com" 1; + "~*livetsomudvekslingstudent.bloggersdelight.dk" 1; + "~*livingcanarias.com" 1; + "~*livingroomdecor.info" 1; + "~*llastbuy.ru" 1; + "~*lmrauction.com" 1; + "~*loadopia.com" 1; + "~*lob.com.ru" 1; + "~*lockerz.com" 1; + "~*locksmith.jp" 1; + "~*lodki-pvh.dp.ua" 1; + "~*loginduepunti.it" 1; + "~*lol-smurfs.com" 1; + "~*lombardfinder.ru" 1; + "~*lomb.co" 1; + "~*lombia.co" 1; + "~*lombia.com" 1; + "~*lomza.info" 1; + "~*longgreen.info" 1; + "~*lost-alpha.ru" 1; + "~*lostfilm-online.ru" 1; + "~*lotto6888.com" 1; + "~*lottospring.com" 1; + "~*love-baby.cz" 1; + "~*lowephotos.info" 1; + "~*low-format.ru" 1; + "~*lsex.xyz" 1; + "~*lubetube.com" 1; + "~*luckyshop.net.ua" 1; + "~*lumb.co" 1; + "~*lutherstable.org" 1; + "~*luxmagazine.cf" 1; + "~*luxup.ru" 1; + "~*m1media.net" 1; + "~*m4ever.net" 1; + "~*mabdoola.blogspot.com" 1; + "~*macdamaged.space" 1; + "~*macdamaged.tech" 1; + "~*mackeeper-center.club" 1; + "~*macnewtech.com" 1; + "~*macresource.co.uk" 1; + "~*madot.onlinewebshop.net" 1; + "~*mafcards.ru" 1; + "~*magazin-pics.ru" 1; + "~*magazintiande.ru" 1; + "~*magda-gadalka.ru" 1; + "~*magento-crew.net" 1; + "~*magicalfind-a.akamaihd.net" 1; + "~*magicdiet.gq" 1; + "~*magicplayer-s.acestream.net" 1; + "~*maglid.ru" 1; + "~*mail.allnews24.in" 1; + "~*mainlinehobby.net" 1; + "~*makedo.ru" 1; + "~*make-money-online.com" 1; + "~*makemoneyonline.com" 1; + "~*maladot.com" 1; + "~*malls.com" 1; + "~*mall.uk" 1; + "~*malwareremovalcenter.com" 1; + "~*manipulyator-peterburg.ru" 1; + "~*mantramusic.ru" 1; + "~*manualterap.roleforum.ru" 1; + "~*manuscript.su" 1; + "~*mapquestz.us" 1; + "~*mararoom.ru" 1; + "~*marblestyle.ru" 1; + "~*marcogrup.com" 1; + "~*marcoislandvacations.net" 1; + "~*marcowebonyodziezowe.pl" 1; + "~*maridan.com.ua" 1; + "~*marketingtechniques.info" 1; + "~*marketland.ml" 1; + "~*marktforschung-stuttgart.com" 1; + "~*marmitaco.cat" 1; + "~*martlinker.com" 1; + "~*massage-info.nl" 1; + "~*masserect.com" 1; + "~*master-muznachas.ru" 1; + "~*masterseek.com" 1; + "~*masturbate.co.uk" 1; + "~*matb3aa.com" 1; + "~*matchpal-a.akamaihd.net" 1; + "~*matematikus.info" 1; + "~*max-eclat.men" 1; + "~*maximilitary.ru" 1; + "~*maxthon.com" 1; + "~*mazda-roadsters.com" 1; + "~*mbiologi.ru" 1; + "~*mcar.in.ua" 1; + "~*mebel-alait.ru" 1; + "~*mebelcomplekt.ru" 1; + "~*mebeldekor.com.ua" 1; + "~*mecash.ru" 1; + "~*medanestesia.ru" 1; + "~*meddesk.ru" 1; + "~*medicinacom.ru" 1; + "~*medicine-4u.org" 1; + "~*medicines-choice.com" 1; + "~*medicovi.com" 1; + "~*medictube.ru" 1; + "~*medi-fitt.hu" 1; + "~*medispainstitute.com.au" 1; + "~*medizinreisen.de" 1; + "~*medkletki.ru" 1; + "~*medkritika.ru" 1; + "~*medmajor.ru" 1; + "~*medosmotr-ufa.ru" 1; + "~*meds-online24.com" 1; + "~*medtherapy.ru" 1; + "~*meduza-consult.ru" 1; + "~*med-zdorovie.com.ua" 1; + "~*meendo-free-traffic.ga" 1; + "~*megaapteka.ru" 1; + "~*mega-bony-2017.pl" 1; + "~*mega-bony2017.pl" 1; + "~*megaindex.ru" 1; + "~*megakino.net" 1; + "~*mega-polis.biz.ua" 1; + "~*megavolt.net.ua" 1; + "~*meget.co.za" 1; + "~*me-ke.com" 1; + "~*meltwater.com" 1; + "~*members.ghanaweb.com" 1; + "~*menetie.ru" 1; + "~*menhealed.net" 1; + "~*menstennisforums.com" 1; + "~*mere.host.sk" 1; + "~*merryhouse.co.uk" 1; + "~*message-warning.net" 1; + "~*mesto-x.com" 1; + "~*metabar.ru" 1; + "~*metalonly.info" 1; + "~*metarip.ru" 1; + "~*metaxalonevstizanidine.blogspot.com" 1; + "~*methodsmarketing.com" 1; + "~*mex-annushka.ru" 1; + "~*mexicotravelnet.com" 1; + "~*mhi-systems.ru" 1; + "~*mhtr.be" 1; + "~*micasainvest.com" 1; + "~*microsearch.ru" 1; + "~*microsoftportal.net" 1; + "~*microstatic.pl" 1; + "~*migente.com" 1; + "~*mikrobiologies.ru" 1; + "~*millionare.com" 1; + "~*mindbox.co.za" 1; + "~*minecraft-neo.ru" 1; + "~*minecraft-rus.org" 1; + "~*minegam.com" 1; + "~*mini.7zap.com" 1; + "~*miniads.ca" 1; + "~*minneapoliscopiers.com" 1; + "~*minyetki.ru" 1; + "~*mir-betting.ru" 1; + "~*mir-business-24.ru" 1; + "~*mir-limuzinov.ru" 1; + "~*mirmedinfo.ru" 1; + "~*mirobuvi.com.ua" 1; + "~*mirtorrent.net" 1; + "~*mirzonru.net" 1; + "~*misandesign.se" 1; + "~*missvietnam.org" 1; + "~*misswell.net" 1; + "~*misswootwoot.com" 1; + "~*mister-shop.com" 1; + "~*mistr-x.org" 1; + "~*mitcdoforumwest.org" 1; + "~*mitrasound.ru" 1; + "~*mixed-wrestling.ru" 1; + "~*mixtapetorrent.com" 1; + "~*mmog-play.ru" 1; + "~*mmoguider.ru" 1; + "~*mncrftpcs.com" 1; + "~*mnogabukaff.net" 1; + "~*mnprs.com" 1; + "~*mobilemedia.md" 1; + "~*mobot.site" 1; + "~*mobplayer.net" 1; + "~*mobplayer.ru" 1; + "~*mobsfun.net" 1; + "~*mobstarr.com" 1; + "~*mockupui.com" 1; + "~*modabutik.ru" 1; + "~*modenamebel.ru" 1; + "~*moesonce.com" 1; + "~*moi-glazki.ru" 1; + "~*mojowhois.com" 1; + "~*mokrayakiska.com" 1; + "~*mole.pluto.ro" 1; + "~*monarchfind-a.akamaihd.net" 1; + "~*monarhs.info" 1; + "~*monetizationking.net" 1; + "~*monetizer.com-01.site" 1; + "~*money-every-day.com" 1; + "~*moneymaster.ru" 1; + "~*moneytop.ru" 1; + "~*monitorwebsitespeed.com" 1; + "~*monthlywinners.com" 1; + "~*moomi-daeri.com" 1; + "~*more-letom.ru" 1; + "~*morepoweronmac.trade" 1; + "~*morf.snn.gr" 1; + "~*morlat.altervista.org" 1; + "~*moroccosurfadventures.com" 1; + "~*moscow-clining.ru" 1; + "~*moscow-region.ru" 1; + "~*moscow.xrus.org" 1; + "~*mosdverka.ru" 1; + "~*moskva.nodup.ru" 1; + "~*mosrif.ru" 1; + "~*mossmesi.com" 1; + "~*mostantikor.ru" 1; + "~*most-kerch.org" 1; + "~*mototsikl.org" 1; + "~*mountainstream.ms" 1; + "~*movaimg.com" 1; + "~*moviemail-online.co.uk" 1; + "~*movies-in-theaters.net" 1; + "~*moviezbonkerssk.cf" 1; + "~*mowser.com" 1; + "~*moxo.com" 1; + "~*moyakuhnia.ru" 1; + "~*moyaterapiya.ru" 1; + "~*moz.com" 1; + "~*mp3films.ru" 1; + "~*mp3ringtone.info" 1; + "~*mrcsa.com.au" 1; + "~*mrinsidesales.com" 1; + "~*mriyadh.com" 1; + "~*mrlmedia.net" 1; + "~*mrmoneymustache.com" 1; + "~*mrsdalloways.com" 1; + "~*mrwhite.biz" 1; + "~*msk-diplomat.com" 1; + "~*mttwtrack.com" 1; + "~*mturkcontent.com" 1; + "~*mug-na-chas-moscow.ru" 1; + "~*muizre.ru" 1; + "~*mundoaberrante.com" 1; + "~*muscle-factory.com.ua" 1; + "~*musezone.ru" 1; + "~*musezone.su" 1; + "~*musicdaddy.net" 1; + "~*musicspire.online" 1; + "~*musicstock.me" 1; + "~*music.utrolive.ru" 1; + "~*musicvidz.ru" 1; + "~*mustat.com" 1; + "~*mustwineblog.com" 1; + "~*muzaporn.com" 1; + "~*muz-baza.net" 1; + "~*muznachas-service.ru" 1; + "~*muz-shoes.ru" 1; + "~*muztops.ru" 1; + "~*my-bc.ru" 1; + "~*my-big-family.com" 1; + "~*myblogregistercm.tk" 1; + "~*mycaf.it" 1; + "~*mydeathspace.com" 1; + "~*mydirtystuff.com" 1; + "~*mydownloadengine.com" 1; + "~*mydownlodablefiles.com" 1; + "~*myfreemp3.eu" 1; + "~*myfreetutorials.com" 1; + "~*myftpupload.com" 1; + "~*myhealthcare.com" 1; + "~*myhitmp3.club" 1; + "~*myindospace.com" 1; + "~*myiptest.com" 1; + "~*mykings.pw" 1; + "~*mylesosibirsk.ru" 1; + "~*mylida.org" 1; + "~*myliveblog.ru" 1; + "~*my.opera.com" 1; + "~*myperiod.club" 1; + "~*mypets.by" 1; + "~*myplaycity.com" 1; + "~*myprintscreen.com" 1; + "~*myseoconsultant.com" 1; + "~*myshopmatemac.com" 1; + "~*mywallpaper.top" 1; + "~*na15.ru" 1; + "~*nacap.ru" 1; + "~*nagdak.ru" 1; + "~*nailsimg.com" 1; + "~*nalogovyy-kodeks.ru" 1; + "~*naperehresti.info" 1; + "~*naphukete.ru" 1; + "~*nardulan.com" 1; + "~*narkologiya-belgorod.ru" 1; + "~*narkologiya-orel.ru" 1; + "~*narkologiya-penza.ru" 1; + "~*narkologiya-peterburg.ru" 1; + "~*narkologiya-voronezh.ru" 1; + "~*narosty.com" 1; + "~*narutonaruto.ru" 1; + "~*nastroyke.net" 1; + "~*nastydollars.com" 1; + "~*nate.com" 1; + "~*na-telefon.biz" 1; + "~*naval.jislaaik.com" 1; + "~*nbsproject.ru" 1; + "~*negociosdasha.com" 1; + "~*negral.pluto.ro" 1; + "~*neobux-bg.info" 1; + "~*neodownload.webcam" 1; + "~*nerudlogistik.ru" 1; + "~*netallergy.ru" 1; + "~*netfacet.net" 1; + "~*netpics.org" 1; + "~*nevansk.ru" 1; + "~*new7ob.com" 1; + "~*new-apps.ru" 1; + "~*newhairstylesformen2014.com" 1; + "~*new-post.tk" 1; + "~*newsperuse.com" 1; + "~*newstraveller.ru" 1; + "~*newstudio.tv" 1; + "~*newtechspb.ru" 1; + "~*nextconseil.com" 1; + "~*nfljerseyscheapbiz.us" 1; + "~*nfljerseyscheapchinabiz.com" 1; + "~*nfljerseysforsalewholesaler.com" 1; + "~*ngps1.ru" 1; + "~*nhl17coins.exblog.jp" 1; + "~*nhl17coinsforps3.gratisblog.biz" 1; + "~*nibbler.silktide.com" 1; + "~*nicovideo.jp" 1; + "~*nightvision746.weebly.com" 1; + "~*niki-mlt.ru" 1; + "~*nikitsyringedrivelg.pen.io" 1; + "~*nikkiewart.ru" 1; + "~*niroo.info" 1; + "~*nl.netlog.com" 1; + "~*noclegonline.info" 1; + "~*nodup.ru" 1; + "~*nonews.co" 1; + "~*nootrino.com" 1; + "~*nordstar.pro" 1; + "~*normalegal.ru" 1; + "~*notaria-desalas.com" 1; + "~*notebook-pro.ru" 1; + "~*notfastfood.ru" 1; + "~*nottyu.xyz" 1; + "~*noumeda.com" 1; + "~*november-lax.com" 1; + "~*novgorod.xrus.org" 1; + "~*novosibirsk.xrus.org" 1; + "~*novosti-hi-tech.ru" 1; + "~*npoet.ru" 1; + "~*nsatc.net" 1; + "~*nucia.biz.ly" 1; + "~*nudepatch.net" 1; + "~*nudo.ca" 1; + "~*nufaq.com" 1; + "~*nullrefer.com" 1; + "~*nuup.info" 1; + "~*nvformula.ru" 1; + "~*nyfinance.ml" 1; + "~*nzfilecloud.weebly.com" 1; + "~*o00.in" 1; + "~*oakleyglassesonline.us" 1; + "~*oballergiya.ru" 1; + "~*obnal.org" 1; + "~*obuv-kupit.ru" 1; + "~*ochistka-stokov.ru" 1; + "~*oconto.ru" 1; + "~*o-dachnik.ru" 1; + "~*odesproperty.com" 1; + "~*odywpjtw.bloger.index.hr" 1; + "~*offer.camp" 1; + "~*offers.bycontext.com" 1; + "~*offf.info" 1; + "~*office-windows.ru" 1; + "~*offside2.5v.pl" 1; + "~*offtime.ru" 1; + "~*oil-td.ru" 1; + "~*okel.co" 1; + "~*oklogistic.ru" 1; + "~*okmusic.jp" 1; + "~*okout.ru" 1; + "~*okroshki.ru" 1; + "~*oktube.ru" 1; + "~*olvanto.ru" 1; + "~*olympescort.com" 1; + "~*omsk.xrus.org" 1; + "~*onclickpredictiv.com" 1; + "~*onclkads.com" 1; + "~*oneclickfiles.com" 1; + "~*onefilms.net" 1; + "~*one-gear.com" 1; + "~*oneshotdate.com" 1; + "~*onetravelguides.com" 1; + "~*onlainbesplatno.ru" 1; + "~*onlinadverts.com" 1; + "~*online7777.com" 1; + "~*onlinebay.ru" 1; + "~*onlinedomains.ru" 1; + "~*onlinefilmz.net" 1; + "~*online-hit.info" 1; + "~*online.ktc45.ru" 1; + "~*onlineku.com" 1; + "~*onlinemegax.com" 1; + "~*onlineserialy.ru" 1; + "~*onlineslotmaschine.com" 1; + "~*online-templatestore.com" 1; + "~*onlinetvseries.me" 1; + "~*onlinewritingjobs17.blogspot.ru" 1; + "~*online-x.ru" 1; + "~*onload.pw" 1; + "~*onlyforemont.ru" 1; + "~*onlythegames.com" 1; + "~*onlywoman.org" 1; + "~*ons-add.men" 1; + "~*onstrapon.purplesphere.in" 1; + "~*o-o-11-o-o.com" 1; + "~*o-o-6-o-o.com" 1; + "~*o-o-6-o-o.ru" 1; + "~*o-o-8-o-o.com" 1; + "~*o-o-8-o-o.ru" 1; + "~*ooo-gotovie.ru" 1; + "~*ooo-olni.ru" 1; + "~*openfrost.com" 1; + "~*openfrost.net" 1; + "~*openlibrary.org" 1; + "~*openmediasoft.com" 1; + "~*openmultipleurl.com" 1; + "~*opinionreelle.com" 1; + "~*ops.picscout.com" 1; + "~*optitrade24.com" 1; + "~*oranga.host.sk" 1; + "~*ordernorxx.com" 1; + "~*orel-reshka.net" 1; + "~*orenburg-gsm.ru" 1; + "~*oren-cats.ru" 1; + "~*orgasmus-virtual.com" 1; + "~*origin-my.ru" 1; + "~*ororodnik.goodbb.ru" 1; + "~*orsonet.ru" 1; + "~*osoznanie-narkotikam.net" 1; + "~*ossmalta.com" 1; + "~*ostrovtaxi.ru" 1; + "~*otbelivanie-zubov.com" 1; + "~*ourtherapy.ru" 1; + "~*ourville.info" 1; + "~*outfitpicz.com" 1; + "~*outpersonals.com" 1; + "~*outrageousdeal-a.akamaihd.net" 1; + "~*outshop.ru" 1; + "~*ovirus.ru" 1; + "~*ownshop.cf" 1; + "~*owohho.com" 1; + "~*oxford-book.com.ua" 1; + "~*ozas.net" 1; + "~*oz-offers.com" 1; + "~*ozoz.it" 1; + "~*paceform.com" 1; + "~*paleohub.info" 1; + "~*palvira.com.ua" 1; + "~*pammik.ru" 1; + "~*paparazzistudios.com.au" 1; + "~*paperics.com" 1; + "~*paperwritingservice17.blogspot.ru" 1; + "~*paradontozanet.ru" 1; + "~*paramountmarble.co.uk" 1; + "~*parlament.biz" 1; + "~*partner-cdn.men" 1; + "~*partner-print.men" 1; + "~*partners-ship.pro" 1; + "~*partybunny.ru" 1; + "~*pathwhelp.org" 1; + "~*pattersonsweb.com" 1; + "~*paydayloanslocal.com" 1; + "~*paydayonlinecom.com" 1; + "~*p-business.ru" 1; + "~*pc-services.ru" 1; + "~*pc-test.net" 1; + "~*pdamods.ru" 1; + "~*pearlisland.ru" 1; + "~*pechikamini.ru" 1; + "~*peekyou.com" 1; + "~*pekori.to" 1; + "~*pelfind.me" 1; + "~*penisvergrotendepillennl.ovh" 1; + "~*pensplan4u.com" 1; + "~*pensplan.com" 1; + "~*pepperstyle.ru" 1; + "~*percin.biz.ly" 1; + "~*perfection-pleasure.ru" 1; + "~*perfectpracticeweb.com" 1; + "~*perm.xrus.org" 1; + "~*perosan.com" 1; + "~*personalhoro.ru" 1; + "~*perso.wanadoo.es" 1; + "~*petedrummond.com" 1; + "~*petrovka-online.com" 1; + "~*petsblogroll.com" 1; + "~*pflexads.com" 1; + "~*pharmacyincity.com" 1; + "~*phobia.us" 1; + "~*photochki.com" 1; + "~*photo.houseofgaga.ru" 1; + "~*photokitchendesign.com" 1; + "~*photorepair.ru" 1; + "~*physfunc.ru" 1; + "~*pic2fly.com" 1; + "~*piccdata.com" 1; + "~*piccshare.com" 1; + "~*picphotos.net" 1; + "~*picscout.com" 1; + "~*picsearch.com" 1; + "~*picsfair.com" 1; + "~*pics-group.com" 1; + "~*picture-group.com" 1; + "~*picturesfrom.com" 