[15:39:45] <@ConnectServ> SIGNOFF egmjnelfo ([email protected] AAAAAA - American Association Against Acronym Abus) signed off at dream-irc.de Quit: th1z iz .:tHa lEEtf0rCe:. dUn f0k wiT eLiTeCr3w
[15:39:45] <@ConnectServ> SIGNOFF R9 ([email protected] 2 future 4 u) signed off at dream-irc.de Quit: th1z iz .:tHa lEEtf0rCe:. dUn f0k wiT eLiTeCr3w
When having an issue, always look at the IPs or hosts the attacker is using. A GZLine takes a whole lot less CPU and memory than a Spamfilter would. If you have access to the firewall settings on the system, I would also recommend you block them with the firewall for a while.
The IPs seem to be owned by a private orginization, GGnet.net, a US-based company. It is against federal law for companies to initiate attacks. The IPs seem to be assigned by AT&T Worldnet Services, so you should send an abuse report to them as well. It is also possible that GGNet has been compromised, but that seems unlikely.
thx for your fast answer i have written an abuse mail to ATT Abuse but isnt there an opertunity to block mass connects with same IP ranges like 12.190.84.* or limit them for example only 50 Connections from one IP range (12.190.84.0-12.190.84.255) an modul or so ?
To mass block those connects, use a kline, zline, gline, or gzline. You can limit the maximum number of simultanious connections by giving the range its own class and allow block, and setting a maximum number of users in that class.
Why the hell can't my signature be empty?
"Your message contains too few characters."
The gzline command will have the IRCd terminate their connections immediately, so no data is sent. This may stop them faster, people usually stop when they realize none of the bots are connecting at all.
If you want to limit the connections (not recommended), you can use a class and allow block and be sure to limit maxperip and maxclients paramiters.
A small note about using the GZLINE command... You may want to:
/mode yournick +s -cF
before typing it, and
/mode yournick +s +cF
after to prevent being flooded with exit notices.