How to remove it ...

These are old archives. They are kept for historic purposes only.
Post Reply
webmonkey
Posts: 7
Joined: Sun Oct 08, 2006 8:10 pm

How to remove it ...

Post by webmonkey » Tue Oct 10, 2006 7:33 am

hi,

F kill 0 385629 86400 advertiser Fred!~Fred@ak.org without *
F kill 0 385636 86400 advertiser Fred!~Fred@ak.org ircd.myan


i cant remove it .. no type :<

Another problem ..

[12:03pm] *** epuwq (~olkbszrol@D31D253A.464B8CD1.BC5725C4.IP) has joined #chatzone
[12:03pm] *** epuwq (~olkbszrol@D31D253A.464B8CD1.BC5725C4.IP) has left #chatzone
[12:03pm] *** gehuuzfbpxbun (~athl@D31D253A.464B8CD1.BC5725C4.IP) has joined #chatzone
[12:03pm] *** gehuuzfbpxbun (~athl@D31D253A.464B8CD1.BC5725C4.IP) has left #chatzone
[12:03pm] *** gehuuzfbpxbun (~athl@D31D253A.464B8CD1.BC5725C4.IP) has joined #chatzone
[12:03pm] *** gehuuzfbpxbun (~athl@D31D253A.464B8CD1.BC5725C4.IP) has left IRC (Client exited)
[12:03pm] *** kszr (~ebuskhrer@D31D253A.464B8CD1.BC5725C4.IP) has joined #chatzone
[12:03pm] *** kszr (~ebuskhrer@D31D253A.464B8CD1.BC5725C4.IP) has left #chatzone

what is the exact syntax for spamfilter to kill them? (matching this random nickname and random ident mask.)
thanks

White_Magic
Posts: 267
Joined: Tue Jan 18, 2005 3:24 pm
Location: Scotland - United Kingdom

Re: How to remove it ...

Post by White_Magic » Tue Oct 10, 2006 9:04 pm

webmonkey wrote:hi,

F kill 0 385629 86400 advertiser Fred!~Fred@ak.org without *
F kill 0 385636 86400 advertiser Fred!~Fred@ak.org ircd.myan


i cant remove it .. no type :<

Another problem ..

[12:03pm] *** epuwq (~olkbszrol@D31D253A.464B8CD1.BC5725C4.IP) has joined #chatzone
[12:03pm] *** epuwq (~olkbszrol@D31D253A.464B8CD1.BC5725C4.IP) has left #chatzone
[12:03pm] *** gehuuzfbpxbun (~athl@D31D253A.464B8CD1.BC5725C4.IP) has joined #chatzone
[12:03pm] *** gehuuzfbpxbun (~athl@D31D253A.464B8CD1.BC5725C4.IP) has left #chatzone
[12:03pm] *** gehuuzfbpxbun (~athl@D31D253A.464B8CD1.BC5725C4.IP) has joined #chatzone
[12:03pm] *** gehuuzfbpxbun (~athl@D31D253A.464B8CD1.BC5725C4.IP) has left IRC (Client exited)
[12:03pm] *** kszr (~ebuskhrer@D31D253A.464B8CD1.BC5725C4.IP) has joined #chatzone
[12:03pm] *** kszr (~ebuskhrer@D31D253A.464B8CD1.BC5725C4.IP) has left #chatzone

what is the exact syntax for spamfilter to kill them? (matching this random nickname and random ident mask.)
thanks
the type is " F "
/spamfilter - F Kill - - without *
/spamfilter - F Kill - - ircd.myan
or
/spamfilter del F Kill - - without *
/spamfilter del F Kill - - ircd.myan

/spamfilter add u gzline - - ^.+!.+@.+464B8CD1\.BC5725C4\.IP:.+
is the filter u`ll want to try... but this maybe ban innocents, if so then
/spamfilter add u gzline - - ^.+!.+@D31D253A\.464B8CD1\.BC5725C4\.IP:.+

will ban only this IP (which he uses all the time)
i spend 4 hrs a day gaming and 14hrs on irc, for 5days a week, im not an addict :D

Jobe1986
Official supporter
Posts: 1180
Joined: Wed May 03, 2006 7:09 pm
Location: United Kingdom

Post by Jobe1986 » Tue Oct 10, 2006 9:11 pm

If it's not a silly question if he uses the same IP all the time why not just GZline the IP straight off rather then having a spamfilter to it?

White_Magic
Posts: 267
Joined: Tue Jan 18, 2005 3:24 pm
Location: Scotland - United Kingdom

Post by White_Magic » Tue Oct 10, 2006 9:14 pm

thus why i added a broader regex beforehand... :P
i spend 4 hrs a day gaming and 14hrs on irc, for 5days a week, im not an addict :D

webmonkey
Posts: 7
Joined: Sun Oct 08, 2006 8:10 pm

Post by webmonkey » Wed Oct 11, 2006 1:19 pm

White_Magic wrote:thus why i added a broader regex beforehand... :P
Hello white_magic thanks you ... to help me ..
but i still cant remove it ..
the error is

09:04pm] -irc.ucsy.edu.mm- Unknown target type 'F'
[09:04pm] -irc.ucsy.edu.mm- Use: /spamfilter [add|del|remove|+|-] [type] [action] [tkltime] [tklreason] [regex]

/spamfilter add u gzline - - ^.+!.+@D31D253A\.464B8CD1\.BC5725C4\.IP:.+
this one is for ip ban right ..

Actually we cant ban that ips. .. because more than half of users use that proxies to join our network ( mean that users are behind firewall )

Can u help me out without banning IP :) thanks you

Stealth
Head of Support
Posts: 2086
Joined: Tue Jun 15, 2004 8:50 pm
Location: Chino Hills, CA, US
Contact:

Post by Stealth » Wed Oct 11, 2006 11:28 pm

Most attacks happen through insecure proxies, which are open for anyone to use. If users are using an open proxy that gets banned, then they need to go find themselves a secure proxy (one that asks for a username and password).

Other than banning the open proxies, there is no way to stop such attacks without putting a massive load on your IRCd. It is a risk you take when you allow users to connect through abused open proxies.

Syzop
UnrealIRCd head coder
Posts: 1864
Joined: Sat Mar 06, 2004 8:57 pm
Location: .nl
Contact:

Post by Syzop » Fri Oct 13, 2006 4:06 pm

A new question about blocking spam done through alias was here, but has been split off to a new topic: How to block spam done through /MS and /MEMOSERV

Jason
Posts: 570
Joined: Mon Jun 14, 2004 5:09 pm

Post by Jason » Mon Oct 16, 2006 4:16 pm

The F means that the filter is global, set through the /spamfilter command, not through the config file (f, local).
Last edited by Jason on Mon Oct 16, 2006 7:24 pm, edited 1 time in total.
Why the hell can't my signature be empty?
"Your message contains too few characters."

White_Magic
Posts: 267
Joined: Tue Jan 18, 2005 3:24 pm
Location: Scotland - United Kingdom

Post by White_Magic » Mon Oct 16, 2006 5:13 pm

ok fair enuff, except how did they add a spamfilter with no target? thou
i spend 4 hrs a day gaming and 14hrs on irc, for 5days a week, im not an addict :D

Jason
Posts: 570
Joined: Mon Jun 14, 2004 5:09 pm

Post by Jason » Mon Oct 16, 2006 7:24 pm

I have no idea. It should have thrown an error. Perhaps invalid server-server protocol. It's not checked as well as client-server.
Why the hell can't my signature be empty?
"Your message contains too few characters."

Post Reply