Anyone seen these???

These are old archives. They are kept for historic purposes only.
Post Reply
droolin
Posts: 42
Joined: Sat Dec 04, 2004 7:27 pm
Location: USA - Ohio
Contact:

Anyone seen these???

Post by droolin » Fri Sep 02, 2005 11:14 pm

In the last couple days, we have been getting hit by a series of bots that seem to be a spin off the girl/boy bot from awhile back. where it says, hi im a girl are you a boy. And it asks you to join them for chat off a url.
Follows is a spattering of the nicks that they seem to be:

Code: Select all

BrIDgeTc was ~cizi@200.140.10.46 * denax
HElEnaY is ~yeley@AwesomeChatter-9BCB3457.dynamic.dejazzd.com * yegey
alLISoNa is ~neve@C243CC58.7322E107.4AE596DB.IP * nacede
AGnESY is ~gefon@AwesomeChatter-993EA48.arcor-ip.net * qacoh
CAthAriNeQ is ~yaqu@AwesomeChatter-D6277B83.l4.c3.dsl.pol.co.uk * nonef
SUzYD is ~leye@341B78C0.D7B0BEF3.2D7BC8AE.IP * fimura
CaTaRiNAD is ~fuguw@AwesomeChatter-2F31ADF1.tpgi.com.au * tehul
CAthAriNeQ is ~yaqu@AwesomeChatter-D6277B83.l4.c3.dsl.pol.co.uk * nonef
EMilIeg (~zeme@28-12-178-69.gci.net)
Follows is the spamfilters I set for when they do say something, which do work.

Code: Select all

F p gline 0 162149 10800 Freaken_girl_boy_spam_bot Seti!eatme@1C2986BF.C74A7EC3.C128BEA.IP i'm a girl\. are you a boy\?
F p gline 0 170364 10800 Freaken_sex_spam_bot_begone. Seti!eatme@AwesomeChat.CsopIRCop.Net http:\/\/sexpartner
Does anyone know of a way to stop these suckers on the way in the door.?
Ive received no reply on version, ping, time, or anything else on them.
Any help is appriceated.

droolin
Hornyness is a perpetual thang. The hornier you are, the hornier your going to be.

Syzop
UnrealIRCd head coder
Posts: 1881
Joined: Sat Mar 06, 2004 8:57 pm
Location: .nl
Contact:

Post by Syzop » Fri Sep 02, 2005 11:18 pm

the nick looks like a real name coming from a namelist + a random letter attached to it, but.. I suppose you were that far already ;).

droolin
Posts: 42
Joined: Sat Dec 04, 2004 7:27 pm
Location: USA - Ohio
Contact:

lol, yea I was

Post by droolin » Fri Sep 02, 2005 11:26 pm

Im trying to see if I can find a name list any place. I don't see anything like this mentioned in the irc security list. But, I'm still looken.
I have seen that the number of upper and lower case letters vary too. Anything from 4 upper in the complete name to more.
Just was hopeing someone had a possible solution.


droolin
Hornyness is a perpetual thang. The hornier you are, the hornier your going to be.

aquanight
Official supporter
Posts: 862
Joined: Tue Mar 09, 2004 10:47 pm
Location: Boise, ID

Post by aquanight » Sun Sep 04, 2005 7:13 am

I think w00t's seen those on dalnet or something a few times...

Probably easiest way to find the namelist is the actually have a copy of the bot... ;)

w00t
Posts: 1136
Joined: Thu Mar 25, 2004 3:31 am
Location: Nowra, Australia

Post by w00t » Sun Sep 04, 2005 10:12 am

Yup, I've seen them around - and until recently I had a copy of the bot :/ if I'd known, I would've saved a copy before I formatted that drive :p
-ChatSpike IRC Network [http://www.chatspike.net]
-Denora Stats [http://denora.nomadirc.net]
-Omerta [http://www.barafranca.com]

droolin
Posts: 42
Joined: Sat Dec 04, 2004 7:27 pm
Location: USA - Ohio
Contact:

do you rember the bot name?

Post by droolin » Sun Sep 04, 2005 7:28 pm

Do you happen to rember the official bot name? Ill hunt and peck my way through google to see if I can find a copy of it. Actualy, do you rember the description everyone called it by???
I was calling it girl/boy. But, I doubt thats what everyone else called it.

Thanks for the reply. Very much appriceated.

droolin
Hornyness is a perpetual thang. The hornier you are, the hornier your going to be.

w00t
Posts: 1136
Joined: Thu Mar 25, 2004 3:31 am
Location: Nowra, Australia

Post by w00t » Mon Sep 05, 2005 11:22 am

no, unfortunatly.. I got it to take a look at it myself when I saw it on dalnet a few months back (~4-5?) but didn't get time to follow it up past getting the .exe..
-ChatSpike IRC Network [http://www.chatspike.net]
-Denora Stats [http://denora.nomadirc.net]
-Omerta [http://www.barafranca.com]

White_Magic
Posts: 267
Joined: Tue Jan 18, 2005 3:24 pm
Location: Scotland - United Kingdom

Post by White_Magic » Thu Sep 15, 2005 11:02 am

Code: Select all

BrIDgeTc was ~cizi@200.140.10.46 * denax 

HElEnaY is ~yeley@AwesomeChatter-9BCB3457.dynamic.dejazzd.com * yegey 

alLISoNa is ~neve@C243CC58.7322E107.4AE596DB.IP * nacede 

AGnESY is ~gefon@AwesomeChatter-993EA48.arcor-ip.net * qacoh 

CAthAriNeQ is ~yaqu@AwesomeChatter-D6277B83.l4.c3.dsl.pol.co.uk * nonef 

SUzYD is ~leye@341B78C0.D7B0BEF3.2D7BC8AE.IP * fimura 

CaTaRiNAD is ~fuguw@AwesomeChatter-2F31ADF1.tpgi.com.au * tehul 

CAthAriNeQ is ~yaqu@AwesomeChatter-D6277B83.l4.c3.dsl.pol.co.uk * nonef 

EMilIeg (~zeme@28-12-178-69.gci.net) 
we`ll i gues its a risk but,
every ident and realname, every second letter (character) is a vowel
but then again nearly every word matchs this regex :P
just something i spottted thou
i spend 4 hrs a day gaming and 14hrs on irc, for 5days a week, im not an addict :D

aquanight
Official supporter
Posts: 862
Joined: Tue Mar 09, 2004 10:47 pm
Location: Boise, ID

Post by aquanight » Thu Sep 15, 2005 4:16 pm

At least it can be filtered though ;)

/spamfilter add u kill - Suspected_drone .+!~([^aeiou][aeiou])*[^aeiou]?@.+:([^aeiou][aeiou])*[^aeiou]?$

droolin
Posts: 42
Joined: Sat Dec 04, 2004 7:27 pm
Location: USA - Ohio
Contact:

ya know, ive looked at that

Post by droolin » Thu Sep 15, 2005 4:49 pm

I did not see that, I swear. All I seen was random letters.
I put the spam filter you sugested in, and so far. Have seen only one innocent. I'm sure it will be more. I expanded on the kill message, to assist any innocent user that gets taken out. I'll watch.
Whats intresting is. We have random letter bots also joining, that i loaded the antirandom module for. The ones getting through, are also being caught by this spamfilter.
Have to thank you for the help. Even if I don't keep this spamfilter, it's something I didn't know about those bots that I now do. Very much appriceated.

droolin
Hornyness is a perpetual thang. The hornier you are, the hornier your going to be.

Post Reply