Page 1 of 1

drone/clone

Posted: Sun Sep 06, 2009 11:12 pm
by menara
hallo can someone help me please with this bots?

x[`Z]] (~qz@200.96.178.34)
y[^[[] (~y@80.250.32.49)
r[\_[] (~e__@119.2.48.42)
q[`^_] (~rzz@119.2.48.42)

is ther a spamfilter for those special characters [ ]

thx

Re: drone/clone

Posted: Mon Sep 07, 2009 10:35 am
by Jobe
Try:
^[a-z]\[[a-z0-9\[\]^`\\_]{3}\]!

Re: drone/clone

Posted: Mon Sep 07, 2009 11:19 am
by menara
thx.
but dont work

Re: drone/clone

Posted: Fri Sep 25, 2009 9:07 pm
by frozenfire
Try removing the ! at the end.

Re: drone/clone

Posted: Sat Sep 26, 2009 2:24 pm
by Jobe
frozenfire wrote:Try removing the ! at the end.
The ! is from the nick!ident@host:name mask that type "u" spamfilters are matched against, it's purpose is to prvent false positives for people who's nicks start with something that match but dont match entirely.

Re: drone/clone

Posted: Tue Jan 05, 2010 3:17 pm
by menara
what about this clones?

fazley is ~jehyrjk@85C8D0E4.6F3BE497.BB49A1F6.IP * inbasv
afar_ is ~aaaaaaaz@A67A2B42.4C4C7B4B.94B07629.IP * kjgdsw
idilz is ~figaro@91C310A5.25239CDA.9A523545.IP * lmrmvy
cddroom is ~opiiec@289C8351.E766BD51.A00E5A25.IP * jriqia
are_ was ~dherfd@120.50.48.251 * jxzrxn
madi was ~polleod@212.116.219.150 * bvxixo

i need a reges please

Thx

Re: drone/clone

Posted: Tue Jan 05, 2010 7:08 pm
by Stealth
Because there's not definite pattern other than the realname is always 6 characters and everything is lower-case, I think a better option than spamfilter would be to run a BOPM or other scanner that will check the connecting IPs against a blacklist (I recommend DroneBL and ProxyBL). I checked the 2 IPs you gave in your most recent reply against DroneBL and ProxyBL, and both of them came back as listed in at least 1 blacklist (this means the person running them is using proxies).

BOPM is easy to set up and use on your network. You simply need to download, compile it, and configure it to connect to your network and which blacklists you want it to check. You can download BOPM from http://wiki.blitzed.org/BOPM and there's an easy to follow example configuration for BOPM (which includes DroneBL and ProxyBL) here: http://tinyurl.com/ycuedg6

EDIT: I also decided to check the IPs from the first post on the blacklists. All of them appear in either DroneBL or ProxyBL. Most of the IPs appear in both!

Re: drone/clone

Posted: Tue Jan 05, 2010 7:56 pm
by menara
<Scanner> DNSBL -> Lookup error on 219.19.140.41.dnsbl.dronebl.org: Refused
<Scanner> DNSBL -> Lookup error on 219.19.140.41.ircbl.ahbl.org: Refused
<Scanner> DNSBL -> Lookup error on 219.19.140.41.tor.dnsbl.sectoor.de: Refused
<Scanner> DNSBL -> Lookup error on 219.19.140.41.rbl.efnet.org: Refused

catch 1 and let 5 connect

Re: drone/clone

Posted: Tue Jan 05, 2010 10:06 pm
by Stealth
Having a BOPM come back and say you're getting a refused error on all your blacklists appears to be a problem with your host/firewall configuration. If this server is on a paid host, you should check with your hosting provider.

Re: drone/clone

Posted: Sun Jan 31, 2010 7:48 pm
by Alexofdarkness
Hey im new to the site and i have a bot that scans incoming connections you can use

Re: drone/clone

Posted: Tue Dec 17, 2013 5:41 am
by erum
Stealth you are great, thanks a lot. I will it try out this evening. Sorry for my English. I will although try out your BOPM configuration example. No we haven't users from Indonesia.??