Weird bots

These are old archives. They are kept for historic purposes only.
GouroB
Posts: 182
Joined: Thu Oct 28, 2004 7:42 pm
Location: London
Contact:

Weird bots

Post by GouroB »

«°15:23°» * Joins: u3758 ([email protected])
«°15:23°» * Joins: q1681 ([email protected])
«°15:23°» * Joins: g6401 ([email protected])
«°15:23°» <Zahir> 9,0|9,3|1,3|3,1|0,1 @Bristi tai naki... ami o... lunch kore Bc te boshlam 3,1|1,3|9,3|9,0|
«°15:23°» * Joins: w2731 ([email protected])
«°15:23°» <ShAdOw_of_dOOm> 5»5,1»1,5»4,5»5,4»4,14»0,14 wtf 4«5,4«4,5«1,5«5,1«5,0«
«°15:23°» * Joins: g7571 ([email protected])
«°15:23°» * Joins: m4674 ([email protected])
«°15:23°» * Parts: Xlove ([email protected])
«°15:23°» * Quits: u9690 ([email protected]) (User has been banned from BanglaCafe (4BOT))
«°15:23°» * Quits: a6079 ([email protected]) (User has been banned from BanglaCafe (4BOT))
«°15:23°» * Quits: u3758 ([email protected]) (User has been banned from BanglaCafe (4BOT))


also
«°11:16°» * Joins: nax2154 ([email protected])
«°11:16°» * Joins: nax3854 ([email protected])
«°11:16°» * Joins: nax7929 ([email protected])

any regex for these bots anyone ? antirandom was unable to detect them.
-=GouroB=-
https://www.shunno.info
Your complete web Solution
Irc.BanglaCafe.com
LargesT Chat server in BanglaDesH
seraphim
Posts: 36
Joined: Tue Apr 03, 2007 11:10 am

Post by seraphim »

//edit: argh sry i didn´t read the text carefully >.<
Jobe
Official supporter
Posts: 1180
Joined: Wed May 03, 2006 7:09 pm
Location: United Kingdom

Post by Jobe »

For the first lot you can/could have used this regex for a user type spamfilter: ^[a-z]\d{4}![a-z]\d{4}@
(matches a letter followed by 4 numbers in both the nick and ident/user)

For the second lot you can use this regex on a user type spamfilter: ^([a-z]{3})\d{4}!\1@
(matches 3 letters followed by 4 numbers where the same 3 letters appear as the full user/ident)

Since I see you had 3 of the second lot connect from the same host id reccomend adjusting your max per IP limits and if possible use session limiting in services to limit the number of clones.
GouroB
Posts: 182
Joined: Thu Oct 28, 2004 7:42 pm
Location: London
Contact:

Post by GouroB »

Since I see you had 3 of the second lot connect from the same host id reccomend adjusting your max per IP limits and if possible use session limiting in services to limit the number of clones.


yah i have 3 user per ip limit, but where do i get session limit .. ? services.conf ?
-=GouroB=-
https://www.shunno.info
Your complete web Solution
Irc.BanglaCafe.com
LargesT Chat server in BanglaDesH
Jobe
Official supporter
Posts: 1180
Joined: Wed May 03, 2006 7:09 pm
Location: United Kingdom

Post by Jobe »

Session limiting in services depends on your services package if you even have one.
GouroB
Posts: 182
Joined: Thu Oct 28, 2004 7:42 pm
Location: London
Contact:

Post by GouroB »

i do have , anope ( latest one ) .. so it is available there ?
-=GouroB=-
https://www.shunno.info
Your complete web Solution
Irc.BanglaCafe.com
LargesT Chat server in BanglaDesH
GouroB
Posts: 182
Joined: Thu Oct 28, 2004 7:42 pm
Location: London
Contact:

Post by GouroB »

«°21:47°» * Joins: ruksog ([email protected])
«°21:47°» * Joins: gjrhey ([email protected])
«°21:47°» * Joins: fsuhzv ([email protected])
«°21:47°» * Joins: Rent`BoY ([email protected])
«°21:47°» * Parts: ruksog ([email protected])
«°21:47°» * Parts: fsuhzv ([email protected])
«°21:47°» * Parts: gjrhey ([email protected])
«°21:47°» * Joins: vruaoq ([email protected])
«°21:47°» * Joins: exadyf ([email protected])
«°21:47°» * Joins: bxtyie ([email protected])
-=GouroB=-
https://www.shunno.info
Your complete web Solution
Irc.BanglaCafe.com
LargesT Chat server in BanglaDesH
GouroB
Posts: 182
Joined: Thu Oct 28, 2004 7:42 pm
Location: London
Contact:

Post by GouroB »

«°20:13°» * Joins: green^rose ([email protected])
«°20:13°» * Joins: dust`in`the`wind ([email protected])
«°20:14°» * Quits: green^rose ([email protected]) (Z:lined (4Low Life!))
«°20:14°» * Joins: noyon ([email protected])
«°20:14°» * Joins: addicted ([email protected])
«°20:14°» * Joins: rose ([email protected])
«°20:14°» * Joins: biggybro ([email protected])
«°20:14°» * Joins: tasu ([email protected])
&

«°20:13°» * Joins: re-rain ([email protected])
«°20:13°» * Joins: rofiq ([email protected])
«°20:13°» * Joins: pious ([email protected])
«°20:13°» * Joins: opal ([email protected])
«°20:13°» * Parts: tanha ([email protected])
«°20:13°» * Parts: kashif ([email protected])
«°20:13°» * Joins: nazrul ([email protected])
«°20:13°» * Joins: mokbul ([email protected])
«°20:13°» * Joins: madhuri ([email protected])
«°20:13°» * Quits: sushmita_1 ([email protected]) (Excess Flood)
«°20:13°» * Quits: shornolota ([email protected]) (Excess Flood)
«°20:13°» * Quits: re-rain ([email protected]) (Excess Flood)
«°20:13°» * Quits: opal ([email protected]) (Excess Flood)
«°20:13°» * Quits: pious ([email protected]) (Excess Flood)

these nicks r normal users nicks only idents r random, any idea how ch these ... and i think these r also some sorta new exploiter like cloneX
-=GouroB=-
https://www.shunno.info
Your complete web Solution
Irc.BanglaCafe.com
LargesT Chat server in BanglaDesH
Jobe
Official supporter
Posts: 1180
Joined: Wed May 03, 2006 7:09 pm
Location: United Kingdom

Post by Jobe »

Could you possibly give us more information such as real names and CTCP versions if possible?
GouroB
Posts: 182
Joined: Thu Oct 28, 2004 7:42 pm
Location: London
Contact:

Post by GouroB »

re-rain was [email protected] * eerrug
re-rain using 143.BanGlaCafe.Com Thu Jun 14 09:13:55 2007
green^rose was [email protected] * yuxdco
green^rose using 143.BanGlaCafe.Com Thu Jun 14 09:14:09 2007
pious was [email protected] * sputou
pious using 143.BanGlaCafe.Com Thu Jun 14 09:13:55 2007
-=GouroB=-
https://www.shunno.info
Your complete web Solution
Irc.BanglaCafe.com
LargesT Chat server in BanglaDesH
Jobe
Official supporter
Posts: 1180
Joined: Wed May 03, 2006 7:09 pm
Location: United Kingdom

Post by Jobe »

Try this for a user type regex:

Code: Select all

![a-z][0-9]{4}@[^:]+:[a-z]{6}
GouroB
Posts: 182
Joined: Thu Oct 28, 2004 7:42 pm
Location: London
Contact:

Post by GouroB »

thanks :D
-=GouroB=-
https://www.shunno.info
Your complete web Solution
Irc.BanglaCafe.com
LargesT Chat server in BanglaDesH
Stealth
Head of Support
Posts: 2086
Joined: Tue Jun 15, 2004 8:50 pm
Location: Chino Hills, CA, US
Contact:

Post by Stealth »

Looks like ClonesXs using a nicklist...
GouroB
Posts: 182
Joined: Thu Oct 28, 2004 7:42 pm
Location: London
Contact:

Post by GouroB »

lkgrofnaqib is [email protected] * ktmyttgovwijan

nxiebg is [email protected] * xiqymlawjigionzehn

any regex for these idiots ?
[/quote]
-=GouroB=-
https://www.shunno.info
Your complete web Solution
Irc.BanglaCafe.com
LargesT Chat server in BanglaDesH
Stealth
Head of Support
Posts: 2086
Joined: Tue Jun 15, 2004 8:50 pm
Location: Chino Hills, CA, US
Contact:

Post by Stealth »

Anti-Random should be able to take care of those
Post Reply