1; + "~*picturesify.com" 1; + "~*picturesmania.com" 1; + "~*pigrafix.at" 1; + "~*pijoto.net" 1; + "~*pila.pl" 1; + "~*pinkduck.ga" 1; + "~*pinstake.com" 1; + "~*pintattoos.com" 1; + "~*pinwallpaper.xyz" 1; + "~*piratecams.com" 1; + "~*pirateday.ru" 1; + "~*piter.xrus.org" 1; + "~*piuminiita.com" 1; + "~*pix24x7.com" 1; + "~*pixell.club" 1; + "~*pixelrz.com" 1; + "~*pixgood.com" 1; + "~*pixhdawesom.com" 1; + "~*pix-hd.com" 1; + "~*pixsad.com" 1; + "~*pizda.lol" 1; + "~*pizdopletka.club" 1; + "~*pizza-imperia.com" 1; + "~*pizza-tycoon.com" 1; + "~*pkmnpcs.com" 1; + "~*pk-pomosch.ru" 1; + "~*pkr1hand.com" 1; + "~*pk-services.ru" 1; + "~*plastweb.ru" 1; + "~*platesauto.com" 1; + "~*platinumdeals.gr" 1; + "~*playlott.com" 1; + "~*play-movie.pl" 1; + "~*play-mp3.com" 1; + "~*pliks.pl" 1; + "~*plohaya-kreditnaya-istoriya.ru" 1; + "~*plusnetwork.com" 1; + "~*pmk-samara.ru" 1; + "~*pochemychka.net" 1; + "~*poffet.net" 1; + "~*pogodnyyeavarii.gq" 1; + "~*pogruztehnik.ru" 1; + "~*poisk-zakona.ru" 1; + "~*pokemongooo.ml" 1; + "~*pokemon-go-play.online" 1; + "~*pokerniydom.ru" 1; + "~*polcin.de" 1; + "~*pomoc-drogowa.cba.pl" 1; + "~*pony-business.com" 1; + "~*popads.net" 1; + "~*popander.mobi" 1; + "~*popcash.net" 1; + "~*poptool.net" 1; + "~*popup-fdm.xyz" 1; + "~*popup-hgd.xyz" 1; + "~*popup-jdh.xyz" 1; + "~*poquoson.org" 1; + "~*porndairy.in" 1; + "~*porngalleries.top" 1; + "~*pornhub-forum.ga" 1; + "~*pornhubforum.tk" 1; + "~*pornhub-forum.uni.me" 1; + "~*pornhub-ru.com" 1; + "~*pornmania.pl" 1; + "~*pornoblood.com" 1; + "~*pornobrazzers.biz" 1; + "~*pornodojd.ru" 1; + "~*porno-dojki.net" 1; + "~*pornofiljmi.com" 1; + "~*pornoforadult.com" 1; + "~*pornogig.com" 1; + "~*pornokajf.com" 1; + "~*pornoklad.net" 1; + "~*pornoklad.ru" 1; + "~*pornokorol.com" 1; + "~*pornolook.net" 1; + "~*pornophoto.xyz" 1; + "~*porno-play.net" 1; + "~*porno-raskazy.ru" 1; + "~*porno-transsexuals.ru" 1; + "~*pornotubexxx.name" 1; + "~*porno-video-chati.ru" 1; + "~*pornpost.in" 1; + "~*pornstartits.xblog.in" 1; + "~*porn-w.org" 1; + "~*porodasobak.net" 1; + "~*portadd.men" 1; + "~*portal-eu.ru" 1; + "~*portnoff.od.ua" 1; + "~*poshiv-chehol.ru" 1; + "~*positive2b.ru" 1; + "~*pospr.waw.pl" 1; + "~*postclass.com" 1; + "~*potoideas.us" 1; + "~*powenlite24.ru" 1; + "~*powitania.pl" 1; + "~*pozdravleniya-c.ru" 1; + "~*pozdrawleniya.com" 1; + "~*pozdrawleniya.ru" 1; + "~*pozvonim.com" 1; + "~*pp-budpostach.com.ua" 1; + "~*pr0fit-b0x.com" 1; + "~*pravoholding.ru" 1; + "~*prchecker.info" 1; + "~*preparevideosafesystem4unow.site" 1; + "~*preparevideosafesystem4unow.space" 1; + "~*pricheski-video.com" 1; + "~*printdirectforless.com" 1; + "~*printingpeach.com" 1; + "~*priora-2.com" 1; + "~*privacyassistant.net" 1; + "~*privatbank46.ru" 1; + "~*privatefx.all4invest.info" 1; + "~*privatefx-in.ru" 1; + "~*privatov-zapisi.ru" 1; + "~*privhosting.com" 1; + "~*prize44.com" 1; + "~*prizefestival.mobi" 1; + "~*prizesbook.online" 1; + "~*prlog.ru" 1; + "~*prod2016.com" 1; + "~*producm.ru" 1; + "~*productarium.com" 1; + "~*produkto.net" 1; + "~*prodvigator.ua" 1; + "~*proekt-gaz.ru" 1; + "~*proekt-mos.ru" 1; + "~*professionalwritingservices15.blogspot.ru" 1; + "~*profitsport.club" 1; + "~*proftests.net" 1; + "~*progress-upakovka.ru" 1; + "~*prohoster.info" 1; + "~*prointer.net.ua" 1; + "~*projectforte.ru" 1; + "~*projefrio.com.br" 1; + "~*prokotov.com" 1; + "~*prom23.ru" 1; + "~*promalp-universal.ru" 1; + "~*prombudpostach.com.ua" 1; + "~*promodj.com" 1; + "~*promoforum.ru" 1; + "~*promoheads.com" 1; + "~*pronekut.com" 1; + "~*pron.pro" 1; + "~*pro-okis.ru" 1; + "~*proposal-engine.com" 1; + "~*propranolol40mg.blogspot.com" 1; + "~*prosmibank.ru" 1; + "~*prosperent.com" 1; + "~*prostitutki-almata.org" 1; + "~*prostitutki-astana.org" 1; + "~*prostitutki-belgoroda.org" 1; + "~*prostitutki-kharkova.org" 1; + "~*prostitutki-kiev.org" 1; + "~*prostitutki-novgoroda.org" 1; + "~*prostitutki-odessa.org" 1; + "~*prostitutki-rostova.org" 1; + "~*prostitutki-tolyatti.org" 1; + "~*prostitutki-tyumeni.org" 1; + "~*prostitutki-yaroslavlya.org" 1; + "~*proxyradar.com" 1; + "~*pr-ten.de" 1; + "~*psa48.ru" 1; + "~*pskcijdc.bloger.index.hr" 1; + "~*psoriasis-file.trade" 1; + "~*pst2017.onlinewebshop.net" 1; + "~*psvita.ru" 1; + "~*publiccasinoil.com" 1; + "~*pufip.com" 1; + "~*pulse33.ru" 1; + "~*purchasepillsnorx.com" 1; + "~*purplesphere.in" 1; + "~*pussysaga.com" 1; + "~*puteshestvennik.com" 1; + "~*putevka24.ru" 1; + "~*putitin.me" 1; + "~*puzo2arbuza.ru" 1; + "~*puzzleweb.ru" 1; + "~*pwwysydh.com" 1; + "~*pxhdwsm.com" 1; + "~*py100.ru" 1; + "~*pyramidlitho.webs.com" 1; + "~*pyrodesigns.com.au" 1; + "~*qcstrtvt.bloger.index.hr" 1; + "~*qexyfu.bugs3.com" 1; + "~*qitt.ru" 1; + "~*qld10000.net" 1; + "~*q-moto.ru" 1; + "~*qualitymarketzone.com" 1; + "~*quality-traffic.com" 1; + "~*quebec-bin.com" 1; + "~*queen.sim-com.ru" 1; + "~*quelle.ru" 1; + "~*quickbuck.com" 1; + "~*quickloanbank.com" 1; + "~*quick-offer.com" 1; + "~*quick-seeker.com" 1; + "~*quit-smoking.ga" 1; + "~*quizzitch.net" 1; + "~*qwarckoine.com" 1; + "~*qwesa.ru" 1; + "~*rabotaetvse.ru" 1; + "~*rabot.host.sk" 1; + "~*rada.ru" 1; + "~*radiogambling.com" 1; + "~*ragecash.com" 1; + "~*raisedseo.com" 1; + "~*rank-checker.online" 1; + "~*rankchecker.online" 1; + "~*ranking2017.ga" 1; + "~*rankingchart.de" 1; + "~*rankings-analytics.com" 1; + "~*ranksays.com" 1; + "~*rankscanner.com" 1; + "~*ranksignals.com" 1; + "~*ranksonic.com" 1; + "~*ranksonic.info" 1; + "~*ranksonic.net" 1; + "~*ranksonic.org" 1; + "~*rapevideosmovies.com" 1; + "~*rapidgator-porn.ga" 1; + "~*rapidokbrain.com" 1; + "~*rasteniya-vs-zombi.ru" 1; + "~*razamicroelectronics.com" 1; + "~*razorweb-a.akamaihd.net" 1; + "~*razyboard.com" 1; + "~*rcb101.ru" 1; + "~*r-control.ru" 1; + "~*realitykings.com" 1; + "~*realmonte.net" 1; + "~*realnye-otzyvy.info" 1; + "~*real-time-analytics.com" 1; + "~*realting-moscow.ru" 1; + "~*realtytimes.com" 1; + "~*rebelmouse.com" 1; + "~*rebuildermedical.com" 1; + "~*recinziireale.com" 1; + "~*recipedays.com" 1; + "~*recipedays.ru" 1; + "~*recordpage-a.akamaihd.net" 1; + "~*rednise.com" 1; + "~*reelheroes.net" 1; + "~*referencemoi.com" 1; + "~*refererx.com" 1; + "~*regionshop.biz" 1; + "~*registratciya-v-moskve.ru" 1; + "~*reimageplus.com" 1; + "~*reklama1.ru" 1; + "~*reklama-i-rabota.ru" 1; + "~*reklamuss.ru" 1; + "~*remedyotc.com" 1; + "~*remmling.de" 1; + "~*remontbiz.ru" 1; + "~*remont-comp-pomosh.ru" 1; + "~*remont-fridge-tv.ru" 1; + "~*remontgruzovik.ru" 1; + "~*remont-komputerov-notebook.ru" 1; + "~*remont-mobile-phones.ru" 1; + "~*remont-ustanovka-tehniki.ru" 1; + "~*remorcicomerciale.ro" 1; + "~*remote-dba.de" 1; + "~*rentalmaty.kz" 1; + "~*rentehno.ru" 1; + "~*repeatlogo.co.uk" 1; + "~*replicaclub.ru" 1; + "~*replica-watch.ru" 1; + "~*resellerclub.com" 1; + "~*responsinator.com" 1; + "~*responsive-test.net" 1; + "~*respublica-otel.ru" 1; + "~*restorator-msk.ru" 1; + "~*resultshub-a.akamaihd.net" 1; + "~*retailwith.com" 1; + "~*retreatia.com" 1; + "~*reversing.cc" 1; + "~*reyel1985.webnode.fr" 1; + "~*rezeptiblud.ru" 1; + "~*rfd-split.hr" 1; + "~*rialp.getenjoyment.net" 1; + "~*richinvestmonitor.com" 1; + "~*rightenergysolutions.com.au" 1; + "~*ring4rhino.com" 1; + "~*ringporno.com" 1; + "~*rique.host.sk" 1; + "~*risparmiocasa.bz.it" 1; + "~*ritlweb.com" 1; + "~*rn-to-bsn.com" 1; + "~*robot-forex.biz" 1; + "~*rockingclicks.com" 1; + "~*roleforum.ru" 1; + "~*roma-kukareku.livejournal.com" 1; + "~*rootandroid.org" 1; + "~*ros-ctm.ru" 1; + "~*rospromtest.ru" 1; + "~*rossanasaavedra.net" 1; + "~*rossmark.ru" 1; + "~*rostov.xrus.org" 1; + "~*royal-betting.net" 1; + "~*royalcar-ufa.ru" 1; + "~*royal-investments.net" 1; + "~*royalvegascasino.com" 1; + "~*rozalli.com" 1; + "~*roznica.com.ua" 1; + "~*rp9.ru" 1; + "~*rucrypt.com" 1; + "~*ru-dety.ru" 1; + "~*ruex.org.ua" 1; + "~*rukino.org" 1; + "~*rumamba.com" 1; + "~*running-line.ru" 1; + "~*runstocks.com" 1; + "~*ruscopybook.com" 1; + "~*rusenvironmental.net" 1; + "~*rusexy.xyz" 1; + "~*rusoft-zone.ru" 1; + "~*ruspdd.com" 1; + "~*russia-today-video.ru" 1; + "~*russintv.fr" 1; + "~*russkie-gorki.ru" 1; + "~*russkoe-zdorovie.ru" 1; + "~*rus-teh.narod.ru" 1; + "~*rvtv.ru" 1; + "~*rvzr-a.akamaihd.net" 1; + "~*rybalka-opt.ru" 1; + "~*sabaapress.com" 1; + "~*sack.net" 1; + "~*sad-torg.com.ua" 1; + "~*sady-urala.ru" 1; + "~*safe-app.net" 1; + "~*sahohev.000host.co.uk" 1; + "~*saitevpatorii.com" 1; + "~*sale-japan.com" 1; + "~*saletool.ru" 1; + "~*salutmontreal.com" 1; + "~*samoiedo.it" 1; + "~*samolet.fr" 1; + "~*samo-soznanie.ru" 1; + "~*sampleletters.net" 1; + "~*sanatorrii.ru" 1; + "~*sandhillsonline.com" 1; + "~*sanjosestartups.com" 1; + "~*sankt-peterburg.nodup.ru" 1; + "~*santasgift.ml" 1; + "~*santechnik.jimdo.com" 1; + "~*sanyuprojects.com" 1; + "~*sarafangel.ru" 1; + "~*saratov.xrus.org" 1; + "~*sarf3omlat.com" 1; + "~*sarm.tk" 1; + "~*sashagreyblog.ga" 1; + "~*savefrom.com" 1; + "~*savememoney.co.za" 1; + "~*savetubevideo.com" 1; + "~*savingsslider-a.akamaihd.net" 1; + "~*savne.org" 1; + "~*sawin.beth.webd.pl" 1; + "~*sax-sex.com" 1; + "~*sayyoethe.blogspot.co.za" 1; + "~*sbdl.no" 1; + "~*sbetodiodnye-lampy.ru" 1; + "~*sbornik-zakonov.ru" 1; + "~*sbprabooks.com" 1; + "~*sbricur.com" 1; + "~*sbt-aqua.ru" 1; + "~*sbwealthsolutions.ca" 1; + "~*scalerite.co.za" 1; + "~*scanmarine.info" 1; + "~*scanmyphones.com" 1; + "~*scanner-alexa.top" 1; + "~*scanner-alex.top" 1; + "~*scanner-andrew.top" 1; + "~*scanner-barak.top" 1; + "~*scanner-brian.top" 1; + "~*scanner-donald.top" 1; + "~*scanner-don.top" 1; + "~*scanner-elena.top" 1; + "~*scanner-fred.top" 1; + "~*scanner-george.top" 1; + "~*scanner-irvin.top" 1; + "~*scanner-ivan.top" 1; + "~*scanner-jack.top" 1; + "~*scanner-jane.top" 1; + "~*scanner-jessica.top" 1; + "~*scanner-jess.top" 1; + "~*scanner-john.top" 1; + "~*scanner-josh.top" 1; + "~*scanner-julianna.top" 1; + "~*scanner-julia.top" 1; + "~*scanner-margo.top" 1; + "~*scanner-mark.top" 1; + "~*scanner-marwin.top" 1; + "~*scanner-mary.top" 1; + "~*scanner-nelson.top" 1; + "~*scanner-olga.top" 1; + "~*scanner-viktor.top" 1; + "~*scanner-walter.top" 1; + "~*scanner-walt.top" 1; + "~*scanner-willy.top" 1; + "~*scansafe.net" 1; + "~*scenarii-1-sentyabrya.uroki.org.ua" 1; + "~*scenicmissouri.us" 1; + "~*school-diplomat.ru" 1; + "~*scoopquest.com" 1; + "~*score-ads.men" 1; + "~*screentoolkit.com" 1; + "~*scripted.com" 1; + "~*sc-specialhost.com" 1; + "~*sdelai-prosto.ru" 1; + "~*sdelatmebel.ru" 1; + "~*sdi-pme.com" 1; + "~*sdrescher.net" 1; + "~*search-error.com" 1; + "~*searchinquire.com" 1; + "~*searchinterneat-a.akamaihd.net" 1; + "~*searchkut.com" 1; + "~*searchlock.com" 1; + "~*searchmywindow-a.akamaihd.net" 1; + "~*searchtooknow-a.akamaihd.net" 1; + "~*searchwebknow-a.akamaihd.net" 1; + "~*seccioncontrabajo.com" 1; + "~*secretscook.ru" 1; + "~*secret.xn--oogle-wmc.com" 1; + "~*securityallianceservices.com" 1; + "~*seeingmeerkat.com" 1; + "~*seeresultshub-a.akamaihd.net" 1; + "~*segol.tv" 1; + "~*seksotur.ru" 1; + "~*selfipicz.com" 1; + "~*semalt.com" 1; + "~*semaltmedia.com" 1; + "~*semp.net" 1; + "~*semprofile.com" 1; + "~*semrush.com" 1; + "~*senger.atspace.co.uk" 1; + "~*seo-2-0.com" 1; + "~*seoanalyses.com" 1; + "~*seocheki.net" 1; + "~*seoexperimenty.ru" 1; + "~*seofied.com" 1; + "~*seoheap.com" 1; + "~*seokicks.de" 1; + "~*seomarketings.online" 1; + "~*seo-platform.com" 1; + "~*seorank.info" 1; + "~*seorankinglinks.com" 1; + "~*seorankinglinks.us" 1; + "~*seorankinglinks.xyz" 1; + "~*seo-smm.kz" 1; + "~*seo-tools-optimizing.com" 1; + "~*serialsway.ucoz.ru" 1; + "~*serptehnika.ru" 1; + "~*servisural.ru" 1; + "~*seryeznie-znakomstva.ru" 1; + "~*sethrollins.net" 1; + "~*sexad.net" 1; + "~*sexblog.pw" 1; + "~*sex-dating.co" 1; + "~*sex.hotblog.top" 1; + "~*sexkrasivo.net" 1; + "~*sexobzor.info" 1; + "~*sexphoto.site" 1; + "~*sexreliz.com" 1; + "~*sexsaoy.com" 1; + "~*sexsearch.com" 1; + "~*sexstream.pl" 1; + "~*sex-tracker.com" 1; + "~*sextracker.com" 1; + "~*sex-tracker.de" 1; + "~*sextracker.de" 1; + "~*sexvideo-sex.com" 1; + "~*sexvporno.ru" 1; + "~*sex-watch.com" 1; + "~*sexyali.com" 1; + "~*sexy-screen-savers.com" 1; + "~*sexyteens.hol.es" 1; + "~*sexytrend.ru" 1; + "~*sfd-chess.ru" 1; + "~*shakhtar-doneck.ru" 1; + "~*sharebutton.net" 1; + "~*sharebutton.org" 1; + "~*share-buttons-for-free.com" 1; + "~*sharebutton.to" 1; + "~*shariki-zuma-lines.ru" 1; + "~*shell-pmr.ru" 1; + "~*shemalegalls.blogporn.in" 1; + "~*shemale-sex.net" 1; + "~*shiksabd.com" 1; + "~*shinikiev.com.ua" 1; + "~*ship-marvel.co.ua" 1; + "~*shisha-swag.de" 1; + "~*shitmovs.com" 1; + "~*shlyahten.ru" 1; + "~*shmetall.com.ua" 1; + "~*shodanhq.com" 1; + "~*shop.acim.org" 1; + "~*shopcheermakeup.info" 1; + "~*shop-electron.ru" 1; + "~*shoppingmiracles.co.uk" 1; + "~*shoppytoolmac.com" 1; + "~*shopvilleroyboch.com.ua" 1; + "~*shopwme.ru" 1; + "~*shop.xz618.com" 