Spamfilter?

These are old archives. They are kept for historic purposes only.
Post Reply
Guest

Spamfilter?

Post by Guest » Sat Aug 14, 2004 10:11 am

4,15 i15 $+ $r(a,z) $+ 4r15 $+ $r(a,z) $+ 4c 4. 4i15 $+ $r(a,z) $+ 4z15 $+ $r(a,z) $+ 4m15 $+ $r(a,z) $+ 4i15 $+ $r(a,z) $+ 4r . c15 $+ $r(a,z) $+ 4o15 $+ $r(a,z) $+ 4m
4,15 i15 $+ $r(a,z) $+ 4r15 $+ $r(a,z) $+ 4c 4. 4A15 $+ $r(a,z) $+ 4n15 $+ $r(a,z) $+ 4k15 $+ $r(a,z) $+ 4a15 $+ $r(a,z) $+ 4r15 $+ $r(a,z) $+ 4a . 4c15 $+ $r(a,z) $+ 4o15 $+ $r(a,z) $+ 4m
4,15 i15 $+ $r(a,z) $+ 4r15 $+ $r(a,z) $+ 4c 4. A15 $+ $r(a,z) $+ 4n15 $+ $r(a,z) $+ 4t15 $+ $r(a,z) $+ 4a15 $+ $r(a,z) $+ 4l15 $+ $r(a,z) $+ 4y15 $+ $r(a,z) $+ 4a .15 $+ $r(a,z) $+ 4c15 $+ $r(a,z) $+ 4o15 $+ $r(a,z) $+ 4m
4,15 i15 $+ $r(a,z) $+ 4r15 $+ $r(a,z) $+ 4c 4. 4S15 $+ $r(a,z) $+ 4h15 $+ $r(a,z) $+ 4o15 $+ $r(a,z) $+ 4w15 $+ $r(a,z) $+ 4t15 $+ $r(a,z) $+ 4v15 4.15 $+ $r(a,z) $+ 4c15 $+ $r(a,z) $+ 4o15 $+ $r(a,z) $+ 4m

add to spamfilter?

codemastr
Former UnrealIRCd head coder
Posts: 811
Joined: Sat Mar 06, 2004 8:47 pm
Location: United States
Contact:

Post by codemastr » Sat Aug 14, 2004 4:36 pm

Umm?
-- codemastr

_HTH_
Posts: 8
Joined: Tue Mar 09, 2004 7:56 pm

Post by _HTH_ » Sat Aug 14, 2004 8:48 pm

Well lol, i didn´t get what he wanted until i used his code with //echo in mIRC ... it´s an irc address in some colored way.
Do it yourself to see it, i can´t paste it with the colors.

Greetings
Christian 'cg' Gayer
RTFM or DIE! :)

codemastr
Former UnrealIRCd head coder
Posts: 811
Joined: Sat Mar 06, 2004 8:47 pm
Location: United States
Contact:

Post by codemastr » Sat Aug 14, 2004 11:38 pm

Well I don't run mIRC so that was why I was asking. But anyway, does it actually display all those $r's in the channel? Or does it show the text it evaluates to?
-- codemastr

aquanight
Official supporter
Posts: 862
Joined: Tue Mar 09, 2004 10:47 pm
Location: Boise, ID

Post by aquanight » Sun Aug 15, 2004 12:18 am

codemastr wrote:Well I don't run mIRC so that was why I was asking. But anyway, does it actually display all those $r's in the channel? Or does it show the text it evaluates to?
Well, if you just copy/paste it as it is, mIRC won't evaluate ID's at all :P .

Sending it to //echo seems to simply remove the $r's. There's no definition of it in mIRC's helpfile, so I'm assuming it must have been a custom alias/identifier on the originator's client.

As to what it appears as (taking the top one):

Code: Select all

 i r c . i z m i r . c o m 
There's a bit of color: the background is gray, and the letters are red (but the code tag prevents me from showing this :/ ) .

codemastr
Former UnrealIRCd head coder
Posts: 811
Joined: Sat Mar 06, 2004 8:47 pm
Location: United States
Contact:

Post by codemastr » Sun Aug 15, 2004 12:37 am

No, $r is $rand. For whatever reason, mIRC treats $r as an alias for that. Since the background and text color is gray, those characters are hidden. Basically, it seems to be an IRC version of the email spam technique.
You hide stuff in the same color as the background color to trick spam filters. To the naked eye, it looks like spam, but to the spam filter it doesn't. Anyway, should be rather easy to block
i[a-z]r[a-z]c[a-z].[a-z]i[a-z]z[a-z]m[a-z]i[a-z]r[a-z].[a-z]c[a-z]o[a-z]m

Something like that should do the trick.
-- codemastr

aquanight
Official supporter
Posts: 862
Joined: Tue Mar 09, 2004 10:47 pm
Location: Boise, ID

Post by aquanight » Sun Aug 15, 2004 4:03 am

codemastr wrote:No, $r is $rand. For whatever reason, mIRC treats $r as an alias for that.
Hm... never knew that :P . Apparently, it's completely undocumented :P .
codemastr wrote:Since the background and text color is gray, those characters are hidden. Basically, it seems to be an IRC version of the email spam technique.
You hide stuff in the same color as the background color to trick spam filters. To the naked eye, it looks like spam, but to the spam filter it doesn't. Anyway, should be rather easy to block
i[a-z]r[a-z]c[a-z].[a-z]i[a-z]z[a-z]m[a-z]i[a-z]r[a-z].[a-z]c[a-z]o[a-z]m

Something like that should do the trick.
Interesting... maybe if support to match color codes in spamfilters was added - this technique could be blocked entirely... :P . Just getting that ^C character into the conf file would be tricky (but not so with /spamfilter :P ).

Stealth
Head of Support
Posts: 2086
Joined: Tue Jun 15, 2004 8:50 pm
Location: Chino Hills, CA, US
Contact:

Post by Stealth » Sun Aug 15, 2004 6:44 am

Echoed in mIRC, i got:

Code: Select all

 iarzc . iwzqmciyr . cboqm 
 izrac . Aknjktatrza . cyoim 
 icrpc . Ajnftvaplyyra .kcmonm 
 iqruc . Srhaoiwbtzv .ycvodm 
BUT you only see (due to colors):

Code: Select all

i r c . i z m i r . c o m 
i r c . A n k a r a . c o m
i r c . A n t a l y a . c o m
i r c . S h o w t v . c o m
The $r's are intentional, as they fill the spaces in the result with a random char to make the user think it is actually doing something important.

Winbots
Posts: 65
Joined: Wed Apr 21, 2004 12:26 am
Location: irc://irc.winbots.org/Winbots
Contact:

Post by Winbots » Mon Sep 20, 2004 10:41 pm

Code: Select all

4,15 i15w4r15d4c 4. 4i15h4z15g4m15a4i15n4r . c15k4o15f4m 
4,15 i15d4r15q4c 4. 4A15n4n15c4k15j4a15o4r15b4a . 4c15l4o15w4m 
4,15 i15x4r15r4c 4. A15k4n15o4t15n4a15z4l15n4y15q4a .15q4c15f4o15b4m 
4,15 i15x4r15v4c 4. 4S15f4h15q4o15f4w15b4t15h4v15 4.15o4c15t4o15h4m 
there is an example of it :)

Post Reply