Page 1 of 1

Bot attack

Posted: Tue Jul 01, 2008 6:45 pm
by Jonny15
We had a bot attack today with about 1200 bots, using roughly 400 different IP addresses.

The nicks were in this form:

NLD|00|XP|SP2|56936219
SWE|02|XP|SP2|67461199
HUN|00|XP|SP2|39549030
ESP|01|XP|SP2|48075604

The SP2 part might be SP0, SP1, SP2, SP3, and perhaps other digits.

Each nick had a real name which matched the nickname.

Has anyone else seen these bots before?
Is spamfilter the best way to block these bots?
If so, can anyone show me which regex to use?

Thanks in advance.

Re: Bot attack

Posted: Thu Jul 03, 2008 12:04 pm
by Jonny15
I could sure use some help with the regex.
Can someone please give me some help?
Thanks

Re: Bot attack

Posted: Fri Jul 04, 2008 4:39 pm
by JRBlood
Yup, we've been seeing these bots for months now trying to join #babu3. Filter we put in place has stopped them cold:

Code: Select all

/spamfilter add u gzline 90d |Bot_Flooder_S| \|XPSP[0-9]\|
Hope this does the trick for ya. :)

Re: Bot attack

Posted: Fri Jul 04, 2008 7:41 pm
by Jonny15
Thanks JRBlood,

I"ll give that a try.

Re: Bot attack

Posted: Sun Jul 27, 2008 3:04 am
by CCCC
I had similar problem with bots, but is there any possibilities to ban if there is no version. Those guys did not have a version and if is possibility to ban those bots and scripts without version ???

Re: Bot attack

Posted: Wed Jul 30, 2008 8:07 pm
by JRBlood
If you can give us all examples of the nicks the bots are using, I'm sure someone can come up with a filter. :)

Re: Bot attack

Posted: Tue Sep 23, 2008 1:34 am
by Exedore
You can block this with your OperServ

Code: Select all

/msg operserv sqline add +0 *|XP|* Reason