Bot attack

These are old archives. They are kept for historic purposes only.
Post Reply
Jonny15
Posts: 5
Joined: Tue Jul 01, 2008 3:03 pm

Bot attack

Post by Jonny15 » Tue Jul 01, 2008 6:45 pm

We had a bot attack today with about 1200 bots, using roughly 400 different IP addresses.

The nicks were in this form:

NLD|00|XP|SP2|56936219
SWE|02|XP|SP2|67461199
HUN|00|XP|SP2|39549030
ESP|01|XP|SP2|48075604

The SP2 part might be SP0, SP1, SP2, SP3, and perhaps other digits.

Each nick had a real name which matched the nickname.

Has anyone else seen these bots before?
Is spamfilter the best way to block these bots?
If so, can anyone show me which regex to use?

Thanks in advance.
Last edited by Jonny15 on Thu Jul 03, 2008 12:05 pm, edited 1 time in total.

Jonny15
Posts: 5
Joined: Tue Jul 01, 2008 3:03 pm

Re: Bot attack

Post by Jonny15 » Thu Jul 03, 2008 12:04 pm

I could sure use some help with the regex.
Can someone please give me some help?
Thanks

JRBlood
Posts: 12
Joined: Sat Apr 12, 2008 8:20 pm
Location: Syracuse, NY USA
Contact:

Re: Bot attack

Post by JRBlood » Fri Jul 04, 2008 4:39 pm

Yup, we've been seeing these bots for months now trying to join #babu3. Filter we put in place has stopped them cold:

Code: Select all

/spamfilter add u gzline 90d |Bot_Flooder_S| \|XPSP[0-9]\|
Hope this does the trick for ya. :)
Image
RaveTrax.com - "Its not a state of mind, Its a way of life."
» Audio Streams - MP3 - 160k MP3 - 64k MP3 - 24k MP3
» Audio Streams - AAC+ - 64k aacPlus v2 - 24k aacPlus v2

Jonny15
Posts: 5
Joined: Tue Jul 01, 2008 3:03 pm

Re: Bot attack

Post by Jonny15 » Fri Jul 04, 2008 7:41 pm

Thanks JRBlood,

I"ll give that a try.

CCCC
Posts: 6
Joined: Fri Jul 18, 2008 11:51 pm

Re: Bot attack

Post by CCCC » Sun Jul 27, 2008 3:04 am

I had similar problem with bots, but is there any possibilities to ban if there is no version. Those guys did not have a version and if is possibility to ban those bots and scripts without version ???

JRBlood
Posts: 12
Joined: Sat Apr 12, 2008 8:20 pm
Location: Syracuse, NY USA
Contact:

Re: Bot attack

Post by JRBlood » Wed Jul 30, 2008 8:07 pm

If you can give us all examples of the nicks the bots are using, I'm sure someone can come up with a filter. :)

Exedore
Posts: 15
Joined: Tue Sep 23, 2008 1:05 am

Re: Bot attack

Post by Exedore » Tue Sep 23, 2008 1:34 am

You can block this with your OperServ

Code: Select all

/msg operserv sqline add +0 *|XP|* Reason

Post Reply