1; + "~*shtaketniki.ru" 1; + "~*shtora66.ru" 1; + "~*sibdevice.ru" 1; + "~*sibecoprom.ru" 1; + "~*sibtest.ru" 1; + "~*sibvitr.ru" 1; + "~*sicfor.bcu.cc" 1; + "~*sideeffectsoftizanidine.blogspot.com" 1; + "~*signal03.ru" 1; + "~*signx.info" 1; + "~*siha.de" 1; + "~*sildenafilcitratemed.com" 1; + "~*sildenafilgeneric.xyz" 1; + "~*silktide.com" 1; + "~*silverage.ru" 1; + "~*silvermature.net" 1; + "~*similardeals.net" 1; + "~*simplepooltips.com" 1; + "~*simple-share-buttons.com" 1; + "~*simply.net" 1; + "~*sim-service.net" 1; + "~*sims-sims.ru" 1; + "~*sindragosa.comxa.com" 1; + "~*sinel.info" 1; + "~*sinestesia.host.sk" 1; + "~*sisiynas.ru" 1; + "~*site3.free-share-buttons.com" 1; + "~*site5.com" 1; + "~*site-auditor.online" 1; + "~*sitebeam.net" 1; + "~*siteexpress.co.il" 1; + "~*siteonomy.com" 1; + "~*site-speed-checker.site" 1; + "~*site-speed-check.site" 1; + "~*sitevaluation.com" 1; + "~*sitevalued.com" 1; + "~*sitopreferito.it" 1; + "~*sivs.ru" 1; + "~*sixcooler.de" 1; + "~*skachat-besplatno-dlja-mobily.ru" 1; + "~*skachat-besplatno-obrazcy.ru" 1; + "~*sk.golden-praga.ru" 1; + "~*skhoolimg.com" 1; + "~*skincrate.net" 1; + "~*sklad-24.ru" 1; + "~*skladvaz.ru" 1; + "~*skylta.com" 1; + "~*sky-mine.ru" 1; + "~*skytraf.xyz" 1; + "~*skyway24.ru" 1; + "~*slavic-magic.ru" 1; + "~*slavkokacunko.de" 1; + "~*slayerlife.com" 1; + "~*sledstvie-veli.net" 1; + "~*slim.sellany.ru" 1; + "~*slkrm.ru" 1; + "~*slonechka.ru" 1; + "~*slowmacfaster.trade" 1; + "~*sluganarodu.ru" 1; + "~*slujbauborki.ru" 1; + "~*smailik.org" 1; + "~*small-game.com" 1; + "~*small-games.biz" 1; + "~*smart-balancewheel.com" 1; + "~*smartbalanceworld.com" 1; + "~*smartpet.ru" 1; + "~*smartphonediscount.info" 1; + "~*smartshoppymac.com" 1; + "~*smokewithrabbits.com" 1; + "~*sms2x2.ru" 1; + "~*smstraf.ru" 1; + "~*snip.tw" 1; + "~*snjack.info" 1; + "~*snjatie-geroinovoy-lomki.ru" 1; + "~*snomer1.ru" 1; + "~*snow.nvr163.com" 1; + "~*snowplanes.com" 1; + "~*snts.shell-pmr.ru" 1; + "~*snworks.com" 1; + "~*snyatie-lomki-v-stacionare.ru" 1; + "~*soaksoak.ru" 1; + "~*sobecjvuwa.com.ru" 1; + "~*soblaznu.net" 1; + "~*socas.pluto.ro" 1; + "~*soc-econom-problems.ru" 1; + "~*social-buttons.com" 1; + "~*social-buttons.xyz" 1; + "~*socialbuttons.xyz" 1; + "~*social-button.xyz" 1; + "~*social-fun.ru" 1; + "~*socialmadesimple.com" 1; + "~*socialseet.ru" 1; + "~*social-s-ggg.xyz" 1; + "~*social-s-hhh.xyz" 1; + "~*social-s-iii.xyz" 1; + "~*socialtrade.biz" 1; + "~*social-vestnik.ru" 1; + "~*soc-proof.su" 1; + "~*soda.media" 1; + "~*sodexo.com" 1; + "~*sofit-dmd.ru" 1; + "~*soft1.ru" 1; + "~*softomix.com" 1; + "~*softomix.net" 1; + "~*softonicads.com" 1; + "~*soft-program.com" 1; + "~*soft-terminal.ru" 1; + "~*softtor.com" 1; + "~*softxaker.ru" 1; + "~*soheavyblog.com" 1; + "~*sohoindia.net" 1; + "~*solitaire-game.ru" 1; + "~*solnplast.ru" 1; + "~*sonata-arctica.wz.cz" 1; + "~*songoo.wz.cz" 1; + "~*sonnikforme.ru" 1; + "~*sophang8.com" 1; + "~*sortthemesitesby.com" 1; + "~*sotkal.lark.ru" 1; + "~*soundfrost.org" 1; + "~*soup.io" 1; + "~*souvenir.cc" 1; + "~*souvenirua.com" 1; + "~*sovetogorod.ru" 1; + "~*soviet-portal.do.am" 1; + "~*spacebarnot.work" 1; + "~*spaceshipad.com" 1; + "~*space.skachat-besplatno-dlja-mobily.ru" 1; + "~*spammen.de" 1; + "~*spbchampionat.ru" 1; + "~*spb.ru" 1; + "~*special-porn.com" 1; + "~*speedup-my.site" 1; + "~*spidtest.org" 1; + "~*spin2016.cf" 1; + "~*splendorsearch-a.akamaihd.net" 1; + "~*sport7777.net" 1; + "~*sports-supplements.us" 1; + "~*sport-video-obzor.ru" 1; + "~*spravka130.ru" 1; + "~*sps-shop.com" 1; + "~*spyfu.com" 1; + "~*spy-sts.com" 1; + "~*squidoo.com" 1; + "~*srdrvp.com" 1; + "~*srecorder.com" 1; + "~*sstroy44.ru" 1; + "~*stackthatbucks.com" 1; + "~*stairliftsarea.com" 1; + "~*stairliftstrue.com" 1; + "~*star61.de" 1; + "~*stardevine.com" 1; + "~*stariy-baku.com" 1; + "~*starpages.net" 1; + "~*start.myplaycity.com" 1; + "~*startufa.ru" 1; + "~*startwp.org" 1; + "~*starwarspcs.com" 1; + "~*stats-public.grammarly.io" 1; + "~*statustroll.com" 1; + "~*stauga.altervista.org" 1; + "~*staynplay.net" 1; + "~*steame.ru" 1; + "~*steelmaster.lv" 1; + "~*stickers-market.ru" 1; + "~*stmassage.ru" 1; + "~*stockquotes.wooeb.com" 1; + "~*stoki.ru" 1; + "~*stop-gepatit.te.ua" 1; + "~*storehouse.ua" 1; + "~*strana-krasoty.ru" 1; + "~*strana-solnca.ru" 1; + "~*streetfire.net" 1; + "~*streetfooduncovered.com" 1; + "~*streha-metalko.si" 1; + "~*stretchingabuckblog.com" 1; + "~*strfls.com" 1; + "~*strigkaomsk.ru" 1; + "~*stroicol.net" 1; + "~*stroimajor.ru" 1; + "~*stroiminsk.org" 1; + "~*stromerrealty.com" 1; + "~*strongholdsb.ru" 1; + "~*strongsignal-a.akamaihd.net" 1; + "~*stroydetali.ru" 1; + "~*stroyhelp-dv.ru" 1; + "~*stroymonolit.su" 1; + "~*studiofaca.com" 1; + "~*stuff-about-money.com" 1; + "~*styro.ru" 1; + "~*success-seo.com" 1; + "~*sugarkun.com" 1; + "~*suggest-keywords.com" 1; + "~*sugvant.ru" 1; + "~*sukarame.net" 1; + "~*sukirgenk.dvrlists.com" 1; + "~*sumo.com" 1; + "~*superinterstitial.com" 1; + "~*superkanpo.com" 1; + "~*supermesta.ru" 1; + "~*supernew.org" 1; + "~*superpages.com" 1; + "~*supers.com.ua" 1; + "~*supervesti.ru" 1; + "~*surcentro.com" 1; + "~*sureone.pro" 1; + "~*surfbuyermac.com" 1; + "~*surflinksmedical.com" 1; + "~*susanholtphotography.com" 1; + "~*svarbit.com" 1; + "~*svarkagid.com" 1; + "~*svetlotorg.ru" 1; + "~*svetodiodoff.ru" 1; + "~*svtrd.com" 1; + "~*swagbucks.com" 1; + "~*swinginwithme.ru" 1; + "~*swiped.su" 1; + "~*sygraem.com" 1; + "~*syla.tk" 1; + "~*t3chtonic.com" 1; + "~*tablepicz.com" 1; + "~*tabletkinaodchudzanie.com.pl" 1; + "~*tacbelarus.ru" 1; + "~*taihouse.ru" 1; + "~*takethatad.com" 1; + "~*tako3.com" 1; + "~*tampabaywatch.org" 1; + "~*taqywu51.soup.io" 1; + "~*tarad.com" 1; + "~*tastyfoodideas.com" 1; + "~*tattogirlspix.com" 1; + "~*tattoo33.ru" 1; + "~*tattooha.com" 1; + "~*tattooreligion.ru" 1; + "~*tatz.tk" 1; + "~*taxidermy4cash.com" 1; + "~*taximytishi.ru" 1; + "~*taxi-v-eisk.ru" 1; + "~*td-33.ru" 1; + "~*teastory.co" 1; + "~*techart24.com" 1; + "~*technopellet.gr" 1; + "~*tecspb.ru" 1; + "~*tedxrj.com" 1; + "~*tedy.su" 1; + "~*teenbbw.yopoint.in" 1; + "~*tehngr.ru" 1; + "~*telegraf.by" 1; + "~*telegramdownload10.com" 1; + "~*telesvoboda.ru" 1; + "~*template-kid.com" 1; + "~*tennis-img.org" 1; + "~*terraclicks.com" 1; + "~*terrafootwear.us" 1; + "~*teslathemes.com" 1; + "~*teur.tk" 1; + "~*texbaza.by" 1; + "~*textads.men" 1; + "~*thebluenoodle.com" 1; + "~*thebluffs.com" 1; + "~*thecoolimages.net" 1; + "~*thecoral.com.br" 1; + "~*thedownloadfreeonlinegames.blogspot.com" 1; + "~*thedownloadfromwarez.blogspot.com" 1; + "~*thefarmergame.com" 1; + "~*thefds.net" 1; + "~*theguardlan.com" 1; + "~*theheroes.ru" 1; + "~*thejournal.ru" 1; + "~*thenetinfo.com" 1; + "~*thepokertimer.com" 1; + "~*thetattoohut.com" 1; + "~*thetoiletpaper.com" 1; + "~*the-torrent-tracker.blogspot.com" 1; + "~*the-usa-games.blogspot.com" 1; + "~*thewomenlife.com" 1; + "~*thfox.com" 1; + "~*thiegs.reco.ws" 1; + "~*thin.me.pn" 1; + "~*thruport.com" 1; + "~*tiandeural.ru" 1; + "~*tiens2010.ru" 1; + "~*timeallnews.ru" 1; + "~*time-japan.ru" 1; + "~*timer4web.com" 1; + "~*timetorelax.biz" 1; + "~*titslove.yopoint.in" 1; + "~*tizanidine4mg.blogspot.com" 1; + "~*tizanidine4mgprice.blogspot.com" 1; + "~*tizanidine4mgstreetprice.blogspot.com" 1; + "~*tizanidine4mgstreetvalue.blogspot.com" 1; + "~*tizanidine4mgtablets.blogspot.com" 1; + "~*tizanidine4mguses.blogspot.com" 1; + "~*tizanidine6mg.blogspot.com" 1; + "~*tizanidineandcipro.blogspot.com" 1; + "~*tizanidineandgabapentin.blogspot.com" 1; + "~*tizanidineandhydrocodone.blogspot.com" 1; + "~*tizanidinecapsules.blogspot.com" 1; + "~*tizanidinecost.blogspot.com" 1; + "~*tizanidinedosage.blogspot.com" 1; + "~*tizanidinedosageforsleep.blogspot.com" 1; + "~*tizanidinedruginteractions.blogspot.com" 1; + "~*tizanidinedrugtest.blogspot.com" 1; + "~*tizanidineduringpregnancy.blogspot.com" 1; + "~*tizanidinefibromyalgia.blogspot.com" 1; + "~*tizanidineformigraines.blogspot.com" 1; + "~*tizanidineforopiatewithdrawal.blogspot.com" 1; + "~*tizanidinehcl2mg.blogspot.com" 1; + "~*tizanidinehcl2mgsideeffects.blogspot.com" 1; + "~*tizanidinehcl2mgtablet.blogspot.com" 1; + "~*tizanidinehcl4mgisitanarcotic.blogspot.com" 1; + "~*tizanidinehcl4mgtab.blogspot.com" 1; + "~*tizanidinehcl4mgtabinfo.blogspot.com" 1; + "~*tizanidinehcl4mgtablet.blogspot.com" 1; + "~*tizanidinehclsideeffects.blogspot.com" 1; + "~*tizanidinehydrochloride2mg.blogspot.com" 1; + "~*tizanidinehydrochloride4mgstreetvalue.blogspot.com" 1; + "~*tizanidineinfo.blogspot.com" 1; + "~*tizanidineingredients.blogspot.com" 1; + "~*tizanidineinteractions.blogspot.com" 1; + "~*tizanidinemusclerelaxant.blogspot.com" 1; + "~*tizanidinenarcotic.blogspot.com" 1; + "~*tizanidineonline.blogspot.com" 1; + "~*tizanidineoral.blogspot.com" 1; + "~*tizanidineorflexeril.blogspot.com" 1; + "~*tizanidinepain.blogspot.com" 1; + "~*tizanidinepills.blogspot.com" 1; + "~*tizanidinerecreationaluse.blogspot.com" 1; + "~*tizanidinerestlesslegsyndrome.blogspot.com" 1; + "~*tizanidineshowupondrugtest.blogspot.com" 1; + "~*tizanidinesideeffects.blogspot.com" 1; + "~*tizanidinesideeffectsweightloss.blogspot.com" 1; + "~*tizanidinesleepaid.blogspot.com" 1; + "~*tizanidinestreetprice.blogspot.com" 1; + "~*tizanidinestreetvalue.blogspot.com" 1; + "~*tizanidineusedfor.blogspot.com" 1; + "~*tizanidinevscyclobenzaprine.blogspot.com" 1; + "~*tizanidinevssoma.blogspot.com" 1; + "~*tizanidinevsvalium.blogspot.com" 1; + "~*tizanidinewithdrawal.blogspot.com" 1; + "~*tizanidinewithdrawalsymptoms.blogspot.com" 1; + "~*tizanidinezanaflex.blogspot.com" 1; + "~*tjkckpytpnje.com" 1; + "~*tkanorganizma.ru" 1; + "~*tksn.ru" 1; + "~*tmm-kurs.ru" 1; + "~*tnctrx.com" 1; + "~*todohr.com" 1; + "~*toloka.hurtom.com" 1; + "~*tomatis.gospartner.com" 1; + "~*tomck.com" 1; + "~*toolsky.com" 1; + "~*tootoo.to" 1; + "~*top10-way.com" 1; + "~*top1-seo-service.com" 1; + "~*top250movies.ru" 1; + "~*topads.men" 1; + "~*topappspro.com" 1; + "~*topclickguru.com" 1; + "~*top-karkas.ru" 1; + "~*topmira.com" 1; + "~*topquality.cf" 1; + "~*topshef.ru" 1; + "~*topvidos.ru" 1; + "~*torontoplumbinggroup.com" 1; + "~*torrent-newgames.com" 1; + "~*torrents.cd" 1; + "~*torrents-tracker.com" 1; + "~*torrnada.ru" 1; + "~*torture.ml" 1; + "~*touchmods.fr" 1; + "~*tourismvictoria.com" 1; + "~*tour-line.net" 1; + "~*tovaroboom.vast.ru" 1; + "~*toxicwap.com" 1; + "~*toys.erolove.in" 1; + "~*tozup.com" 1; + "~*tpu.ru" 1; + "~*tracksz.co" 1; + "~*tradedeals.biz" 1; + "~*trafaret74.ru" 1; + "~*traffic100.com" 1; + "~*traffic2cash.org" 1; + "~*trafficmania.com" 1; + "~*trafficmonetize.org" 1; + "~*trafficnetzwerk.de" 1; + "~*traffique.net" 1; + "~*traffixer.com" 1; + "~*trahic.ru" 1; + "~*trahvid.com" 1; + "~*tramadolandtizanidine.blogspot.com" 1; + "~*traxdom.ru" 1; + "~*treasuretrack-a.akamaihd.net" 1; + "~*trion.od.ua" 1; + "~*tripper.de" 1; + "~*tri-slona.org" 1; + "~*triumf-realty.ru" 1; + "~*trk-4.net" 1; + "~*trkdf.com" 1; + "~*trkur.com" 1; + "~*trubywriting.com" 1; + "~*trudogolik.net" 1; + "~*truemfilelj.gq" 1; + "~*trustedhealthtips.com" 1; + "~*trustedmaccleaner.com" 1; + "~*tsan.net" 1; + "~*tsstcorpcddvdwshbbdriverfb.aircus.com" 1; + "~*tube8.com" 1; + "~*tuberkulezanet.ru" 1; + "~*tuberkuleznik.ru" 1; + "~*tuckermktg.com" 1; + "~*tula.howotorg.ru" 1; + "~*tula.mdverey.ru" 1; + "~*tupper-posuda.ru" 1; + "~*tupper-shop.ru" 1; + "~*turbo-suslik.org" 1; + "~*turist-strani.ru" 1; + "~*turizm.bz" 1; + "~*turkeyreport.tk" 1; + "~*turvgori.ru" 1; + "~*tvand.ru" 1; + "~*tversvet.ru" 1; + "~*tvoystartup.ru" 1; + "~*tv-spoty.info" 1; + "~*tvteleport.ru" 1; + "~*twelvevisionspartyofcolorado.com" 1; + "~*twiclub.in" 1; + "~*twincitiescarservice.com" 1; + "~*twinderbella.com" 1; + "~*twitlinks.com" 1; + "~*twittrading.com" 1; + "~*twittruth.com" 1; + "~*twodollarshows.com" 1; + "~*twojebook.pl" 1; + "~*twu.com.ua" 1; + "~*txxx.com" 1; + "~*tyumen.xrus.org" 1; + "~*u17795.netangels.ru" 1; + "~*ua-company.ru" 1; + "~*uamtrk.com" 1; + "~*uasb.ru" 1; + "~*ublaze.ru" 1; + "~*u-cheats.ru" 1; + "~*uchebavchehii.ru" 1; + "~*uchil.net" 1; + "~*ucoz.ru" 1; + "~*ucsol.ru" 1; + "~*udsgame.online" 1; + "~*ufa.xrus.org" 1; + "~*uhdtv.website" 1; + "~*uhodzalijami.ru" 1; + "~*uhod-za-sobakoj.ru" 1; + "~*ukrup.com" 1; + "~*ultimateclassicrock.com" 1; + "~*ultimatesetnewfreeallsoftupgradesystems.pw" 1; + "~*ultramart.biz" 1; + "~*umg-stroy.ru" 1; + "~*umityangin.net" 1; + "~*um-razum.ru" 1; + "~*underthesite.com" 1; + "~*uni.me" 1; + "~*unimodemhalfduplefw.pen.io" 1; + "~*unitygame3d.com" 1; + "~*universals.com.ua" 1; + "~*unmaroll.ya.ru" 1; + "~*unpredictable.ga" 1; + "~*uogonline.com" 1; + "~*upstore.me" 1; + "~*uptime-alpha.net" 1; + "~*uptimebot.net" 1; + "~*uptimechecker.com" 1; + "~*uptime.com" 1; + "~*ural-buldozer.ru" 1; + "~*urccvfmc.bloger.index.hr" 