Network under attack by a botnet - need help

These are old archives. They are kept for historic purposes only.
Post Reply
Thunderbird
Posts: 5
Joined: Mon Mar 08, 2004 5:23 pm

Network under attack by a botnet - need help

Post by Thunderbird »

I am a netadmin on an IRC Network that is currently being used by two botnets. We'd really like to get rid of these bots but currently have no way of doing so without spamming our opers.

Here's the deal. These bots connect to the network with either [elicomp]- or dUck-[ as their nick prefix. So far we have over 2000, yes that's two thousand glines, and they still keep coming.

They always join the same channel so we setup a trap chan using Anope services and that works, but it spams the opers with gline notices every couple of seconds, since the bots just keep joining.

Also we've tried the qline attempt, but that creates soooo much spam that unfortunately that's not an option.

These bots do not respond to CTCP Version and they have random idents and seem to come from an unmeasurable number of IP addresses (over 2000 at least).

What I need is a way to like gline a name i guess or somehow prevent anyone that has a nick containing dUck-[ or [elicomp]- from connecting to the network at all.
aquanight
Official supporter
Posts: 862
Joined: Tue Mar 09, 2004 10:47 pm
Location: Boise, ID

Re: Network under attack by a botnet - need help

Post by aquanight »

Thunderbird wrote:Also we've tried the qline attempt, but that creates soooo much spam that unfortunately that's not an option.
/mode <oper> +s -q
will shut up the qline snotice.
Thunderbird
Posts: 5
Joined: Mon Mar 08, 2004 5:23 pm

Post by Thunderbird »

Ok, I'm using your solution now and it seems to work. I guess there's not a better permanent solution? Even though we are using snomask -q, aren't the IRC servers still being spammed with Unknown Connections?
codemastr
Former UnrealIRCd head coder
Posts: 811
Joined: Sat Mar 06, 2004 8:47 pm
Location: United States
Contact:

Post by codemastr »

What I need is a way to like gline a name i guess or somehow prevent anyone that has a nick containing dUck-[ or [elicomp]- from connecting to the network at all.
Looks like you want an sqline. Usually, services has a command to do this. Something like:
/msg operserv sqline add dUck-[*
Try doing /msg operserv sqline help

That should solve your problem.
-- codemastr
Post Reply