Botnet attack - nicks change randomly

These are old archives. They are kept for historic purposes only.
Post Reply
Tranqer

Botnet attack - nicks change randomly

Post by Tranqer »

All I know its being organised from irc.gnaa.us...a so called Gay Niggers Association of America.

Bots come with approx 70 bots attack several channels, both nick changes, floods with GNAA_GNAA, etc, and quits.

Real names are just as radon and different from 4 characters up to 25.
Small copy of channel join:


[23:46:30] * Joins: naiPHqtHQ ([email protected])
[23:46:30] * Joins: xfRRVoaHBP ([email protected])
[23:46:30] * Joins: jsDRzAalYYZ ([email protected])
[23:46:30] * Joins: VUnprzCTR ([email protected])
[23:46:30] * Joins: pPWOGYPwKR ([email protected])
[23:46:30] * Joins: kHKeVlCFzK ([email protected])
[23:46:30] * Joins: kqeUzNJLM ([email protected])
[23:46:30] * Joins: TwUxnfiVK ([email protected])
[23:46:30] * Joins: NPczpychQIo ([email protected])
[23:46:30] * Joins: CjcbPnabVn ([email protected])
[23:46:30] * Joins: tswHnLGCh ([email protected])
[23:46:30] * Joins: fgzagKogIw (~[email protected])
[23:46:30] * Joins: PlNjGYXznDqG (~[email protected])
[23:46:30] * Joins: UewfoMFpLOh ([email protected])
[23:46:30] * Joins: ZvVptGtXXn ([email protected])
[23:46:30] * Joins: HyWTXxbYEi (~[email protected])
[23:46:30] * Joins: baTdgRWlvVYf (~[email protected])
[23:46:30] * Joins: pBSyabuVrtH (~[email protected])
[23:46:30] * Joins: BCzZlBoEfWN (~[email protected])
[23:46:30] * Joins: PFAmhosxkO (~[email protected])
[23:46:30] * Joins: PswcvTiXnIoN (~[email protected])
[23:46:30] * Joins: IXPcNtOdAjt (~[email protected])
[23:46:30] * Joins: DyfQXMoGK (~[email protected])
[23:46:30] * Joins: LzUWLOALUfFT (~[email protected])
[23:46:30] * Joins: wqqqAVAYuNIi ([email protected])
[23:46:30] * Joins: zPFfPrCAFAg (~[email protected])
[23:46:30] * Joins: KiUBpsjPyHn (~[email protected])
[23:46:30] * Joins: SrCfzDZPHCVF ([email protected])
[23:46:30] * Joins: gAzcgpcZckUA ([email protected])
[23:46:30] * Joins: LPJLpMxvR ([email protected])
[23:46:30] * Joins: cnXMwBnSV ([email protected])
[23:46:30] * Joins: KGNTYXuSEKJ ([email protected])
[23:46:30] * Joins: YkFhmgTKmA ([email protected])

I've no clue how to make a proper spamfilter for this as my knowledge about regex is unfortunatly still limited. Although I'm still learning it, some proffesional help with this would be very appreciated :)

Greets,
Tranqqer
Jason
Posts: 570
Joined: Mon Jun 14, 2004 5:09 pm

Post by Jason »

Could you paste Nick!User@Host:Realname combinations for several please?

Right now I cant make you a very accurate regex. Whatever I made to match this now would have a significant false positive rate. Also, is there anything they say?
Why the hell can't my signature be empty?
"Your message contains too few characters."
Matridom
Posts: 296
Joined: Fri Jan 07, 2005 3:28 am

Post by Matridom »

Never argue with an idiot. They will bring you down to their level, then beat you with experience.
Guest

Post by Guest »

Things they have said:

[02:06:37] <nEkHkZCNgdd> gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us
[02:06:37] <KZrXIPFzR> gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us

and

[00:14:07] <SBczjSt> gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_!
[00:14:07] <fvMhRbgnWYrPNYDpCZrPNkcbJdWBiA> gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_!

(again, small copies, but the text is the same)


Examples of whowas:

nEkHkZCNgdd was [email protected] * LDuJKkeXGCWJNufXpMziMgbgXicUER
nEkHkZCNgdd using orgrimmar.wowirc.com Sat May 6 04:55:22 2006

fvMhRbgnWYrPNYDpCZrPNkcbJdWBiA was [email protected] * PTVJMzhWhYHyFFUuxEifliVEhmmmlZuAgK
fvMhRbgnWYrPNYDpCZrPNkcbJdWBiA using ironforge.wowirc.com Tue Jul 4 02:51:27 2006

SBczjSt was [email protected] * lESNyUKaaoesTCALchTGRYYqlZZCMuNE
SBczjSt using ironforge.wowirc.com Tue Jul 4 02:51:27 2006
Jason
Posts: 570
Joined: Mon Jun 14, 2004 5:09 pm

Post by Jason »

The bot author did a good job with the nick/ident/realname combinations. They are impossible to spamfilter by anything other than length and the set of used characters. The messages however, are easy to target.


Type this command as an oper with the gline ability.

/spamfilter + cpnN gzline 7d Spambot (gnaa_dot_us_){5,}
Why the hell can't my signature be empty?
"Your message contains too few characters."
Post Reply