1; + "~*url2image.com" 1; + "~*urlopener.blogspot.com.au" 1; + "~*urlopener.com" 1; + "~*uroffer.link" 1; + "~*uroki.net" 1; + "~*usadacha.net" 1; + "~*us-america.ru" 1; + "~*usdx.us" 1; + "~*userequip.com" 1; + "~*ussearche.cf" 1; + "~*ustion.ru" 1; + "~*utrolive.ru" 1; + "~*uvozdeckych.info" 1; + "~*uytmaster.ru" 1; + "~*uzungil.com" 1; + "~*v24s.net" 1; + "~*vabasa.inwtrade.com" 1; + "~*vacuumscleaner.com" 1; + "~*vadimkravtcov.ru" 1; + "~*valkiria-tk.ru" 1; + "~*valoresito.com" 1; + "~*vapmedia.org" 1; + "~*vapsy.com" 1; + "~*varikoz24.com" 1; + "~*vashsvet.com" 1; + "~*vavilone.com" 1; + "~*vbabule.net" 1; + "~*vc.ru" 1; + "~*vduplo.ru" 1; + "~*vedomstvo.net" 1; + "~*veerotech.com" 1; + "~*vegan-foods.us" 1; + "~*vegascosmetics.ru" 1; + "~*vektorpress.ru" 1; + "~*vekzdorov.ru" 1; + "~*velobikestock.com" 1; + "~*venta-prom.ru" 1; + "~*ventelnos.com" 1; + "~*vesnatehno.com" 1; + "~*vesnatehno.ru" 1; + "~*vezuviy.su" 1; + "~*vgoloveboli.net" 1; + "~*viagra.pp.ua" 1; + "~*via-gra.webstarts.com" 1; + "~*viagroid.ru" 1; + "~*viandpet.com" 1; + "~*viberdownload10.com" 1; + "~*video-chat.cn" 1; + "~*video-chat.in" 1; + "~*videochat.mx" 1; + "~*videochat.tv.br" 1; + "~*videochaty.ru" 1; + "~*video-hollywood.ru" 1; + "~*videokrik.net" 1; + "~*videooko.weebly.com" 1; + "~*video--production.com" 1; + "~*videosbox.ru" 1; + "~*videos-for-your-business.com" 1; + "~*videotuber.ru" 1; + "~*video-woman.com" 1; + "~*videtubs.pl" 1; + "~*viel.su" 1; + "~*vigrx-original.ru" 1; + "~*viktoria-center.ru" 1; + "~*vilingstore.net" 1; + "~*villacoloniale.com" 1; + "~*vinsit.ru" 1; + "~*vinylvault.co.uk" 1; + "~*vip2ch.com" 1; + "~*vip.51.la" 1; + "~*vip-dom.in" 1; + "~*vip-file.com" 1; + "~*vipms.ru" 1; + "~*vip-parfumeria.ru" 1; + "~*vipsiterip.org" 1; + "~*visa-china.ru" 1; + "~*visa-pasport.ru" 1; + "~*visionwell.com.cn" 1; + "~*vita.com.hr" 1; + "~*vitalads.net" 1; + "~*vitanail.ru" 1; + "~*viven.host.sk" 1; + "~*vizag.kharkov.ua" 1; + "~*vkak.ru" 1; + "~*vk-mus.ru" 1; + "~*vkontaktemusic.ru" 1; + "~*vkontarkte.com" 1; + "~*vksaver-all.ru" 1; + "~*vladhistory.com" 1; + "~*vladimir.xrus.org" 1; + "~*vltai.com" 1; + "~*vmnmvzsmn.over-blog.com" 1; + "~*vodaodessa.com" 1; + "~*vod.com.ua" 1; + "~*voditeltrezviy.ru" 1; + "~*vodkoved.ru" 1; + "~*volgograd.xrus.org" 1; + "~*voloomoney.com" 1; + "~*volume-pills.biz" 1; + "~*voluumtracker1.com" 1; + "~*voluumtrk.com" 1; + "~*vonradio.com" 1; + "~*voprosotvet24.ru" 1; + "~*voronezh.xrus.org" 1; + "~*vostoktrade.info" 1; + "~*vote-up.ru" 1; + "~*vozbujdenie.com" 1; + "~*vpnhowto.info" 1; + "~*vremya.eu" 1; + "~*vriel.batcave.net" 1; + "~*vrnelectro.ru" 1; + "~*vrotike.ru" 1; + "~*vsesubwaysurfers.com" 1; + "~*vseuznaem.com" 1; + "~*vtc.pw" 1; + "~*vucms.com" 1; + "~*vvon.co.uk" 1; + "~*vykup-avto-krasnodar.ru" 1; + "~*vykupavto-krasnodar.ru" 1; + "~*vzlom-na-zakaz.com" 1; + "~*w3data.co" 1; + "~*w3javascript.com" 1; + "~*w7s.ru" 1; + "~*walkme.com" 1; + "~*wallpapers-best.com" 1; + "~*wapsite.me" 1; + "~*wareseeker.com" 1; + "~*warningwar.ru" 1; + "~*warningzscaler.heraeus.com" 1; + "~*watchdogs-2.ru" 1; + "~*watch-movies.ru" 1; + "~*watchmyfb.pl" 1; + "~*watchmygf.net" 1; + "~*waterpurifier.club" 1; + "~*wdfdocando.com" 1; + "~*wdrake.com" 1; + "~*we-are-gamers.com" 1; + "~*webads.co.nz" 1; + "~*web-betting.ru" 1; + "~*web.cvut.cz" 1; + "~*webinstantservice.com" 1; + "~*webix.me" 1; + "~*webjam.com" 1; + "~*weblo.com" 1; + "~*webmasterhome.cn" 1; + "~*webmonetizer.net" 1; + "~*webnode.me" 1; + "~*webradiology.ru" 1; + "~*webs.com" 1; + "~*webscouter.net" 1; + "~*webshoppermac.com" 1; + "~*websiteaccountant.de" 1; + "~*website-analytics.online" 1; + "~*website-datenbank.de" 1; + "~*websiteexplorer.info" 1; + "~*websites-reviews.com" 1; + "~*websitevaluebot.com" 1; + "~*webtherapy.ru" 1; + "~*weburlopener.com" 1; + "~*wechatdownload10.com" 1; + "~*weclipart.com" 1; + "~*wedding0venues.tk" 1; + "~*wedding-salon.net" 1; + "~*weebly.com" 1; + "~*weekes.biz.tc" 1; + "~*weightatraining.com" 1; + "~*wejdz-tu.pl" 1; + "~*welck.octopis.com" 1; + "~*welcomeauto.ru" 1; + "~*wellcome2slovenia.ru" 1; + "~*wenimage.com" 1; + "~*weprik.ru" 1; + "~*wesharepics.com" 1; + "~*wesharepics.info" 1; + "~*wesharepics.site" 1; + "~*westsextube.com" 1; + "~*westvilletowingservices.co.za" 1; + "~*wetgames.ru" 1; + "~*whatistizanidine2mg.blogspot.com" 1; + "~*whatistizanidinehclusedfor.blogspot.com" 1; + "~*whatsappdownload10.com" 1; + "~*whatsupinfoley.com" 1; + "~*whatzmyip.net" 1; + "~*wheelchairliftsarea.com" 1; + "~*whereiskentoday.com" 1; + "~*where-toget.com" 1; + "~*whipme.yopoint.in" 1; + "~*whiteelephantwellington.com" 1; + "~*whiteproduct.com" 1; + "~*wholesalecheapjerseysfree.com" 1; + "~*wholesalejerseychinaoutlet.com" 1; + "~*wholesalejerseychinashop.com" 1; + "~*wholesalejerseys-cheapest.com" 1; + "~*wholesalejerseysgaa.com" 1; + "~*wholesalenfljerseys.us.com" 1; + "~*wholinkstome.com" 1; + "~*whos.amung.us" 1; + "~*whosonmyserver.com" 1; + "~*wikes.20fr.com" 1; + "~*wildworld.site" 1; + "~*windowssearch-exp.com" 1; + "~*wineitudes.wordpress.com" 1; + "~*wingsoffury2.com" 1; + "~*winner7777.net" 1; + "~*winterclassichockeyjerseys.com" 1; + "~*winwotgold.pl" 1; + "~*winx-play.ru" 1; + "~*wiosenny-bon-1500.pl" 1; + "~*witherrom55.eklablog.fr" 1; + "~*w-journal.ru" 1; + "~*wnoz.de" 1; + "~*womama.ru" 1; + "~*woman-h.ru" 1; + "~*woman-orgasm.ru" 1; + "~*woman-tampon.ru" 1; + "~*womenpics.net" 1; + "~*womens-journal.net" 1; + "~*womensplay.net" 1; + "~*womensterritory.ru" 1; + "~*wonderfulflowers.biz" 1; + "~*wordpresscore.com" 1; + "~*wordpress-crew.net" 1; + "~*works.if.ua" 1; + "~*worldhistory.biz" 1; + "~*worldis.me" 1; + "~*worldlovers.ru" 1; + "~*world-mmo.com" 1; + "~*wormix-cheats.ru" 1; + "~*wowas31.ucoz.ru" 1; + "~*woweb.com.ua" 1; + "~*writingservices17.blogspot.ru" 1; + "~*wrona.it" 1; + "~*wsgames.ru" 1; + "~*wstroika.ru" 1; + "~*wurr.voila.net" 1; + "~*ww1943.ru" 1; + "~*www.arenda-yeisk.ru" 1; + "~*wygraj-skiny.win" 1; + "~*wygraj-teraz.com" 1; + "~*wzgyyq.com" 1; + "~*xaijo.com" 1; + "~*xbaboon.com" 1; + "~*xblog.in" 1; + "~*xboxster.ru" 1; + "~*xcc24.pl" 1; + "~*xclicks.net" 1; + "~*xcombear.ru" 1; + "~*xdoza.com" 1; + "~*xep.info" 1; + "~*xfire.com" 1; + "~*xgftnlrt.bloger.index.hr" 1; + "~*xjlottery.com" 1; + "~*xjrul.com" 1; + "~*xkaz.org" 1; + "~*x-lime.net" 1; + "~*xlolitka.com" 1; + "~*xlovecam.com" 1; + "~*xmlinde.com" 1; + "~*xmronta.com" 1; + "~*xn--1-8sbcpb0bdm8k6a.xn--p1ai" 1; + "~*xn--24-glceagatoq7c2a6ioc.xn--p1ai" 1; + "~*xn-----6kcaacnblni5c5bicdpcmficy.xn--p1ai" 1; + "~*xn-----6kccaibs5cb8afhjrfmix2n.xn--p1ai" 1; + "~*xn------7cdbapdecfd4ak1bn0amjffj7afu3y.xn--p1ai" 1; + "~*xn-----7kcabaipgeakzcss7bjdqdwpfnhv.xn--p1ai" 1; + "~*xn-----7kceclhb4abre1b4a0ccl2fxch1a.xn--p1ai" 1; + "~*xn----7sbaaabaei0cc8aj5bj0bncejx.xn--p1ai" 1; + "~*xn----7sbahjd3btneuw1joc.xn--p1ai" 1; + "~*xn----7sbbagbq7bd5aheftfllo4m.xn--p1ai" 1; + "~*xn----7sbbahaq9bb5afgiqfliv4m.xn--p1ai" 1; + "~*xn----7sbho2agebbhlivy.xn--p1ai" 1; + "~*xn----7sbifcamovvfggw9d.xn--p1ai" 1; + "~*xn--80aaafbn2bc2ahdfrfkln6l.xn--p1ai" 1; + "~*xn--80aaagvmjabrs1aoc9luc.xn--p1ai" 1; + "~*xn--80aaaks3bbhabgbigamdr2h.xn--p1ai" 1; + "~*xn--80aafb2a.xn--p1ai" 1; + "~*xn--80aagddcgkbcqbad7amllnejg6dya.xn--p1ai" 1; + "~*xn--80aanaardaperhcem4a6i.com" 1; + "~*xn--80ab4aa2g.xn--p1ai" 1; + "~*xn--80adaggc5bdhlfamsfdij4p7b.xn--p1ai" 1; + "~*xn--80aeahghtf8ac5i.xn--p1ai" 1; + "~*xn--80aebbcbcdemfkhba4byaehoejh8dza3v.xn--p1ai" 1; + "~*xn--80ahvj9e.xn--p1ai" 1; + "~*xn--80aikhbrhr.net" 1; + "~*xn--80ajbshivpvn2i.xn--p1ai" 1; + "~*xn--80ajjbdhgmudixfjc8c5a9df8b.xn--p1ai" 1; + "~*xn--80aodinpgi.xn--p1ai" 1; + "~*xn-----8kcatubaocd1bneepefojs1h2e.xn--p1ai" 1; + "~*xn----8sbdbjgb1ap7a9c4czbh.xn--p1acf" 1; + "~*xn----8sbhefaln6acifdaon5c6f4axh.xn--p1ai" 1; + "~*xn--90acenikpebbdd4f6d.xn--p1ai" 1; + "~*xn----9sbebi2bvzr7h.xn--p1ai" 1; + "~*xn--b1adccaf1bzj.xn--p1ai" 1; + "~*xn--b1ag5cfn.xn--p1ai" 1; + "~*xn--b1agm2d.net" 1; + "~*xn--c1acygb.xn--p1ai" 1; + "~*xn--d1abj0abs9d.in.ua" 1; + "~*xn--e1aggki3c.xn--80adxhks" 1; + "~*xn--h1aakne2ba.xn--p1ai" 1; + "~*xn--h1ahbi.com.ua" 1; + "~*xn--hxazdsfy.blogspot.com" 1; + "~*xn----itbeirbjbi7bc6bh2d.xn--p1ai" 1; + "~*xn----itbkqkfiq.xn--p1ai" 1; + "~*xn--l1aengat.xn--p1ai" 1; + "~*xn--lifehacer-1rb.com" 1; + "~*xn--oogle-wmc.com" 1; + "~*xn--q1a.xn--b1aube0e.xn--c1acygb.xn--p1ai" 1; + "~*xnxxandxvideos.com" 1; + "~*xnxx-n.com" 1; + "~*xolodremont.ru" 1; + "~*xoxcenter.com" 1; + "~*x-porno.video" 1; + "~*xportvusbdriver8i.snack.ws" 1; + "~*xpresscare.ru" 1; + "~*x.rafomedia.com" 1; + "~*x-rates.ru" 1; + "~*xrus.org" 1; + "~*xsion.net" 1; + "~*x-stars.ru" 1; + "~*xtube.com" 1; + "~*xtubeporno.net" 1; + "~*xuki.us" 1; + "~*xvideosbay.com" 1; + "~*xwatt.ru" 1; + "~*xxart.ru" 1; + "~*xxxdatinglocal.us" 1; + "~*xxxguitars.com" 1; + "~*xxxnatelefon.ru" 1; + "~*xxxrus.org" 1; + "~*xxx-treker.ru" 1; + "~*xxxtube69.com" 1; + "~*xz618.com" 1; + "~*xzlive.com" 1; + "~*yaaknaa.info" 1; + "~*yaderenergy.ru" 1; + "~*yadro.ru" 1; + "~*yaminecraft.ru" 1; + "~*yatrk.xyz" 1; + "~*yeartwit.com" 1; + "~*yebocasino.com" 1; + "~*yebocasino.co.za" 1; + "~*ynymnwbm.bloger.index.hr" 1; + "~*yogamatsexpert.com" 1; + "~*yorkshireccc.com" 1; + "~*yorkshire.com" 1; + "~*youandcredit.ru" 1; + "~*youbloodyripper.com" 1; + "~*youdao.com" 1; + "~*youdesigner.kz" 1; + "~*yougetsignal.com" 1; + "~*youghbould.wordpress.com" 1; + "~*youjizz.vc" 1; + "~*youporn-forum.ga" 1; + "~*youporn-forum.uni.me" 1; + "~*youporn-ru.com" 1; + "~*youradulthosting.com" 1; + "~*youraticles.pl" 1; + "~*yourdesires.ru" 1; + "~*youresponsive.com" 1; + "~*yourothersite.com" 1; + "~*yoursearch.me" 1; + "~*yoursite.com" 1; + "~*youtoner.it" 1; + "~*youtubedownload.org" 1; + "~*yuarra.pluto.ro" 1; + "~*yubikk.info" 1; + "~*yugk.net" 1; + "~*yugo-star.ru" 1; + "~*yunque.pluto.ro" 1; + "~*yurgorod.ru" 1; + "~*yur-p.ru" 1; + "~*zahvat.ru" 1; + "~*zaidia.xhost.ro" 1; + "~*zaimhelp.ru" 1; + "~*zaim-pod-zalog-krasnodar.ru" 1; + "~*zajm-pod-zalog-nedvizhimosti.ru" 1; + "~*zajm-zalog-krasnodar.ru" 1; + "~*zakazfutbolki.com" 1; + "~*zakazvzloma.com" 1; + "~*zakon-ob-obrazovanii.ru" 1; + "~*zakonobosago.ru" 1; + "~*zaloadi.ru" 1; + "~*zaloro.com" 1; + "~*zapiszto.pl" 1; + "~*zarabotat-na-sajte.ru" 1; + "~*zarenica.net" 1; + "~*zastenchivosti.net" 1; + "~*zastroyka.org" 1; + "~*zazagames.org" 1; + "~*zdesformula.ru" 1; + "~*zdesoboi.com" 1; + "~*zebradudka.com" 1; + "~*zebramart.ru" 1; + "~*zeleznobeton.ru" 1; + "~*zerocash.msk.ru" 1; + "~*zeroredirect10.com" 1; + "~*zeroredirect11.com" 1; + "~*zeroredirect12.com" 1; + "~*zeroredirect1.com" 1; + "~*zeroredirect2.com" 1; + "~*zeroredirect5.com" 1; + "~*zeroredirect6.com" 1; + "~*zeroredirect7.com" 1; + "~*zeroredirect8.com" 1; + "~*zeroredirect9.com" 1; + "~*zeroredirect.com" 1; + "~*zhongwenlink.com" 1; + "~*zhorapankratov7.blogspot.com" 1; + "~*zigarettenonl.canalblog.com" 1; + "~*zigarettenonlinekaufen1.bloog.pl" 1; + "~*zigarettenonlinekaufen1.blox.pl" 1; + "~*zigarettenonlinekaufen2.bloog.pl" 1; + "~*zigarettenonlinekaufen2.drupalgardens.com" 1; + "~*zigarettenonlinekaufen.tumblr.com" 1; + "~*zigzog.ru" 1; + "~*zkjovpdgxivg.ga" 1; + "~*zlatnajesen.com" 1; + "~*zmoda.hostreo.com" 1; + "~*znakomstva-moskva77.ru" 1; + "~*znakomstvaonlain.ru" 1; + "~*znakomstva-piter78.ru" 1; + "~*znaniyapolza.ru" 1; + "~*zog.link" 1; + "~*zojirushi-products.ru" 1; + "~*zolotoy-lis.ru" 1; + "~*zona-aqua.ru" 1; + "~*zoominfo.com" 1; + "~*zophim.me" 1; + "~*zrizvtrnpale.tk" 1; + "~*zryydi.com" 1; + "~*zs2vm.top" 1; + "~*zscaler.net" 1; + "~*zscalerone.net" 1; + "~*zverokruh-shop.cz" 1; + "~*zvetki.ru" 1; + "~*zx6.ru" 1; + "~*zytpirwai.net" 1; +# END BAD REFERERS ### DO NOT EDIT THIS LINE AT ALL ### + +} + + +# *********************************************** +# WHITELISTING AND BLACKLISTING IP ADDRESS RANGES +# *********************************************** + +# Geo directive to deny and also whitelist certain ip addresses + +geo $validate_client { + +# ******************** +# First Our Safety Net +# ******************** + +# Anything not matching our rules is allowed through with default 0; + + default 0; + +# *********************************** +# Whitelist all your OWN IP addresses +# *********************************** + +# Whitelist all your own IP addresses from any validate_client checks +# Add all your IP addresses and ranges below (one per line) + # Use the new include file method so any further updates will no longer require you to + # have to keep putting your whitelisted IP addresses here when updating. + +# START WHITELISTED IP RANGES ### DO NOT EDIT THIS LINE AT ALL ### + include /etc/nginx/bots.d/whitelist-ips.conf; +# END WHITELISTED IP RANGES ### DO NOT EDIT THIS LINE AT ALL ### + +# *********** +# Google Bots +# *********** + +# For Safety Sake Google's Known BOT IP Ranges are all white listed in case you add +# anything lower down that you mistakenly picked up as a bad bot. + +# UA "AdsBot-Google (+http://www.google.com/adsbot.html)" +# UA "DoCoMo/2.0 N905i(c100;TB;W24H16) (compatible; Googlebot-Mobile/2.3; +http://www.google.com/bot.html)" +# UA "Googlebot-Image/1.0" +# UA "Googlebot/2.1 (+http://www.google.com/bot.html)" +# UA "Googlebot/2.1 (+http://www.googlebot.com/bot.html)" +# UA "Googlebot/Test (+http://www.googlebot.com/bot.html)" +# UA "Googlebot/Test" +# UA "Mediapartners-Google/2.1 (+http://www.googlebot.com/bot.html)" +# UA "Mediapartners-Google/2.1" +# UA "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" +# UA "SAMSUNG-SGH-E250/1.0 Profile/MIDP-2.0 Configuration/CLDC-1.1 UP.Browser/6.2.3.3.c.1.101 (GUI) MMP/2.0 (compatible; Googlebot-Mobile/2.1; +http://www.google.com/bot.html)" +# UA "gsa-crawler (Enterprise; S4-E9LJ2B82FJJAA; me@mycompany.com)" + +# START GOOGLE IP RANGES ### DO NOT EDIT THIS LINE AT ALL ### + 209.85.128.0/17 0; + 216.239.32.0/19 0; + 64.233.160.0/19 0; + 64.68.80.0/21 0; + 66.102.0.0/20 0; + 66.249.64.0/19 0; + 72.14.128.0/17 0; + 74.125.0.0/16 0; +# END GOOGLE IP RANGES ### DO NOT EDIT THIS LINE AT ALL ### + +# ********* +# Bing Bots +# ********* + +# START BING IP RANGES ### DO NOT EDIT THIS LINE AT ALL ### + 157.54.0.0/15 0; + 157.56.0.0/14 0; + 157.60.0.0/16 0; + 207.46.0.0/16 0; + 40.112.0.0/13 0; + 40.120.0.0/14 0; + 40.124.0.0/16 0; + 40.125.0.0/17 0; + 40.74.0.0/15 0; + 40.76.0.0/14 0; + 40.80.0.0/12 0; + 40.96.0.0/12 0; +# END BING IP RANGES ### DO NOT EDIT THIS LINE AT ALL ### + +# START CLOUDFLARE IP RANGES ### DO NOT EDIT THIS LINE AT ALL ### + 103.21.244.0/22 0; + 103.22.200.0/22 0; + 103.31.4.0/22 0; + 104.16.0.0/12 0; + 108.162.192.0/18 0; + 131.0.72.0/22 0; + 141.101.64.0/18 0; + 162.158.0.0/15 0; + 172.64.0.0/13 0; + 173.245.48.0/20 0; + 188.114.96.0/20 0; + 190.93.240.0/20 0; + 197.234.240.0/22 0; + 198.41.128.0/17 0; + 199.27.128.0/21 0; + 2400:cb00::/32 0; + 2405:8100::/32 0; + 2405:b500::/32 0; + 2606:4700::/32 0; + 2803:f800::/32 0; + 2a06:98c0::/29 0; + 2c0f:f248::/32 0; +# END CLOUDFLARE IP RANGES ### DO NOT EDIT THIS LINE AT ALL ### + +# Cyveillance / Qwest Communications +# ********************************** +# I am extensively researching this subject - appears to be US government involved +# and also appears to be used by all sorts of law enforcement agencies. For one they +# do not obey robots.txt and continually disguise their User-Agent strings. Time will +# tell if this is all correct or not. +# For now see - https://en.wikipedia.org/wiki/Cyveillance + +# IMPORTANT UPDATE ON Cyveillance / Qwest Communications !!! +# ********************************************************** +# I have done a lot of research on Cyveillance now and through monitoring my logs I know +# for sure what companies are using them and what they are actually looking for. +# My research has led me to understand that Cyveillance services are used by hundreds +# of companies to help them dicsover theft of copyrighted materials like images, movies +# music and other materials. I personally believe a lot of block lists who originally recommended +# blocking Cyveillance have done so to protect their torrent or p2p sites from being scanned. +# I personally have now unblocked them as image theft is a big problem of mine but if you +# do want to block Cyveillance you can simply modify the entries in the block below from "0" to "1" +# Getty Images is one such company who appears to use Cyveillance to help monitor for copyright theft. + +# If you really do want to block them change all the 0's below to 1. + +# START CYVEILLANCE BLOCK ### DO NOT EDIT THIS LINE AT ALL ### + 38.100.19.8/29 0; + 38.100.21.0/24 0; + 38.100.41.64/26 0; + 38.105.71.0/25 0; + 38.105.83.0/27 0; + 38.112.21.140/30 0; + 38.118.42.32/29 0; + 63.144.0.0/13 0; + 65.112.0.0/12 0; + 65.213.208.128/27 0; + 65.222.176.96/27 0; + 65.222.185.72/29 0; +# END CYVEILLANCE BLOCK ### DO NOT EDIT THIS LINE AT ALL ### + +# **************** +# Berkely Scanner +# **************** + +# The Berkeley University has a scanner testing all over the web sending a complex +# payload an expecting a reply from servers who are infected or who just respond to such +# a payload. The payload looks similar to this +# "$\xC9\xE1\xDC\x9B+\x8F\x1C\xE71\x99\xA8\xDB6\x1E#\xBB\x19#Hx\xA7\xFD\x0F9-" +# and is sometime VERY long. You may have noticed this in your logs. +# I support research projects and all my servers respond with an error to this type of +# string so I do not block them but if you want to block just uncomment the following line +# or email them asking them not to scan your server. They do respond. +# Visit http://169.229.3.91/ for more info + +# START BERKELEY SCANNER ### DO NOT EDIT THIS LINE AT ALL ### + 169.229.3.91 0; +# END BERKELEY SCANNER ### DO NOT EDIT THIS LINE AT ALL ### + +# ************************* +# Wordpress Theme Detectors +# ************************* + +# START WP THEME DETECTORS ### DO NOT EDIT THIS LINE AT ALL ### + 104.197.51.76 1; #makeawebsitehub.com/theme-detector/ + 108.167.189.81 1; #whatpress.net + 109.73.225.87 1; #theseotools.net/wp-theme-detector + 13.68.211.181 1; #hackertarget.com + 142.4.218.201 1; #builtwith.com (bilby.builtwith.com / monty.builtwith.com / trends.builtwith.com) + 149.56.33.22 1; #freeonlineseo.org/wordpress-theme-detector + 158.69.187.171 1; #builtwith.com + 158.69.26.58 1; #www.mythemedetector.com/detector + 162.13.185.20 1; #makeawebsitehub.com/theme-detector/ + 173.237.189.235 1; #seo-tools.freedirectorywebsites.com/wordpress-theme-detector + 173.255.210.133 1; #www.scanwp.com + 185.45.14.186 1; #whoiswp.com + 192.163.217.239 1; #scanwp.net + 192.185.4.40 1; #whatwpthemeisthat.com + 192.95.29.139 1; #seotoolstation.com/wordpress-theme-detector + 192.99.17.79 1; #builtwith.com (oscar.builtwith.com) + 198.27.69.229 1; #builtwith.com (fluffy.builtwith.com) + 198.58.124.46 1; #makeawebsitehub.com/theme-detector/ + 199.241.28.124 1; #wordpressthemedetector.org + 212.71.238.108 1; #pentest-tools.com (Vulnerability Scanner) + 37.247.121.179 1; #wpthemedetector.com + 37.60.253.215 1; #wploop.com/wordpress-theme-detector-tool/ + 45.63.68.250 1; #www.cuteseotools.net/wordpress-theme-detector + 45.79.139.191 1; #wprecon.com + 50.116.84.148 1; #detectwptheme.com + 52.87.112.125 1; #whattheme.com + 66.96.183.60 1; #www.callseotools.com/wordpress-theme-detector + 89.36.223.188 1; #www.cuteseotools.net/wordpress-theme-detector +# END WP THEME DETECTORS ### DO NOT EDIT THIS LINE AT ALL ### + +# **************************************** +# NIBBLER - SEO testing and reporting tool +# **************************************** +# See - http://nibbler.silktide.com/ + +# START NIBBLER ### DO NOT EDIT THIS LINE AT ALL ### + 52.201.238.175 1; + 52.90.20.216 1; + 54.161.247.146 1; + 54.211.214.177 1; + 54.227.194.252 1; + 54.242.239.179 1; + 54.242.250.203 1; +# END NIBBLER ### DO NOT EDIT THIS LINE AT ALL ### + + +# **************************** +# Known Bad IP's and IP Ranges +# **************************** + +# Add any other IPs or Subnets here that you wish to block +# Although any permanent blocks should be done using Fail2Ban and IPTables and not +# hampering down Nginx with all the checks against perma-banned IP's + +# START BAD IP RANGES ### DO NOT EDIT THIS LINE AT ALL ### + 104.223.37.150 1; + 104.5.92.27 1; + 109.236.83.247 1; + 137.74.49.205 1; + 137.74.49.208 1; + 146.0.74.150 1; + 148.251.54.44 1; + 149.56.151.180 1; + 149.56.232.146 1; + 150.70.0.0/16 1; + 151.80.27.90 1; + 151.80.99.90 1; + 151.80.99.91 1; + 154.16.199.144 1; + 154.16.199.34 1; + 154.16.199.48 1; + 154.16.199.78 1; + 158.69.142.34 1; + 166.62.80.172 1; + 173.212.192.219 1; + 173.234.11.105 1; + 173.234.153.106 1; + 173.234.153.30 1; + 173.234.175.68 1; + 173.234.31.9 1; + 173.234.38.25 1; + 176.126.245.213 1; + 178.238.234.1 1; + 185.100.87.238 1; + 185.115.125.99 1; + 185.119.81.11 1; + 185.119.81.63 1; + 185.119.81.77 1; + 185.119.81.78 1; + 185.130.225.65 1; + 185.130.225.66 1; + 185.130.225.83 1; + 185.130.225.90 1; + 185.130.225.94 1; + 185.130.225.95 1; + 185.130.226.105 1; + 185.153.197.103 1; + 185.159.36.6 1; + 185.47.62.199 1; + 185.62.190.38 1; + 185.70.105.161 1; + 185.70.105.164 1; + 185.85.239.156 1; + 185.85.239.157 1; + 185.86.13.213 1; + 185.86.5.199 1; + 185.86.5.212 1; + 185.92.72.88 1; + 185.93.185.11 1; + 185.93.185.12 1; + 188.209.52.101 1; + 190.152.223.27 1; + 191.96.249.29 1; + 192.69.89.173 1; + 193.201.224.205 1; + 195.154.183.190 1; + 195.229.241.174 1; + 210.212.194.60 1; + 216.218.147.194 1; + 220.227.234.129 1; + 23.253.230.158 1; + 23.89.159.176 1; + 31.170.160.209 1; + 45.32.186.11 1; + 45.76.21.179 1; + 46.249.38.145 1; + 46.249.38.146 1; + 46.249.38.148 1; + 46.249.38.149 1; + 46.249.38.150 1; + 46.249.38.151 1; + 46.249.38.152 1; + 46.249.38.153 1; + 46.249.38.154 1; + 46.249.38.159 1; + 51.255.172.22 1; + 5.39.218.232 1; + 5.39.219.24 1; + 5.39.222.18 1; + 5.39.223.134 1; + 54.213.16.154 1; + 54.213.9.111 1; + 62.210.146.49 1; + 62.210.88.4 1; + 65.98.91.181 1; + 69.162.124.237 1; + 69.64.147.24 1; + 72.8.183.202 1; + 77.247.178.191 1; + 77.247.178.47 1; + 77.247.181.219 1; + 78.31.184.0/21 1; + 78.31.211.0/24 1; + 80.87.205.10 1; + 80.87.205.11 1; + 85.17.230.23 1; + 85.17.26.68 1; + 91.185.190.172 1; + 91.200.12.0/22 1; + 91.200.12.15 1; + 91.200.12.49 1; + 91.200.12.91 1; + 92.222.66.137 1; + 93.104.209.11 1; + 93.158.200.103 1; + 93.158.200.105 1; + 93.158.200.115 1; + 93.158.200.124 1; + 93.158.200.126 1; + 93.158.200.66 1; + 93.158.200.68 1; +# END BAD IP RANGES ### DO NOT EDIT THIS LINE AT ALL ### +} + +# Keep own IPs out of DDOS Filter +# Add your own IP addresses and ranges below to spare them from the rate +# limiting DDOS filter (one per line) +geo $ratelimited { + default 1; + 127.0.0.1 0; +} + +# ***************************************** +# MAP BAD BOTS TO OUR RATE LIMITER FUNCTION +# ***************************************** + + map $bad_bot $bot_iplimit { + 0 ""; + 1 ""; + 2 $binary_remote_addr; + } + +# *********************** +# SET RATE LIMITING ZONES +# *********************** + +# BAD BOT RATE LIMITING ZONE +# limits for Zone $bad_bot = 1 +# Nothing Set - you can set a different zone limiter here if you like +# We issue a 444 response instead to all bad bots. + +# limits for Zone $bad_bot = 2 +# this rate limiting will only take effect if you change any of the bots and change +# their block value from 1 to 2. + limit_conn_zone $bot_iplimit zone=bot2_connlimit:16m; + limit_req_zone $bot_iplimit zone=bot2_reqlimitip:16m rate=2r/s; + +### *** MAKE SURE TO ADD to your nginx.conf *** +### server_names_hash_bucket_size 64; +### server_names_hash_max_size 4096; +### limit_req_zone $binary_remote_addr zone=flood:50m rate=90r/s; +### limit_conn_zone $binary_remote_addr zone=addr:50m; +### to allow it to load this large set of domains into memory and to set the rate limiting zones for the DDOS filter. + +### THE END of the Long and Winding Road + +### Also check out my Ultimate Apache Bad Bot Blocker on Github +### https://github.com/mitchellkrogza/apache-ultimate-bad-bot-blocker diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/custom_rules b/Engintron_for_cPanel_WHM_Configuration_Example/custom_rules new file mode 100755 index 000000000..223b76ce9 --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/custom_rules @@ -0,0 +1,93 @@ +##################################################################### +# === Place your custom rules for Nginx here === +# +# Some examples: +# - Engintron & CloudFlare +# - HTTP to HTTPS redirects when using CloudFlare +# - Setting up domains with dedicated IPs on the system +# - Cache exclusions for domains, subdomains or even directories +# - Any other global or domain specific rule (redirect, process etc.) +# +# For up to date info check out the Engintron wiki at: +# https://github.com/engintron/engintron/wiki +# +# *** Updated for Engintron v1.8.3 *** +# +##################################################################### + +# === FOR USE WITH CLOUDFLARE === +# +# a) If your server has a single shared IP ONLY and you wish to use CloudFlare for any (or all) of your sites +# you will have to specify this shared IP address below otherwise you'll get errors from CloudFlare. +# This change will simply tell Nginx to skip DNS resolving and simply forward traffic to the shared IP. +# Uncomment the following line if all your sites on the shared (main) IP of your server are on CloudFlare: +# +# set $PROXY_DOMAIN_OR_IP "XXX.XXX.XXX.XXX"; # Use your cPanel's shared IP address here +# +# b) If you utilize CloudFlare on a cPanel server with BOTH a shared IP and dedicated IPs for domains, you will +# have to set the IP ONLY for each such