ReferrerBlock 2026.2.8

ReferrerBlock

ReferrerBlock middleware to block referrer spam and malicious traffic.

⚙️ Usage

var builder = WebApplication.CreateBuilder(args); var app = builder.Build();

app.UseReferrerBlock();

app.Run();

The middleware uses default blocking rules. Optionally, you can customize them:

app.UseReferrerBlock(options => { 
    options.BlockedDomains.Add("spam-site.com"); 
    options.BlockedTLDs.Add(".suspicious"); 
    options.BlockedPatterns.Add("malicious");
    options.BlockedSubdomainPrefixes.Add("spam");
    });

📝 Examples

Disable default TLD blocking

app.UseReferrerBlock(options => 
{ 
    options.BlockedTLDs.Clear(); // Remove all default TLDs
    options.BlockedDomains.Add("spam-site.com"); 
});

Use only custom rules

app.UseReferrerBlock(options => 
{ 
    // Clear all default rules
    options.BlockedTLDs.Clear();
    options.BlockedDomains.Clear();
    options.BlockedPatterns.Clear();
    options.BlockedSubdomainPrefixes.Clear();
    
    // Add only your custom rules
    options.BlockedDomains.Add("spam-site.com");
    options.BlockedDomains.Add("malicious-domain.com");
    options.BlockedTLDs.Add(".scam");
    options.BlockedPatterns.Add("suspicious");
    options.BlockedSubdomainPrefixes.Add("bot");
});

Combine default rules with custom ones

app.UseReferrerBlock(options => 
{ 
    // Keep default rules and add custom ones
    options.BlockedDomains.Add("spam-site.com"); 
    options.BlockedTLDs.Add(".suspicious"); 
    options.BlockedPatterns.Add("malicious");
    options.BlockedSubdomainPrefixes.Add("bot");
});

Block subdomain prefixes with numeric variations

The BlockedSubdomainPrefixes option allows you to block subdomains that start with a specific prefix followed by optional digits.

app.UseReferrerBlock(options => 
{ 
    // Block subdomains like: iqri., iqri1., iqri18., hk., hk1., hk12., etc.
    options.BlockedSubdomainPrefixes.Add("iqri");
    options.BlockedSubdomainPrefixes.Add("hk");
    options.BlockedSubdomainPrefixes.Add("spam");
});

This will block referrers like:

• iqri.example.com ✅ blocked
• iqri1.spammer.net ✅ blocked
• iqri18.malicious.org ✅ blocked
• hk12.badsite.com ✅ blocked

But will NOT block:

• iqri1x.example.com ❌ not blocked (has letters after digits)
• myiqri1.example.com ❌ not blocked (prefix not at start)
• iqrisite.com ❌ not blocked (in domain name, not subdomain)

🚀 Performance

The middleware is optimized for high-performance scenarios using ReadOnlySpan<char> instead of traditional Uri parsing, resulting in minimal memory allocations.

Benchmark Results

BenchmarkDotNet v0.15.8, Windows 11, Intel Core i9-9900K CPU 3.60GHz
.NET 9.0.12, X64 RyuJIT x86-64-v3

Run benchmarks yourself:

cd benchmarks/AspNetCore.ReferrerBlock.Benchmarks
dotnet run -c Release

📊 Blocked Domains

See BLOCKED_DOMAINS.md for the complete list of blocked domains, TLDs, and patterns with their addition history.