Forum Discussion
R__Winters_7757
Nimbostratus
Sep 16, 2010iRule to alert on hotlinking
Hey all,
I am looking for an irule to trigger an alert whenever hotlinking is detected. We are having issues with phishers mirroring our pages but thankfully they keep the FQDN of the image...
R__Winters_7757
Nimbostratus
Sep 16, 2010Joe,
Thanks for the response. On my own I came up with
when HTTP_REQUEST {
set refer_host [string tolower [URI::host [HTTP::header Referer]]]
if { ( [matchclass [HTTP::uri] ends_with $::images] ) and ( not [matchclass $refer_host starts_with $::allowed_referers] ) } {
log "Warning, Hotlinking detected from: $refer_host"
}
}
I just had two questions,
1. If I add a data group list for allowed_referers, how are those input? FQDN? Just host? i.e. example.com, www.example.com, or http://www.example.com
2. what is the significance of "local 0"?
Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects
