drone/clone

These are old archives. They are kept for historic purposes only.
Post Reply
menara
Posts: 4
Joined: Sun Sep 06, 2009 11:05 pm

drone/clone

Post by menara »

hallo can someone help me please with this bots?

x[`Z]] (~qz@200.96.178.34)
y[^[[] (~y@80.250.32.49)
r[\_[] (~e__@119.2.48.42)
q[`^_] (~rzz@119.2.48.42)

is ther a spamfilter for those special characters [ ]

thx
Jobe
Official supporter
Posts: 1180
Joined: Wed May 03, 2006 7:09 pm
Location: United Kingdom

Re: drone/clone

Post by Jobe »

Try:
^[a-z]\[[a-z0-9\[\]^`\\_]{3}\]!
Your IP: Image
Your Country: Image
menara
Posts: 4
Joined: Sun Sep 06, 2009 11:05 pm

Re: drone/clone

Post by menara »

thx.
but dont work
frozenfire
Posts: 4
Joined: Fri Sep 25, 2009 8:38 pm

Re: drone/clone

Post by frozenfire »

Try removing the ! at the end.
Jobe
Official supporter
Posts: 1180
Joined: Wed May 03, 2006 7:09 pm
Location: United Kingdom

Re: drone/clone

Post by Jobe »

frozenfire wrote:Try removing the ! at the end.
The ! is from the nick!ident@host:name mask that type "u" spamfilters are matched against, it's purpose is to prvent false positives for people who's nicks start with something that match but dont match entirely.
Your IP: Image
Your Country: Image
menara
Posts: 4
Joined: Sun Sep 06, 2009 11:05 pm

Re: drone/clone

Post by menara »

what about this clones?

fazley is ~jehyrjk@85C8D0E4.6F3BE497.BB49A1F6.IP * inbasv
afar_ is ~aaaaaaaz@A67A2B42.4C4C7B4B.94B07629.IP * kjgdsw
idilz is ~figaro@91C310A5.25239CDA.9A523545.IP * lmrmvy
cddroom is ~opiiec@289C8351.E766BD51.A00E5A25.IP * jriqia
are_ was ~dherfd@120.50.48.251 * jxzrxn
madi was ~polleod@212.116.219.150 * bvxixo

i need a reges please

Thx
Stealth
Head of Support
Posts: 2086
Joined: Tue Jun 15, 2004 8:50 pm
Location: Chino Hills, CA, US
Contact:

Re: drone/clone

Post by Stealth »

Because there's not definite pattern other than the realname is always 6 characters and everything is lower-case, I think a better option than spamfilter would be to run a BOPM or other scanner that will check the connecting IPs against a blacklist (I recommend DroneBL and ProxyBL). I checked the 2 IPs you gave in your most recent reply against DroneBL and ProxyBL, and both of them came back as listed in at least 1 blacklist (this means the person running them is using proxies).

BOPM is easy to set up and use on your network. You simply need to download, compile it, and configure it to connect to your network and which blacklists you want it to check. You can download BOPM from http://wiki.blitzed.org/BOPM and there's an easy to follow example configuration for BOPM (which includes DroneBL and ProxyBL) here: http://tinyurl.com/ycuedg6

EDIT: I also decided to check the IPs from the first post on the blacklists. All of them appear in either DroneBL or ProxyBL. Most of the IPs appear in both!
menara
Posts: 4
Joined: Sun Sep 06, 2009 11:05 pm

Re: drone/clone

Post by menara »

<Scanner> DNSBL -> Lookup error on 219.19.140.41.dnsbl.dronebl.org: Refused
<Scanner> DNSBL -> Lookup error on 219.19.140.41.ircbl.ahbl.org: Refused
<Scanner> DNSBL -> Lookup error on 219.19.140.41.tor.dnsbl.sectoor.de: Refused
<Scanner> DNSBL -> Lookup error on 219.19.140.41.rbl.efnet.org: Refused

catch 1 and let 5 connect
Stealth
Head of Support
Posts: 2086
Joined: Tue Jun 15, 2004 8:50 pm
Location: Chino Hills, CA, US
Contact:

Re: drone/clone

Post by Stealth »

Having a BOPM come back and say you're getting a refused error on all your blacklists appears to be a problem with your host/firewall configuration. If this server is on a paid host, you should check with your hosting provider.
Alexofdarkness
Posts: 3
Joined: Sun Dec 27, 2009 2:14 am

Re: drone/clone

Post by Alexofdarkness »

Hey im new to the site and i have a bot that scans incoming connections you can use
erum
Posts: 1
Joined: Tue Dec 17, 2013 5:34 am

Re: drone/clone

Post by erum »

Stealth you are great, thanks a lot. I will it try out this evening. Sorry for my English. I will although try out your BOPM configuration example. No we haven't users from Indonesia.??
Post Reply