Anybody know what these are?

These are old archives. They are kept for historic purposes only.
Stormdancing
Posts: 14
Joined: Mon Sep 27, 2004 3:29 pm

Anybody know what these are?

Post by Stormdancing » Wed Sep 29, 2004 9:57 pm

I have been noticing these for the last week or so. They never join any channel, just connect to the server and sit there. I'm suspicious. I kill them off and in a few hours they return to lurk in the hallway.

* Guest244942 H ~zgvyo@Stormdancing-60CD465.direct-adsl.nl :0 spobao
* Guest431650 H ~qqwhe@3D62027D.AEEB8337.594AFDCE.IP :0 ofjjat
* Guest558634 H ~vcssr@38552AC3.B92519CF.1B78581D.IP :1 vequiu
* Guest647264 H ~pbrhn@11EDFF2A.6819D7AA.467A0286.IP :0 gjkvvi
* Guest155805 H ~irqkm@290727B2.ECB13FB3.5657B9D4.IP :1 dufedp
* Guest397621 H ~rivth@Stormdancing-1C7919B3.nsw.bigpond.net.au :1 lzdssc
* Guest654860 H ~djxwn@Stormdancing-25F162D7.dalect01.va.comcast.net :1 klgojd
* Guest142248 H ~sulky@Stormdancing-2A12A284.fastres.net :2 ddbaao
* Guest419843 H ~apvgm@Stormdancing-26B81D5.kabel.telenet.be :0 cxcjql

WilliamWIkked
Posts: 59
Joined: Sun Jun 20, 2004 3:30 am
Contact:

Post by WilliamWIkked » Wed Sep 29, 2004 11:40 pm

Someone else told me about them, and IRC Defender doesn't catch them.
[insert another cliche sig here.]

codemastr
Former UnrealIRCd head coder
Posts: 811
Joined: Sat Mar 06, 2004 8:47 pm
Location: United States
Contact:

Post by codemastr » Thu Sep 30, 2004 12:11 am

It's kind of hard to tell from that, they could be anything. Perhaps you can gather a bit more info? Do they respond to CTCP version? If so, with with? What about other CTCPs? If you msg them, do they say anything back? What about if you invite them to a channel? Or force them to join a channel? Sometimes they'll leak a bit of info with things like that.
-- codemastr

Syzop
UnrealIRCd head coder
Posts: 1957
Joined: Sat Mar 06, 2004 8:57 pm
Location: .nl
Contact:

Post by Syzop » Thu Sep 30, 2004 2:46 am

I noticed a thread about this somewhere.. basically the only thing they came up with was to qline "Guest??????" (since they all have 6 digits), services won't have problems with changing people to Guest nicks anyway since they can override that... it would only affect users with 'Guest' + 6 characters.

[on a sidenote, some people with other apps used (more specific) regexes like "Guest[0-9]{6}", but we don't have support for that yet. This will however be added very soon ;).]

Still, I'm interested in any additional info about what these bots do/can too :).

Ron2K

Post by Ron2K » Thu Sep 30, 2004 6:36 am

Funny you should bring this up here. Yesterday, on a channel on KnightNet that I sit in, we had a join flood with those nicks. (I just put a ban on Guest*!*@* and kicked them all off.)

The user@host mask mentioned looks familiar too.

aquanight
Official supporter
Posts: 862
Joined: Tue Mar 09, 2004 10:47 pm
Location: Boise, ID

Post by aquanight » Thu Sep 30, 2004 7:32 am

Syzop wrote:I noticed a thread about this somewhere.. basically the only thing they came up with was to qline "Guest??????" (since they all have 6 digits), services won't have problems with changing people to Guest nicks anyway since they can override that... it would only affect users with 'Guest' + 6 characters.
We really need to have the ability to extend ban nick {} / SQLINE to do things other than just say "Erroneous nick" eg kill/kline/zline (recommend only those for ban nick{}) or kill/gline/gzline (for SQLINE). Or allow the connection with a tempshun or regular shun :) .

