UnrealIRCd Forums

I have been noticing these for the last week or so. They never join any channel, just connect to the server and sit there. I'm suspicious. I kill them off and in a few hours they return to lurk in the hallway.

* Guest244942 H ~[email protected] :0 spobao
* Guest431650 H ~[email protected] :0 ofjjat
* Guest558634 H ~[email protected] :1 vequiu
* Guest647264 H ~[email protected] :0 gjkvvi
* Guest155805 H ~[email protected] :1 dufedp
* Guest397621 H ~[email protected] :1 lzdssc
* Guest654860 H ~[email protected] :1 klgojd
* Guest142248 H ~[email protected] :2 ddbaao
* Guest419843 H ~[email protected] :0 cxcjql

Someone else told me about them, and IRC Defender doesn't catch them.

It's kind of hard to tell from that, they could be anything. Perhaps you can gather a bit more info? Do they respond to CTCP version? If so, with with? What about other CTCPs? If you msg them, do they say anything back? What about if you invite them to a channel? Or force them to join a channel? Sometimes they'll leak a bit of info with things like that.

I noticed a thread about this somewhere.. basically the only thing they came up with was to qline "Guest??????" (since they all have 6 digits), services won't have problems with changing people to Guest nicks anyway since they can override that... it would only affect users with 'Guest' + 6 characters.

[on a sidenote, some people with other apps used (more specific) regexes like "Guest[0-9]{6}", but we don't have support for that yet. This will however be added very soon ;).]

Still, I'm interested in any additional info about what these bots do/can too :).

Funny you should bring this up here. Yesterday, on a channel on KnightNet that I sit in, we had a join flood with those nicks. (I just put a ban on Guest*!*@* and kicked them all off.)

The user@host mask mentioned looks familiar too.

Syzop wrote:I noticed a thread about this somewhere.. basically the only thing they came up with was to qline "Guest??????" (since they all have 6 digits), services won't have problems with changing people to Guest nicks anyway since they can override that... it would only affect users with 'Guest' + 6 characters.

We really need to have the ability to extend ban nick {} / SQLINE to do things other than just say "Erroneous nick" eg kill/kline/zline (recommend only those for ban nick{}) or kill/gline/gzline (for SQLINE). Or allow the connection with a tempshun or regular shun .

** moderator Syzop edit: please read my post, I already clearly said something about that, you are getting a bit annoying **

these have been around on our network for some time and a number of other networks have them too, only on some of the networks do they join any channels, ours is unfortuntely one of those, they pm people about 30seconds afterward an on join event with a variable message that (at the time contained http://www.powow.com/gameo/sexclip dot exe ) obviously you could spamfilter this, but seeing as they are not joining any of your channels, then it won't work for you, the url may also have changed since we qlined them

I don't know what has happened to the website since as we qlined Guest??????, however I know they reported to another network (can't remember which off the top of my head) where the bot owner controled them

Guest631493 is ~[email protected] * jgcird
Guest631493 is connecting from *@ip51cf4eb1.direct-adsl.nl 81.207.78.177

Guest602993 is ~[email protected] * rgfors
Guest602993 is connecting from *@pa-latrobe1b-147.pit.adelphia.net 68.65.137.147

No version reply
Does not respond to any of my ctcp
No response to /msg or /notice
No response to invite
No response to DCC chat
No response to DCC Send

sajoin each and they all joined
still no response to /msg /notice /ctcp

You're welcome to come over and check-out/abuse them however you wish. LOL

irc.stormdancing.net

Dana

Joy oh Joy, now they are 3 fold. 3 times as many as before I messed with them...........

off I go to set a ban

are they in any channels?

katsklaw Posted: Fri Oct 01, 2004 5:58 pm Post subject:

--------------------------------------------------------------------------------

are they in any channels?

No they are all in the hall.

Add to mIRC Remotes:
raw 352:*:/gzline $5 7d Go away Bots
(The $5 may be one off, actually $4 or $6)

Then Type: /who +n Guest??????

As the results on the /who come in, your mIRC will gzline them. That will take care of those bots, feel free to alter it as you see fit, and if your running anything but mIRC, sorry, you lose

AAAAAH.

And what happens when I do a regular /who? It gzlines everyone in my net!
What happens when I join a channel, and my self-joined script /who's the channel to update the address list? It gzlines the whole channel! Not good!

Improved version:
Type /gzlinethosebots and they're gone.

i could be wrong but they look like dsnx bots i would suggest this on mirc or if your running bx lemme know ill give u a code for that

aquanight wrote:AAAAAH.

And what happens when I do a regular /who? It gzlines everyone in my net!
What happens when I join a channel, and my self-joined script /who's the channel to update the address list? It gzlines the whole channel! Not good!

Improved version:

Code: Select all

alias gzlinethosebots {
    enable #gzlinethosebots
    who +n Guest??????
}
#gzlinethosebots off
raw 352:*:if (Guest?????? iswm $5) gzline $5 7d Go away.
raw 315:*:disable #gzlinethosebots
#gzlinethosebots end

Type /gzlinethosebots and they're gone.

its $6 for the nickname, i know becuz i have a addon made to do this exact task except it can do more, is also offers " protection" to the user using it, the coder *(myself)* and certain channels so it aviods Banning people ON that the channel u state, (Gzlining a netadmin aint a good idea u know) - ive had this addon made at least since beta versions of unreal:D