domain at the "WHEN TO SPECIFY A DOMAIN IP" section lower in this file. +# +# c) It is possible to force-redirect all your domains on CloudFlare to HTTPS if you have TLS/SSL enabled +# in CloudFlare's "Crypto" settings page. Make sure you use "Flexible SSL" there so CloudFlare proxies +# traffic from HTTPS to Nginx's HTTP port (80). This way you'll also be able to serve sites over HTTPS with +# no actual TLS/SSL certificate installed on the server, as long as they exist in CloudFlare and have +# CloudFlare's shared TLS/SSL certificate enabled there. To redirect to HTTPS, simply specify a block similar +# to the one below and make sure you set the domains you DO NOT want to automatically redirect to HTTPS. +# +# # === Protocol redirect handling when using CloudFlare [start] === +# +# set $redirToSSL ""; +# if ($http_cf_visitor ~ '{"scheme":"http"}') { +# set $redirToSSL "on"; +# } +# +# # Set each domain you DO NOT want to automatically redirect to HTTPS when using CloudFlare only below +# # and repeat the process with additional "if" blocks for more domains +# +# if ($host ~ 'domain-to-exclude-from-redirect.com') { +# set $redirToSSL "off"; +# } +# if ($redirToSSL = "on") { +# return 301 https://$host$request_uri; +# } +# +# # === Protocol redirect handling when using CloudFlare [finish] === + + + +# === WHEN TO SPECIFY A DOMAIN IP === +# By default, Nginx will redirect requests to the right domain IP by using DNS resolving. +# However there are cases where you want to specify an IP for use with Nginx: +# - When you use CloudFlare for certain domains only on your server, +# regardless of whether these domains use the server's shared IP or a dedicated IP. +# - When you are working on a domain which does not yet (DNS) resolve to your server, +# but you want to access it by modifying your computer's "hosts" file. +# +# To specify the domain IP in such cases, simply enter a domain or subdomain in an "if" block +# (as shown below) and inside that block set the appropriate shared or dedicated IP to point to. +# +# To specify the IP for a domain simply uncomment the following 3 lines and make sure you replace +# example.com with your actual domain or subdomain and also replace XXX.XXX.XXX.XXX with the actual +# IP assigned to that domain. To specify the IP for more domains, simply copy that "if" block +# (per domain) and change accordingly. +# +# if ($host ~ "example.com") { +# set $PROXY_DOMAIN_OR_IP "XXX.XXX.XXX.XXX"; +# } + + + +# === DOMAIN AND URL PATH EXCLUSIONS FROM CACHING === +# If you wish to exclude certain domains, subdomains or even full URL paths from micro-caching and/or +# static file caching, simply specify them below and use a colon (|) character as a separator. +# Remember that if you specify a "naked" domain name, e.g. mynicedomain.com, every subdomain e.g. +# support.mynicedomain.com will also be excluded from caching. Decide wisely! +# If you wish to disable ONLY micro-caching, then comment the line "set $CACHE_BYPASS_FOR_STATIC". +# If you wish to disable ONLY static file caching, then comment the line "set $CACHE_BYPASS_FOR_DYNAMIC". +# +# Note: Don't include the "http(s)://" portion of a URL. +# + if ($SITE_URI ~* "nirmoladda.com|nirmoladda.com/login|nirmoladda.com/register|nirmoladda.com/logout|nirmoladda.com/admin.php") { + set $CACHE_BYPASS_FOR_DYNAMIC 1; # Disables micro-caching +# set $CACHE_BYPASS_FOR_STATIC 1; # Disables static file caching + } diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/custom_rules.dist b/Engintron_for_cPanel_WHM_Configuration_Example/custom_rules.dist new file mode 100755 index 000000000..084986eb0 --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/custom_rules.dist @@ -0,0 +1,93 @@ +##################################################################### +# === Place your custom rules for Nginx here === +# +# Some examples: +# - Engintron & CloudFlare +# - HTTP to HTTPS redirects when using CloudFlare +# - Setting up domains with dedicated IPs on the system +# - Cache exclusions for domains, subdomains or even directories +# - Any other global or domain specific rule (redirect, process etc.) +# +# For up to date info check out the Engintron wiki at: +# https://github.com/engintron/engintron/wiki +# +# *** Updated for Engintron v1.8.3 *** +# +##################################################################### + +# === FOR USE WITH CLOUDFLARE === +# +# a) If your server has a single shared IP ONLY and you wish to use CloudFlare for any (or all) of your sites +# you will have to specify this shared IP address below otherwise you'll get errors from CloudFlare. +# This change will simply tell Nginx to skip DNS resolving and simply forward traffic to the shared IP. +# Uncomment the following line if all your sites on the shared (main) IP of your server are on CloudFlare: +# +# set $PROXY_DOMAIN_OR_IP "XXX.XXX.XXX.XXX"; # Use your cPanel's shared IP address here +# +# b) If you utilize CloudFlare on a cPanel server with BOTH a shared IP and dedicated IPs for domains, you will +# have to set the IP ONLY for each such domain at the "WHEN TO SPECIFY A DOMAIN IP" section lower in this file. +# +# c) It is possible to force-redirect all your domains on CloudFlare to HTTPS if you have TLS/SSL enabled +# in CloudFlare's "Crypto" settings page. Make sure you use "Flexible SSL" there so CloudFlare proxies +# traffic from HTTPS to Nginx's HTTP port (80). This way you'll also be able to serve sites over HTTPS with +# no actual TLS/SSL certificate installed on the server, as long as they exist in CloudFlare and have +# CloudFlare's shared TLS/SSL certificate enabled there. To redirect to HTTPS, simply specify a block similar +# to the one below and make sure you set the domains you DO NOT want to automatically redirect to HTTPS. +# +# # === Protocol redirect handling when using CloudFlare [start] === +# +# set $redirToSSL ""; +# if ($http_cf_visitor ~ '{"scheme":"http"}') { +# set $redirToSSL "on"; +# } +# +# # Set each domain you DO NOT want to automatically redirect to HTTPS when using CloudFlare only below +# # and repeat the process with additional "if" blocks for more domains +# +# if ($host ~ 'domain-to-exclude-from-redirect.com') { +# set $redirToSSL "off"; +# } +# if ($redirToSSL = "on") { +# return 301 https://$host$request_uri; +# } +# +# # === Protocol redirect handling when using CloudFlare [finish] === + + + +# === WHEN TO SPECIFY A DOMAIN IP === +# By default, Nginx will redirect requests to the right domain IP by using DNS resolving. +# However there are cases where you want to specify an IP for use with Nginx: +# - When you use CloudFlare for certain domains only on your server, +# regardless of whether these domains use the server's shared IP or a dedicated IP. +# - When you are working on a domain which does not yet (DNS) resolve to your server, +# but you want to access it by modifying your computer's "hosts" file. +# +# To specify the domain IP in such cases, simply enter a domain or subdomain in an "if" block +# (as shown below) and inside that block set the appropriate shared or dedicated IP to point to. +# +# To specify the IP for a domain simply uncomment the following 3 lines and make sure you replace +# example.com with your actual domain or subdomain and also replace XXX.XXX.XXX.XXX with the actual +# IP assigned to that domain. To specify the IP for more domains, simply copy that "if" block +# (per domain) and change accordingly. +# +# if ($host ~ "example.com") { +# set $PROXY_DOMAIN_OR_IP "XXX.XXX.XXX.XXX"; +# } + + + +# === DOMAIN AND URL PATH EXCLUSIONS FROM CACHING === +# If you wish to exclude certain domains, subdomains or even full URL paths from micro-caching and/or +# static file caching, simply specify them below and use a colon (|) character as a separator. +# Remember that if you specify a "naked" domain name, e.g. mynicedomain.com, every subdomain e.g. +# support.mynicedomain.com will also be excluded from caching. Decide wisely! +# If you wish to disable ONLY micro-caching, then comment the line "set $CACHE_BYPASS_FOR_STATIC". +# If you wish to disable ONLY static file caching, then comment the line "set $CACHE_BYPASS_FOR_DYNAMIC". +# +# Note: Don't include the "http(s)://" portion of a URL. +# +# if ($SITE_URI ~* "example.com|example2.com/path|example3.com/some/other/path|subdomain.example4.com") { +# set $CACHE_BYPASS_FOR_DYNAMIC 1; # Disables micro-caching +# set $CACHE_BYPASS_FOR_STATIC 1; # Disables static file caching +# } diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/fastcgi_params b/Engintron_for_cPanel_WHM_Configuration_Example/fastcgi_params new file mode 100755 index 000000000..28decb955 --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/fastcgi_params @@ -0,0 +1,25 @@ + +fastcgi_param QUERY_STRING $query_string; +fastcgi_param REQUEST_METHOD $request_method; +fastcgi_param CONTENT_TYPE $content_type; +fastcgi_param CONTENT_LENGTH $content_length; + +fastcgi_param SCRIPT_NAME $fastcgi_script_name; +fastcgi_param REQUEST_URI $request_uri; +fastcgi_param DOCUMENT_URI $document_uri; +fastcgi_param DOCUMENT_ROOT $document_root; +fastcgi_param SERVER_PROTOCOL $server_protocol; +fastcgi_param REQUEST_SCHEME $scheme; +fastcgi_param HTTPS $https if_not_empty; + +fastcgi_param GATEWAY_INTERFACE CGI/1.1; +fastcgi_param SERVER_SOFTWARE nginx/$nginx_version; + +fastcgi_param REMOTE_ADDR $remote_addr; +fastcgi_param REMOTE_PORT $remote_port; +fastcgi_param SERVER_ADDR $server_addr; +fastcgi_param SERVER_PORT $server_port; +fastcgi_param SERVER_NAME $server_name; + +# PHP only, required if PHP was built with --enable-force-cgi-redirect +fastcgi_param REDIRECT_STATUS 200; diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/koi-utf b/Engintron_for_cPanel_WHM_Configuration_Example/koi-utf new file mode 100755 index 000000000..e7974ff6a --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/koi-utf @@ -0,0 +1,109 @@ + +# This map is not a full koi8-r <> utf8 map: it does not contain +# box-drawing and some other characters. Besides this map contains +# several koi8-u and Byelorussian letters which are not in koi8-r. +# If you need a full and standard map, use contrib/unicode2nginx/koi-utf +# map instead. + +charset_map koi8-r utf-8 { + + 80 E282AC ; # euro + + 95 E280A2 ; # bullet + + 9A C2A0 ; #   + + 9E C2B7 ; # · + + A3 D191 ; # small yo + A4 D194 ; # small Ukrainian ye + + A6 D196 ; # small Ukrainian i + A7 D197 ; # small Ukrainian yi + + AD D291 ; # small Ukrainian soft g + AE D19E ; # small Byelorussian short u + + B0 C2B0 ; # ° + + B3 D081 ; # capital YO + B4 D084 ; # capital Ukrainian YE + + B6 D086 ; # capital Ukrainian I + B7 D087 ; # capital Ukrainian YI + + B9 E28496 ; # numero sign + + BD D290 ; # capital Ukrainian soft G + BE D18E ; # capital Byelorussian short U + + BF C2A9 ; # (C) + + C0 D18E ; # small yu + C1 D0B0 ; # small a + C2 D0B1 ; # small b + C3 D186 ; # small ts + C4 D0B4 ; # small d + C5 D0B5 ; # small ye + C6 D184 ; # small f + C7 D0B3 ; # small g + C8 D185 ; # small kh + C9 D0B8 ; # small i + CA D0B9 ; # small j + CB D0BA ; # small k + CC D0BB ; # small l + CD D0BC ; # small m + CE D0BD ; # small n + CF D0BE ; # small o + + D0 D0BF ; # small p + D1 D18F ; # small ya + D2 D180 ; # small r + D3 D181 ; # small s + D4 D182 ; # small t + D5 D183 ; # small u + D6 D0B6 ; # small zh + D7 D0B2 ; # small v + D8 D18C ; # small soft sign + D9 D18B ; # small y + DA D0B7 ; # small z + DB D188 ; # small sh + DC D18D ; # small e + DD D189 ; # small shch + DE D187 ; # small ch + DF D18A ; # small hard sign + + E0 D0AE ; # capital YU + E1 D090 ; # capital A + E2 D091 ; # capital B + E3 D0A6 ; # capital TS + E4 D094 ; # capital D + E5 D095 ; # capital YE + E6 D0A4 ; # capital F + E7 D093 ; # capital G + E8 D0A5 ; # capital KH + E9 D098 ; # capital I + EA D099 ; # capital J + EB D09A ; # capital K + EC D09B ; # capital L + ED D09C ; # capital M + EE D09D ; # capital N + EF D09E ; # capital O + + F0 D09F ; # capital P + F1 D0AF ; # capital YA + F2 D0A0 ; # capital R + F3 D0A1 ; # capital S + F4 D0A2 ; # capital T + F5 D0A3 ; # capital U + F6 D096 ; # capital ZH + F7 D092 ; # capital V + F8 D0AC ; # capital soft sign + F9 D0AB ; # capital Y + FA D097 ; # capital Z + FB D0A8 ; # capital SH + FC D0AD ; # capital E + FD D0A9 ; # capital SHCH + FE D0A7 ; # capital CH + FF D0AA ; # capital hard sign +} diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/koi-win b/Engintron_for_cPanel_WHM_Configuration_Example/koi-win new file mode 100755 index 000000000..72afabe89 --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/koi-win @@ -0,0 +1,103 @@ + +charset_map koi8-r windows-1251 { + + 80 88 ; # euro + + 95 95 ; # bullet + + 9A A0 ; #   + + 9E B7 ; # · + + A3 B8 ; # small yo + A4 BA ; # small Ukrainian ye + + A6 B3 ; # small Ukrainian i + A7 BF ; # small Ukrainian yi + + AD B4 ; # small Ukrainian soft g + AE A2 ; # small Byelorussian short u + + B0 B0 ; # ° + + B3 A8 ; # capital YO + B4 AA ; # capital Ukrainian YE + + B6 B2 ; # capital Ukrainian I + B7 AF ; # capital Ukrainian YI + + B9 B9 ; # numero sign + + BD A5 ; # capital Ukrainian soft G + BE A1 ; # capital Byelorussian short U + + BF A9 ; # (C) + + C0 FE ; # small yu + C1 E0 ; # small a + C2 E1 ; # small b + C3 F6 ; # small ts + C4 E4 ; # small d + C5 E5 ; # small ye + C6 F4 ; # small f + C7 E3 ; # small g + C8 F5 ; # small kh + C9 E8 ; # small i + CA E9 ; # small j + CB EA ; # small k + CC EB ; # small l + CD EC ; # small m + CE ED ; # small n + CF EE ; # small o + + D0 EF ; # small p + D1 FF ; # small ya + D2 F0 ; # small r + D3 F1 ; # small s + D4 F2 ; # small t + D5 F3 ; # small u + D6 E6 ; # small zh + D7 E2 ; # small v + D8 FC ; # small soft sign + D9 FB ; # small y + DA E7 ; # small z + DB F8 ; # small sh + DC FD ; # small e + DD F9 ; # small shch + DE F7 ; # small ch + DF FA ; # small hard sign + + E0 DE ; # capital YU + E1 C0 ; # capital A + E2 C1 ; # capital B + E3 D6 ; # capital TS + E4 C4 ; # capital D + E5 C5 ; # capital YE + E6 D4 ; # capital F + E7 C3 ; # capital G + E8 D5 ; # capital KH + E9 C8 ; # capital I + EA C9 ; # capital J + EB CA ; # capital K + EC CB ; # capital L + ED CC ; # capital M + EE CD ; # capital N + EF CE ; # capital O + + F0 CF ; # capital P + F1 DF ; # capital YA + F2 D0 ; # capital R + F3 D1 ; # capital S + F4 D2 ; # capital T + F5 D3 ; # capital U + F6 C6 ; # capital ZH + F7 C2 ; # capital V + F8 DC ; # capital soft sign + F9 DB ; # capital Y + FA C7 ; # capital Z + FB D8 ; # capital SH + FC DD ; # capital E + FD D9 ; # capital SHCH + FE D7 ; # capital CH + FF DA ; # capital hard sign +} diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/mime.types b/Engintron_for_cPanel_WHM_Configuration_Example/mime.types new file mode 100755 index 000000000..9f2343f19 --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/mime.types @@ -0,0 +1,105 @@ +# /** +# * @version 1.8.3 +# * @package Engintron for cPanel/WHM +# * @author Fotis Evangelou +# * @url https://engintron.com +# * @copyright Copyright (c) 2010 - 2017 Nuevvo Webware P.C. All rights reserved. +# * @license GNU/GPL license: https://www.gnu.org/copyleft/gpl.html +# */ + +types { + + text/html html htm shtml; + text/css css; + text/xml xml; + image/gif gif; + image/jpeg jpeg jpg; + application/javascript js; + application/atom+xml atom; + application/rss+xml rss; + + text/mathml mml; + text/plain txt; + text/vnd.sun.j2me.app-descriptor jad; + text/vnd.wap.wml wml; + text/x-component htc; + + image/png png; + image/tiff tif tiff; + image/vnd.wap.wbmp wbmp; + image/x-icon ico; + image/x-jng jng; + image/x-ms-bmp bmp; + image/svg+xml svg svgz; + image/webp webp; + + application/font-woff woff woff2; + application/java-archive jar war ear; + application/json json; + application/mac-binhex40 hqx; + application/msword doc; + application/pdf pdf; + application/postscript ps eps ai; + application/rtf rtf; + application/vnd.apple.mpegurl m3u8; + application/vnd.ms-excel xls; + application/vnd.ms-fontobject eot; + application/vnd.ms-powerpoint ppt; + application/vnd.wap.wmlc wmlc; + application/vnd.google-earth.kml+xml kml; + application/vnd.google-earth.kmz kmz; + application/x-7z-compressed 7z; + application/x-cocoa cco; + application/x-java-archive-diff jardiff; + application/x-java-jnlp-file jnlp; + application/x-makeself run; + application/x-perl pl pm; + application/x-pilot prc pdb; + application/x-rar-compressed rar; + application/x-redhat-package-manager rpm; + application/x-sea sea; + application/x-shockwave-flash swf; + application/x-stuffit sit; + application/x-tcl tcl tk; + application/x-x509-ca-cert der pem crt; + application/x-xpinstall xpi; + application/xhtml+xml xhtml; + application/xspf+xml xspf; + application/zip zip; + + application/octet-stream bin exe dll; + application/octet-stream deb; + application/octet-stream dmg; + application/octet-stream iso img; + application/octet-stream msi msp msm; + + application/vnd.openxmlformats-officedocument.wordprocessingml.document docx; + application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx; + application/vnd.openxmlformats-officedocument.presentationml.presentation pptx; + + audio/midi mid midi kar; + audio/mpeg mp3; + audio/ogg ogg; + audio/x-m4a m4a; + audio/x-realaudio ra; + + video/3gpp 3gpp 3gp; + video/mp2t ts; + video/mp4 mp4; + video/mpeg mpeg mpg; + video/quicktime mov; + video/webm webm; + video/x-flv flv; + video/x-m4v m4v; + video/x-mng mng; + video/x-ms-asf asx asf; + video/x-ms-wmv wmv; + video/x-msvideo avi; + + # Fonts + #application/vnd.ms-fontobject eot; + application/x-font-ttf ttf; + font/opentype otf; + #font/x-woff woff woff2; + +} diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/nginx.conf b/Engintron_for_cPanel_WHM_Configuration_Example/nginx.conf new file mode 100755 index 000000000..550ba33be --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/nginx.conf @@ -0,0 +1,134 @@ +# /** +# * @version 1.8.3 +# * @package Engintron for cPanel/WHM +# * @author Fotis Evangelou +# * @url https://engintron.com +# * @copyright Copyright (c) 2010 - 2017 Nuevvo Webware P.C. All rights reserved. +# * @license GNU/GPL license: https://www.gnu.org/copyleft/gpl.html +# */ + +user nginx; +pid /var/run/nginx.pid; + +worker_processes auto; +worker_rlimit_nofile 65535; + +events { + multi_accept on; + use epoll; + worker_connections 65535; +} + +http { + ## Basic Settings ## + client_body_buffer_size 128k; + client_body_timeout 30s; # Use 5s for high-traffic sites + client_header_timeout 30s; # Use 5s for high-traffic sites + client_max_body_size 1024m; + keepalive_timeout 20s; + port_in_redirect off; + sendfile on; + server_name_in_redirect off; + server_tokens off; + tcp_nodelay on; + tcp_nopush on; + types_hash_max_size 2048; + + ## DNS Resolver ## + # If in China, enable the OpenDNS entry that matches your network connectivity (IPv4 only or IPv4 & IPv6) + # OpenDNS (IPv4 & IPv6) + #resolver 208.67.222.222 208.67.220.220 [2620:0:ccc::2] [2620:0:ccd::2]; + # OpenDNS (IPv4 only) + #resolver 208.67.222.222 208.67.220.220; + # Google Public DNS (IPv4 & IPv6) + #resolver 8.8.8.8 8.8.4.4 [2001:4860:4860::8888] [2001:4860:4860::8844]; + # Google Public DNS (IPv4 only) [default] + resolver 8.8.8.8 8.8.4.4; + + ## Real IP Forwarding ## + set_real_ip_from 127.0.0.1; + + # CloudFlare IPs + # List from: https://www.cloudflare.com/ips-v4 + set_real_ip_from 103.21.244.0/22; + set_real_ip_from 103.22.200.0/22; + set_real_ip_from 103.31.4.0/22; + set_real_ip_from 104.16.0.0/12; + set_real_ip_from 108.162.192.0/18; + set_real_ip_from 131.0.72.0/22; + set_real_ip_from 141.101.64.0/18; + set_real_ip_from 162.158.0.0/15; + set_real_ip_from 172.64.0.0/13; + set_real_ip_from 173.245.48.0/20; + set_real_ip_from 188.114.96.0/20; + set_real_ip_from 190.93.240.0/20; + set_real_ip_from 197.234.240.0/22; + set_real_ip_from 198.41.128.0/17; + set_real_ip_from 199.27.128.0/21; + # List from: https://www.cloudflare.com/ips-v6 + set_real_ip_from 2400:cb00::/32; + set_real_ip_from 2405:8100::/32; + set_real_ip_from 2405:b500::/32; + set_real_ip_from 2606:4700::/32; + set_real_ip_from 2803:f800::/32; + set_real_ip_from 2c0f:f248::/32; + set_real_ip_from 2a06:98c0::/29; + + # Replace with correct visitor IP + real_ip_header X-Forwarded-For; + real_ip_recursive on; + + ## MIME ## + include /etc/nginx/mime.types; + default_type application/octet-stream; + + ## Logging Settings ## + access_log /var/log/nginx/access.log; + error_log /var/log/nginx/error.log; + + ## Gzip Settings ## + gzip on; + gzip_buffers 16 8k; + gzip_comp_level 5; + gzip_disable "msie6"; + gzip_min_length 256; + gzip_proxied any; + gzip_types + application/atom+xml + application/javascript + application/json + application/ld+json + application/manifest+json + application/rss+xml + application/vnd.geo+json + application/vnd.ms-fontobject + application/x-font-ttf + application/x-javascript + application/x-web-app-manifest+json + application/xhtml+xml + application/xml + font/opentype + image/bmp + image/svg+xml + image/x-icon + text/cache-manifest + text/css + text/javascript + text/plain + text/vcard + text/vnd.rim.location.xloc + text/vtt + text/x-component + text/x-cross-domain-policy + text/x-js + text/xml; + gzip_vary on; + + # Proxy Settings + proxy_cache_path /tmp/engintron_dynamic levels=1:2 keys_zone=engintron_dynamic:20m inactive=10m max_size=500m; + proxy_cache_path /tmp/engintron_static levels=1:2 keys_zone=engintron_static:20m inactive=10m max_size=500m; + proxy_temp_path /tmp/engintron_temp; + + ## Virtual Host Configs ## + include /etc/nginx/conf.d/*.conf; +} diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/proxy_params_common b/Engintron_for_cPanel_WHM_Configuration_Example/proxy_params_common new file mode 100755 index 000000000..7f160d074 --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/proxy_params_common @@ -0,0 +1,50 @@ +# /** +# * @version 1.8.3 +# * @package Engintron for cPanel/WHM +# * @author Fotis Evangelou +# * @url https://engintron.com +# * @copyright Copyright (c) 2010 - 2017 Nuevvo Webware P.C. All rights reserved. +# * @license GNU/GPL license: https://www.gnu.org/copyleft/gpl.html +# */ + +# General Proxy Settings +proxy_pass $scheme://$PROXY_DOMAIN_OR_IP:$PROXY_TO_PORT; +proxy_http_version 1.1; # Always upgrade to HTTP/1.1 +proxy_set_header Accept-Encoding ""; # Optimize encoding +proxy_set_header Connection ""; # Enable keepalives +proxy_set_header Host $host; +proxy_set_header Proxy ""; +proxy_set_header Referer $http_referer; +proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; +proxy_set_header X-Forwarded-Host $host; +proxy_set_header X-Forwarded-Port $server_port; +proxy_set_header X-Forwarded-Proto $scheme; +proxy_set_header X-Forwarded-Server $host; +proxy_set_header X-Real-IP $remote_addr; +proxy_set_header CF-Connecting-IP $http_cf_connecting_ip; +proxy_set_header CF-Visitor $http_cf_visitor; + +# Buffers +proxy_buffers 256 16k; +proxy_buffer_size 128k; +proxy_busy_buffers_size 256k; +proxy_temp_file_write_size 256k; + +# Timeouts +proxy_connect_timeout 180s; +proxy_read_timeout 240s; +proxy_send_timeout 240s; + +# Security Headers +add_header X-XSS-Protection "1; mode=block" always; +add_header X-Content-Type-Options "nosniff" always; +# The HSTS header below force-redirects HTTP to HTTPS traffic & uses the browser's cache +# to store the redirect. Comment out with caution. More info on HSTS here: +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security +#if ($scheme = 'https') { +# add_header Strict-Transport-Security "max-age=86400; includeSubDomains" always; +#} + +# Info +add_header X-Nginx-Cache-Status $upstream_cache_status; +add_header X-Server-Powered-By "Engintron"; diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/proxy_params_dynamic b/Engintron_for_cPanel_WHM_Configuration_Example/proxy_params_dynamic new file mode 100755 index 000000000..685ab46dc --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/proxy_params_dynamic @@ -0,0 +1,79 @@ +# /** +# * @version 1.8.3 +# * @package Engintron for cPanel/WHM +# * @author Fotis Evangelou +# * @url https://engintron.com +# * @copyright Copyright (c) 2010 - 2017 Nuevvo Webware P.C. All rights reserved. +# * @license GNU/GPL license: https://www.gnu.org/copyleft/gpl.html +# */ + +# === MICRO CACHING === +# 1 second (1s) micro-caching enabled for all proxied dynamic HTML content +# If you wish to have longer cache times, change the "proxy_cache_valid" +# line from "1s" to whatever time you want (e.g. "30s" or "1m"). +# This cache is turned off when certain criteria are met, e.g. when a site +# manager logs into WordPress' backend/admin section. + +############################################################################################# +# ADVANCED USERS ONLY: +# This setting is for cPanel servers with only one to a few sites & NO user-generated content +# in the frontend (no forums, no e-commerce sites, no user logins!) - you have been warned! +# Use the time defined in "$EXPIRES_FOR_DYNAMIC" to force client-side caching on dynamic content +# (set to 1m by default). To enable, uncomment all lines located at the bottom of this file. +# You can also raise "proxy_cache_valid" to the same value (e.g. "1m") to force longer +# server-side caching. +# The combination of these settings will have Nginx serve all content without issuing requests +# to Apache except only when it's required to refresh its cache. +set $EXPIRES_FOR_DYNAMIC 1m; +############################################################################################# + +# Allow separate cache entries for mobile devices (smartphones & tables) +set $MOBILE ""; +if ($http_user_agent ~* "(iPhone|iPod|iPad|Android|Mobile|Tablet)") { + set $MOBILE "mobile_"; +} + +# CMS (& CMS extension) specific cookies (e.g. Joomla, K2 for Joomla, WordPress, WooCommerce) +if ($http_cookie ~* "(joomla_[a-zA-Z0-9_]+|userID|wordpress_[a-zA-Z0-9_]+|wp-postpass|comment_author_[a-zA-Z0-9_]+|woocommerce_[a-zA-Z0-9_]+|wp_woocommerce_[a-zA-Z0-9_]+)") { + set $CACHE_BYPASS_FOR_DYNAMIC 1; + set $EXPIRES_FOR_DYNAMIC 0; +} + +# Invision Power Board (IPB) +if ($cookie_member_id ~ "^[1-9][0-9]*$") { + set $CACHE_BYPASS_FOR_DYNAMIC 1; + set $EXPIRES_FOR_DYNAMIC 0; +} + +# Admin sections & generic entry point names for CMSs +if ($request_uri ~* "(/administrator|com_user|com_users|com_contact|com_mailto|/component/user|/component/users|/component/contact|/component/mailto|/wp-admin|/wp-login.php|/ucp.php|/login|/logout|/connect|/signin|/signup|/register)") { + set $CACHE_BYPASS_FOR_DYNAMIC 1; + set $EXPIRES_FOR_DYNAMIC 0; +} + +# Disable caching when the "Cache-Control" header is set to "private" +if ($http_cache_control ~* "private") { + set $CACHE_BYPASS_FOR_DYNAMIC 1; + set $EXPIRES_FOR_DYNAMIC 0; +} + +# Proxy cache settings +proxy_no_cache $CACHE_BYPASS_FOR_DYNAMIC; +proxy_cache_bypass $CACHE_BYPASS_FOR_DYNAMIC; + +proxy_cache engintron_dynamic; +proxy_cache_key "$MOBILE$request_method$scheme$host$request_uri"; +proxy_cache_lock on; +proxy_cache_methods GET HEAD; +proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504; # Additional options: http_403 http_404 +proxy_cache_valid 200 1s; # Adjust for longer server-side cache times (unfortunately, we cannot use a variable here) +proxy_ignore_headers Cache-Control Expires Set-Cookie Vary; + +# Force client-side caching for dynamic content (commented by default) +# See explanation at the top of this file +#expires $EXPIRES_FOR_DYNAMIC; +#proxy_hide_header Cache-Control; +#proxy_hide_header Expires; +#proxy_hide_header Pragma; +#proxy_hide_header Set-Cookie; +#proxy_hide_header Vary; diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/proxy_params_static b/Engintron_for_cPanel_WHM_Configuration_Example/proxy_params_static new file mode 100755 index 000000000..decbc82a1 --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/proxy_params_static @@ -0,0 +1,51 @@ +# /** +# * @version 1.8.3 +# * @package Engintron for cPanel/WHM +# * @author Fotis Evangelou +# * @url https://engintron.com +# * @copyright Copyright (c) 2010 - 2017 Nuevvo Webware P.C. All rights reserved. +# * @license GNU/GPL license: https://www.gnu.org/copyleft/gpl.html +# */ + +# === STATIC ASSET CACHING === +# Proxy Cache Settings for static files ONLY. +# Nginx can cache static files and directly serve them without issuing calls +# to Apache on every static file request. +# By default Engintron will set a 1 minute (1m) cache time for static files. +# To increase, simply adjust the value for "proxy_cache_valid" +# Respects the different "Expires" header set per file type in "default.conf" +# for client-side caching. +# Every other header is ignored, stripped or reset from the request to +# maximize caching. +# This cache is turned off when certain criteria are met, e.g. when a site +# manager logs into WordPress' backend/admin section. + +# Admin sections for CMSs +if ($request_uri ~* "(/administrator|/wp-admin|/wp-login.php)") { + set $CACHE_BYPASS_FOR_STATIC 1; +} + +# Proxy cache settings +proxy_no_cache $CACHE_BYPASS_FOR_STATIC; +proxy_cache_bypass $CACHE_BYPASS_FOR_STATIC; + +proxy_cache engintron_static; +proxy_cache_key "$request_method$scheme$host$request_uri"; +proxy_cache_lock on; +proxy_cache_min_uses 1; +proxy_cache_revalidate on; +proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504; # Additional options: http_403 http_404 +proxy_cache_valid 200 301 302 1m; # Adjust for longer server-side cache times (unfortunately, we cannot use a variable here) + +proxy_ignore_headers Cache-Control Expires Set-Cookie Vary; +proxy_hide_header Cache-Control; +proxy_hide_header Expires; +proxy_hide_header Pragma; +proxy_hide_header Set-Cookie; +proxy_hide_header Vary; + +# Reset headers +add_header Pragma "public"; + +# Disable logging +access_log off; diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/scgi_params b/Engintron_for_cPanel_WHM_Configuration_Example/scgi_params new file mode 100755 index 000000000..6d4ce4f3e --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/scgi_params @@ -0,0 +1,17 @@ + +scgi_param REQUEST_METHOD $request_method; +scgi_param REQUEST_URI $request_uri; +scgi_param QUERY_STRING $query_string; +scgi_param CONTENT_TYPE $content_type; + +scgi_param DOCUMENT_URI $document_uri; +scgi_param DOCUMENT_ROOT $document_root; +scgi_param SCGI 1; +scgi_param SERVER_PROTOCOL $server_protocol; +scgi_param REQUEST_SCHEME $scheme; +scgi_param HTTPS $https if_not_empty; + +scgi_param REMOTE_ADDR $remote_addr; +scgi_param REMOTE_PORT $remote_port; +scgi_param SERVER_PORT $server_port; +scgi_param SERVER_NAME $server_name; diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/utilities/https_vhosts.php b/Engintron_for_cPanel_WHM_Configuration_Example/utilities/https_vhosts.php new file mode 100755 index 000000000..46fdc21ea --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/utilities/https_vhosts.php @@ -0,0 +1,140 @@ +#!/usr/bin/php +(.+?)\<\/VirtualHost\>#s"; + preg_match_all($regex, $file, $matches, PREG_PATTERN_ORDER); + if(count($matches[1])) { + foreach ($matches[1] as $vhost) { + if($hostnamePemFile && strpos($vhost, $hostnamePemFile)!== false) continue; // Skip the main hostname entry + preg_match("#ServerName (.+?)\n#s", $vhost, $name); + preg_match("#ServerAlias (.+?)\n#s", $vhost, $aliases); + preg_match("#SSLCertificateFile (.+?)(\n|\r)#s", $vhost, $certfile); + preg_match("#SSLCertificateKeyFile (.+?)(\n|\r)#s", $vhost, $certkeyfile); + preg_match("#SSLCACertificateFile (.+?)(\n|\r)#s", $vhost, $certcafile); + if($aliases[1]){ + $vhostAliases = $aliases[1]; + } else { + $vhostAliases = ''; + } + $vhostDomains = trim($name[1].' '.$vhostAliases); + $vhostCertFile = $certfile[1]; + $vhostCertKeyFile = $certkeyfile[1]; + $fullChainCertName = str_replace('/var/cpanel/ssl/installed/certs/', '/etc/ssl/engintron/', $vhostCertFile); + if($certcafile[1]){ + $vhostCertCAFile = $certcafile[1]; + $vhostFullChainCert = file_get_contents($vhostCertFile)."\n".file_get_contents($vhostCertCAFile); + $ocspStapling = ' + # OCSP Stapling + #ssl_trusted_certificate '.$fullChainCertName.'; + #ssl_stapling on; + #ssl_stapling_verify on; + '; + } else { + $vhostFullChainCert = file_get_contents($vhostCertFile); + $ocspStapling = ''; + } + file_put_contents($fullChainCertName, $vhostFullChainCert); + $output .= ' +# Definition block for domain(s): '.$vhostDomains.' # +server { + listen '.NGINX_HTTPS_PORT.' ssl http2; + #listen [::]:443 ipv6only=on ssl http2; + server_name '.$vhostDomains.'; + # deny all; # DO NOT REMOVE OR CHANGE THIS LINE - Used when Engintron is disabled to block Nginx from becoming an open proxy + ssl_certificate '.$fullChainCertName.'; + ssl_certificate_key '.$vhostCertKeyFile.'; + '.$ocspStapling.' + include common_https.conf; +} + '; + } + } + } + file_put_contents(NGINX_DEFAULT_HTTPS_VHOST, $output); +} + +// Run the check +if (!file_exists(NGINX_DEFAULT_HTTPS_VHOST) || (file_exists(HTTPD_CONF) && is_readable(HTTPD_CONF) && (filemtime(HTTPD_CONF) + HTTPD_CONF_LAST_CHANGED) > time())) { + generate_https_vhosts(); + echo "HTTPS vhosts for Nginx re-created.\n"; + exit(1); +} else { + echo "No changes in Apache's vhosts configuration. HTTPS vhosts for Nginx unchanged.\n"; + exit(0); +} diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/utilities/https_vhosts.sh b/Engintron_for_cPanel_WHM_Configuration_Example/utilities/https_vhosts.sh new file mode 100755 index 000000000..06c7b15b8 --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/utilities/https_vhosts.sh @@ -0,0 +1,29 @@ +#!/bin/bash + +# /** +# * @version 1.8.3 +# * @package Engintron for cPanel/WHM +# * @author Fotis Evangelou +# * @url https://engintron.com +# * @copyright Copyright (c) 2010 - 2017 Nuevvo Webware P.C. All rights reserved. +# * @license GNU/GPL license: https://www.gnu.org/copyleft/gpl.html +# */ + +COUNTER="0" + +function generate_https_vhosts { + if [ -f /etc/nginx/utilities/https_vhosts.php ]; then + RUN_CHECK=$(/usr/bin/php -c /dev/null /etc/nginx/utilities/https_vhosts.php) + if [[ $RUN_CHECK == 1 ]]; then + service nginx reload; + fi + fi + sleep 10 +} + +while [ $COUNTER -lt 5 ]; do + generate_https_vhosts + COUNTER=$[$COUNTER+1] +done + +exit 0 diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/uwsgi_params b/Engintron_for_cPanel_WHM_Configuration_Example/uwsgi_params new file mode 100755 index 000000000..09c732cd6 --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/uwsgi_params @@ -0,0 +1,17 @@ + +uwsgi_param QUERY_STRING $query_string; +uwsgi_param REQUEST_METHOD $request_method; +uwsgi_param CONTENT_TYPE $content_type; +uwsgi_param CONTENT_LENGTH $content_length; + +uwsgi_param REQUEST_URI $request_uri; +uwsgi_param PATH_INFO $document_uri; +uwsgi_param DOCUMENT_ROOT $document_root; +uwsgi_param SERVER_PROTOCOL $server_protocol; +uwsgi_param REQUEST_SCHEME $scheme; +uwsgi_param HTTPS $https if_not_empty; + +uwsgi_param REMOTE_ADDR $remote_addr; +uwsgi_param REMOTE_PORT $remote_port; +uwsgi_param SERVER_PORT $server_port; +uwsgi_param SERVER_NAME $server_name; diff --git a/Engintron_for_cPanel_WHM_Configuration_Example/win-utf b/Engintron_for_cPanel_WHM_Configuration_Example/win-utf new file mode 100755 index 000000000..ed8bc007a --- /dev/null +++ b/Engintron_for_cPanel_WHM_Configuration_Example/win-utf @@ -0,0 +1,126 @@ + +# This map is not a full windows-1251 <> utf8 map: it does not +# contain Serbian and Macedonian letters. If you need a full map, +# use contrib/unicode2nginx/win-utf map instead. + +charset_map windows-1251 utf-8 { + + 82 E2809A ; # single low-9 quotation mark + + 84 E2809E ; # double low-9 quotation mark + 85 E280A6 ; # ellipsis + 86 E280A0 ; # dagger + 87 E280A1 ; # double dagger + 88 E282AC ; # euro + 89 E280B0 ; # per mille + + 91 E28098 ; # left single quotation mark + 92 E28099 ; # right single quotation mark + 93 E2809C ; # left double quotation mark + 94 E2809D ; # right double quotation mark + 95 E280A2 ; # bullet + 96 E28093 ; # en dash + 97 E28094 ; # em dash + + 99 E284A2 ; # trade mark sign + + A0 C2A0 ; #   + A1 D18E ; # capital Byelorussian short U + A2 D19E ; # small Byelorussian short u + + A4 C2A4 ; # currency sign + A5 D290 ; # capital Ukrainian soft G + A6 C2A6 ; # borken bar + A7 C2A7 ; # section sign + A8 D081 ; # capital YO + A9 C2A9 ; # (C) + AA D084 ; # capital Ukrainian YE + AB C2AB ; # left-pointing double angle quotation mark + AC C2AC ; # not sign + AD C2AD ; # soft hypen + AE C2AE ; # (R) + AF D087 ; # capital Ukrainian YI + + B0 C2B0 ; # ° + B1 C2B1 ; # plus-minus sign + B2 D086 ; # capital Ukrainian I + B3 D196 ; # small Ukrainian i + B4 D291 ; # small Ukrainian soft g + B5 C2B5 ; # micro sign + B6 C2B6 ; # pilcrow sign + B7 C2B7 ; # · + B8 D191 ; # small yo + B9 E28496 ; # numero sign + BA D194 ; # small Ukrainian ye + BB C2BB ; # right-pointing double angle quotation mark + + BF D197 ; # small Ukrainian yi + + C0 D090 ; # capital A + C1 D091 ; # capital B + C2 D092 ; # capital V + C3 D093 ; # capital G + C4 D094 ; # capital D + C5 D095 ; # capital YE + C6 D096 ; # capital ZH + C7 D097 ; # capital Z + C8 D098 ; # capital I + C9 D099 ; # capital J + CA D09A ; # capital K + CB D09B ; # capital L + CC D09C ; # capital M + CD D09D ; # capital N + CE D09E ; # capital O + CF D09F ; # capital P + + D0 D0A0 ; # capital R + D1 D0A1 ; # capital S + D2 D0A2 ; # capital T + D3 D0A3 ; # capital U + D4 D0A4 ; # capital F + D5 D0A5 ; # capital KH + D6 D0A6 ; # capital TS + D7 D0A7 ; # capital CH + D8 D0A8 ; # capital SH + D9 D0A9 ; # capital SHCH + DA D0AA ; # capital hard sign + DB D0AB ; # capital Y + DC D0AC ; # capital soft sign + DD D0AD ; # capital E + DE D0AE ; # capital YU + DF D0AF ; # capital YA + + E0 D0B0 ; # small a + E1 D0B1 ; # small b + E2 D0B2 ; # small v + E3 D0B3 ; # small g + E4 D0B4 ; # small d + E5 D0B5 ; # small ye + E6 D0B6 ; # small zh + E7 D0B7 ; # small z + E8 D0B8 ; # small i + E9 D0B9 ; # small j + EA D0BA ; # small k + EB D0BB ; # small l + EC D0BC ; # small m + ED D0BD ; # small n + EE D0BE ; # small o + EF D0BF ; # small p + + F0 D180 ; # small r + F1 D181 ; # small s + F2 D182 ; # small t + F3 D183 ; # small u + F4 D184 ; # small f + F5 D185 ; # small kh + F6 D186 ; # small ts + F7 D187 ; # small ch + F8 D188 ; # small sh + F9 D189 ; # small shch + FA D18A ; # small hard sign + FB D18B ; # small y + FC D18C ; # small soft sign + FD D18D ; # small e + FE D18E ; # small yu + FF D18F ; # small ya +}