All I know its being organised from irc.gnaa.us...a so called Gay Niggers Association of America.
Bots come with approx 70 bots attack several channels, both nick changes, floods with GNAA_GNAA, etc, and quits.
Real names are just as radon and different from 4 characters up to 25.
Small copy of channel join:
[23:46:30] * Joins: naiPHqtHQ ([email protected])
[23:46:30] * Joins: xfRRVoaHBP ([email protected])
[23:46:30] * Joins: jsDRzAalYYZ ([email protected])
[23:46:30] * Joins: VUnprzCTR ([email protected])
[23:46:30] * Joins: pPWOGYPwKR ([email protected])
[23:46:30] * Joins: kHKeVlCFzK ([email protected])
[23:46:30] * Joins: kqeUzNJLM ([email protected])
[23:46:30] * Joins: TwUxnfiVK ([email protected])
[23:46:30] * Joins: NPczpychQIo ([email protected])
[23:46:30] * Joins: CjcbPnabVn ([email protected])
[23:46:30] * Joins: tswHnLGCh ([email protected])
[23:46:30] * Joins: fgzagKogIw (~[email protected])
[23:46:30] * Joins: PlNjGYXznDqG (~[email protected])
[23:46:30] * Joins: UewfoMFpLOh ([email protected])
[23:46:30] * Joins: ZvVptGtXXn ([email protected])
[23:46:30] * Joins: HyWTXxbYEi (~[email protected])
[23:46:30] * Joins: baTdgRWlvVYf (~[email protected])
[23:46:30] * Joins: pBSyabuVrtH (~[email protected])
[23:46:30] * Joins: BCzZlBoEfWN (~[email protected])
[23:46:30] * Joins: PFAmhosxkO (~[email protected])
[23:46:30] * Joins: PswcvTiXnIoN (~[email protected])
[23:46:30] * Joins: IXPcNtOdAjt (~[email protected])
[23:46:30] * Joins: DyfQXMoGK (~[email protected])
[23:46:30] * Joins: LzUWLOALUfFT (~[email protected])
[23:46:30] * Joins: wqqqAVAYuNIi ([email protected])
[23:46:30] * Joins: zPFfPrCAFAg (~[email protected])
[23:46:30] * Joins: KiUBpsjPyHn (~[email protected])
[23:46:30] * Joins: SrCfzDZPHCVF ([email protected])
[23:46:30] * Joins: gAzcgpcZckUA ([email protected])
[23:46:30] * Joins: LPJLpMxvR ([email protected])
[23:46:30] * Joins: cnXMwBnSV ([email protected])
[23:46:30] * Joins: KGNTYXuSEKJ ([email protected])
[23:46:30] * Joins: YkFhmgTKmA ([email protected])
I've no clue how to make a proper spamfilter for this as my knowledge about regex is unfortunatly still limited. Although I'm still learning it, some proffesional help with this would be very appreciated
Greets,
Tranqqer
Botnet attack - nicks change randomly
Could you paste Nick!User@Host:Realname combinations for several please?
Right now I cant make you a very accurate regex. Whatever I made to match this now would have a significant false positive rate. Also, is there anything they say?
Right now I cant make you a very accurate regex. Whatever I made to match this now would have a significant false positive rate. Also, is there anything they say?
Why the hell can't my signature be empty?
"Your message contains too few characters."
"Your message contains too few characters."
Things they have said:
[02:06:37] <nEkHkZCNgdd> gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us
[02:06:37] <KZrXIPFzR> gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us
and
[00:14:07] <SBczjSt> gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_!
[00:14:07] <fvMhRbgnWYrPNYDpCZrPNkcbJdWBiA> gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_!
(again, small copies, but the text is the same)
Examples of whowas:
nEkHkZCNgdd was [email protected] * LDuJKkeXGCWJNufXpMziMgbgXicUER
nEkHkZCNgdd using orgrimmar.wowirc.com Sat May 6 04:55:22 2006
fvMhRbgnWYrPNYDpCZrPNkcbJdWBiA was [email protected] * PTVJMzhWhYHyFFUuxEifliVEhmmmlZuAgK
fvMhRbgnWYrPNYDpCZrPNkcbJdWBiA using ironforge.wowirc.com Tue Jul 4 02:51:27 2006
SBczjSt was [email protected] * lESNyUKaaoesTCALchTGRYYqlZZCMuNE
SBczjSt using ironforge.wowirc.com Tue Jul 4 02:51:27 2006
[02:06:37] <nEkHkZCNgdd> gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us
[02:06:37] <KZrXIPFzR> gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us
and
[00:14:07] <SBczjSt> gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_!
[00:14:07] <fvMhRbgnWYrPNYDpCZrPNkcbJdWBiA> gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_!
(again, small copies, but the text is the same)
Examples of whowas:
nEkHkZCNgdd was [email protected] * LDuJKkeXGCWJNufXpMziMgbgXicUER
nEkHkZCNgdd using orgrimmar.wowirc.com Sat May 6 04:55:22 2006
fvMhRbgnWYrPNYDpCZrPNkcbJdWBiA was [email protected] * PTVJMzhWhYHyFFUuxEifliVEhmmmlZuAgK
fvMhRbgnWYrPNYDpCZrPNkcbJdWBiA using ironforge.wowirc.com Tue Jul 4 02:51:27 2006
SBczjSt was [email protected] * lESNyUKaaoesTCALchTGRYYqlZZCMuNE
SBczjSt using ironforge.wowirc.com Tue Jul 4 02:51:27 2006
The bot author did a good job with the nick/ident/realname combinations. They are impossible to spamfilter by anything other than length and the set of used characters. The messages however, are easy to target.
Type this command as an oper with the gline ability.
/spamfilter + cpnN gzline 7d Spambot (gnaa_dot_us_){5,}
Type this command as an oper with the gline ability.
/spamfilter + cpnN gzline 7d Spambot (gnaa_dot_us_){5,}
Why the hell can't my signature be empty?
"Your message contains too few characters."
"Your message contains too few characters."