** moderator Syzop edit: please read my post, I already clearly said something about that, you are getting a bit annoying **

pak
Posts: 17
Joined: Thu Mar 11, 2004 8:26 pm

Post by pak » Thu Sep 30, 2004 9:01 am

these have been around on our network for some time and a number of other networks have them too, only on some of the networks do they join any channels, ours is unfortuntely one of those, they pm people about 30seconds afterward an on join event with a variable message that (at the time contained http://www.powow.com/gameo/sexclip dot exe ) obviously you could spamfilter this, but seeing as they are not joining any of your channels, then it won't work for you, the url may also have changed since we qlined them

I don't know what has happened to the website since as we qlined Guest??????, however I know they reported to another network (can't remember which off the top of my head) where the bot owner controled them

Stormdancing
Posts: 14
Joined: Mon Sep 27, 2004 3:29 pm

Post by Stormdancing » Thu Sep 30, 2004 4:35 pm

Guest631493 is ~sccoz@Stormdancing-60CD465.direct-adsl.nl * jgcird
Guest631493 is connecting from *@ip51cf4eb1.direct-adsl.nl 81.207.78.177

Guest602993 is ~iiazj@Stormdancing-366F26B9.pit.adelphia.net * rgfors
Guest602993 is connecting from *@pa-latrobe1b-147.pit.adelphia.net 68.65.137.147

No version reply
Does not respond to any of my ctcp
No response to /msg or /notice
No response to invite
No response to DCC chat
No response to DCC Send

sajoin each and they all joined
still no response to /msg /notice /ctcp

You're welcome to come over and check-out/abuse them however you wish. LOL

irc.stormdancing.net

Dana

Stormdancing
Posts: 14
Joined: Mon Sep 27, 2004 3:29 pm

Post by Stormdancing » Fri Oct 01, 2004 4:12 pm

Joy oh Joy, now they are 3 fold. 3 times as many as before I messed with them...........

off I go to set a ban

katsklaw
Official supporter
Posts: 1124
Joined: Sun Apr 18, 2004 5:06 pm
Contact:

Post by katsklaw » Fri Oct 01, 2004 5:58 pm

are they in any channels?

Stormdancing
Posts: 14
Joined: Mon Sep 27, 2004 3:29 pm

Post by Stormdancing » Fri Oct 01, 2004 8:03 pm

katsklaw Posted: Fri Oct 01, 2004 5:58 pm Post subject:

--------------------------------------------------------------------------------

are they in any channels?
No they are all in the hall.

Jason
Posts: 570
Joined: Mon Jun 14, 2004 5:09 pm

Post by Jason » Fri Oct 01, 2004 10:05 pm

Add to mIRC Remotes:
raw 352:*:/gzline $5 7d Go away Bots
(The $5 may be one off, actually $4 or $6)

Then Type: /who +n Guest??????

As the results on the /who come in, your mIRC will gzline them. That will take care of those bots, feel free to alter it as you see fit, and if your running anything but mIRC, sorry, you lose
Why the hell can't my signature be empty?
"Your message contains too few characters."

aquanight
Official supporter
Posts: 862
Joined: Tue Mar 09, 2004 10:47 pm
Location: Boise, ID

Post by aquanight » Sat Oct 02, 2004 5:32 am

AAAAAH.

And what happens when I do a regular /who? It gzlines everyone in my net!
What happens when I join a channel, and my self-joined script /who's the channel to update the address list? It gzlines the whole channel! Not good!

Improved version:

Code: Select all

alias gzlinethosebots {
    enable #gzlinethosebots
    who +n Guest??????
}
#gzlinethosebots off
raw 352:*:if (Guest?????? iswm $5) gzline $5 7d Go away.
raw 315:*:disable #gzlinethosebots
#gzlinethosebots end
Type /gzlinethosebots and they're gone.

mikeallmighty

Post by mikeallmighty » Mon Feb 14, 2005 6:07 am

i could be wrong but they look like dsnx bots i would suggest this on mirc or if your running bx lemme know ill give u a code for that

Code: Select all

on *:snotice: if ($nick == guest??????) {gzline $nick +0 DSNX are lame} }}

White_Magic
Posts: 267
Joined: Tue Jan 18, 2005 3:24 pm
Location: Scotland - United Kingdom

Post by White_Magic » Mon Feb 14, 2005 11:07 am

aquanight wrote:AAAAAH.

And what happens when I do a regular /who? It gzlines everyone in my net!
What happens when I join a channel, and my self-joined script /who's the channel to update the address list? It gzlines the whole channel! Not good!

Improved version:

Code: Select all

alias gzlinethosebots {
    enable #gzlinethosebots
    who +n Guest??????
}
#gzlinethosebots off
raw 352:*:if (Guest?????? iswm $5) gzline $5 7d Go away.
raw 315:*:disable #gzlinethosebots
#gzlinethosebots end
Type /gzlinethosebots and they're gone.
its $6 for the nickname, i know becuz i have a addon made to do this exact task except it can do more, is also offers " protection" to the user using it, the coder *(myself)* and certain channels so it aviods Banning people ON that the channel u state, (Gzlining a netadmin aint a good idea u know) - ive had this addon made at least since beta versions of unreal:D
i spend 4 hrs a day gaming and 14hrs on irc, for 5days a week, im not an addict :D

Post Reply