New Flood Kiddie

These are old archives. They are kept for historic purposes only.
Post Reply
X-Trancer
Posts: 34
Joined: Mon Mar 08, 2004 5:24 am

New Flood Kiddie

Post by X-Trancer » Mon Nov 29, 2004 12:19 am

How do I add into the Spamfilter.conf?
[01:08:03] * Joins: Just-Kidding (Hacker@C6483EED.76FD052A.2B701BAD.IP)
[01:08:06] <Just-Kidding> [TWMv05] Ethernet: Something used to catch the EtherBunny. HTTP://TWM2K4.TRIPOD.COM
[01:08:06] * Parts: Just-Kidding (Hacker@C6483EED.76FD052A.2B701BAD.IP) ([TWMv05] HTTP://TWM2K4.TRIPOD.COM [TWMv05])
[01:08:32] * Joins: Just-Kidding (Hacker@C6483EED.76FD052A.2B701BAD.IP)
[01:08:36] <Just-Kidding> [TWMv05] Shell to DOS... Come in DOS, this is Shell calling, do you copy? HTTP://TWM2K4.TRIPOD.COM
[01:08:36] * Parts: Just-Kidding (Hacker@C6483EED.76FD052A.2B701BAD.IP) ([TWMv05] HTTP://TWM2K4.TRIPOD.COM [TWMv05])
[01:10:03] * Joins: Just-Kidding (Hacker@C6483EED.76FD052A.2B701BAD.IP)
[01:10:06] <Just-Kidding> [TWMv05] BIT: A word used to describe computers, as in "Our son's computer cost quite a bit." HTTP://TWM2K4.TRIPOD.COM
[01:10:06] * Parts: Just-Kidding (Hacker@C6483EED.76FD052A.2B701BAD.IP) ([TWMv05] HTTP://TWM2K4.TRIPOD.COM [TWMv05])

Stealth
Head of Support
Posts: 2086
Joined: Tue Jun 15, 2004 8:50 pm
Location: Chino Hills, CA, US
Contact:

Post by Stealth » Mon Nov 29, 2004 12:27 am

Well, since you were there to see it, and it was one person, /gline works wonders...

If you want a spamfilter to block that exact part message:

Code: Select all

http://.+\.tripod\.com
will block everything that has tripod.com in it, with http:// in front of it.

Use the part and channel spamfilter types, see the docs for information on how to add/make spamfilters, and what the types are.

Steck
Posts: 4
Joined: Sat Nov 27, 2004 2:45 pm

Post by Steck » Mon Nov 29, 2004 6:41 pm

Blocking all of tripod.com, is a bit "general".
There's also a problem with this, the bots spamming this that I found are using color codes between each character of the web address & [TWMv05], also the statement between those two is random, I've seen many different variations.
-Steck

Dukat
Posts: 1083
Joined: Tue Mar 16, 2004 5:44 pm
Location: Switzerland

Post by Dukat » Mon Nov 29, 2004 7:05 pm

But why do you want to spamfilter that? It's just one user!
/gline him! :D

medice
Posts: 42
Joined: Fri Jul 09, 2004 11:02 pm

Post by medice » Mon Nov 29, 2004 7:49 pm

it seems that this is not really a single user - i've seen this today the first time be at least 5 on one network and another one (propabbly the same) on another network...

whats the situation with those color-tags? does spamfilter strip them out before matching the mask?
greets
/medice

Steck
Posts: 4
Joined: Sat Nov 27, 2004 2:45 pm

Post by Steck » Tue Nov 30, 2004 3:01 am

I've found no working regex for these.. even trying to compensate for each color code (this spam I've seen only uses black & white):

[0-9]T[0-9]E[0-9]S[0-9]T

etc. No luck thus far :-/
Last edited by Steck on Tue Nov 30, 2004 11:59 am, edited 1 time in total.
-Steck

codemastr
Former UnrealIRCd head coder
Posts: 811
Joined: Sat Mar 06, 2004 8:47 pm
Location: United States
Contact:

Post by codemastr » Tue Nov 30, 2004 3:51 am

From my testing spamfilter doesnt strip any codes.
Well I don't know what you tested, but it certainly does strip it. The first thing in the dospamfilter function is:
str = (char *)StripControlCodes(str_in);
-- codemastr

Steck
Posts: 4
Joined: Sat Nov 27, 2004 2:45 pm

Post by Steck » Tue Nov 30, 2004 11:59 am

Alright then,
What sort of regex would work best in this instance?
My attempts to write a decent regex have all failed.
Thanks
-Steck

Syzop
UnrealIRCd head coder
Posts: 1955
Joined: Sat Mar 06, 2004 8:57 pm
Location: .nl
Contact:

Post by Syzop » Tue Nov 30, 2004 5:13 pm

Personally, I would just have used (w/action 'block'):

Code: Select all

TWM2K4\.TRIPOD\.COM
But if you have an action gline or whatever then I suppose you want a way stricter one, I'm personally usually just nice and paranoid at the same time ;).
Sidenote: the site got removed >:)

Post Reply