Spam Bots

If you have trouble on your server with spam, drones/zombies/bots or proxies

Moderator: Supporters

Locked
RadioClick
Posts: 20
Joined: Sat Dec 18, 2010 2:03 pm

Spam Bots

Post by RadioClick »

Hello, i have some problem with the spam bots and i don't know how to stop him.
I use blacklist like dnsblacklist.co.uk or dronebl.org.
I also use the spamfilter for the website and the irc adress irc.freenode.net but now use other language and i don't know wich one is:
[PRIVMSG #ChatRomanesc: 'A fascinatіng bⅼοg ᴡһerе frᥱеnoԁᥱ staff ⅿᥱⅿber Matthew mѕt Trout recoᥙᥒts һіѕ eⲭperiᥱncеѕ of еyе-raping уoᥙng cһⅰldrᥱᥒ https://MattSTrоut.соⅿ/'] [Spam/Advertising]

[Spamfilter] [email protected] matches filter 'https': [PRIVMSG #System: 'А fÉ‘Ñ•cinatiᥒg blog wһеre frееᥒodе ѕtаff ⅿеmbеr Matthеw mÑ•t Trഠᥙt recⲟ∪nts Ò»iѕ exреrâ…°ences of eуе-raping ỿoung ϲhiⅼԁrᥱᥒ https://MattSТroᥙt.cⲟⅿ/'] [Spam/Advertising]

[Spamfilter] [email protected] matches filter 'https': [PRIVMSG #wWe: 'Read wÒ»at IRᏟ â…°nveÑ•tÑ–É¡ative ϳοurnaⅼіsts һаvе uᥒcoᴠеred ഠn the frеeᥒoԁe ⲣеԁоphiâ…¼ia Ñ•cɑᥒdal https:⧸᜵ᥱnсyclopediаdraâ…¿atica.rs∕ᖴreᥱᥒoԁegate'] [Spam/Advertising]

(15:24) <zayita> /!\ AΤΤN: Τhіs cһanᥒeⅼ haѕ mഠ∨eԁ to irϲ.freeᥒoԁe.nеt #/jοiᥒ ᜵!\
(15:24) <zayita> І tһouɡht you guỿs migһt be intereѕted ⅰn tһis blog by freеnοdе ѕtaff meⅿber Βrуɑn klഠᥱri Οstеrgɑarԁ httⲣѕ://bryɑᥒοѕtеrgaɑrⅾ․coⅿ/
(15:24) <zayita> Read ᴡһat ΙRC іnvеstⅰɡatiᴠе јoᥙrᥒaⅼіsts hɑvе uᥒcoᴠereԁ oᥒ the freеᥒoԁe peԁophⅰⅼⅰa scɑnⅾaⅼ һttрѕ˸/∕еnⅽyϲⅼopeԁiadraⅿatⅰϲa.rs/Frᥱeᥒodeɡate

Somebody can help me?
CrazyCat
Posts: 214
Joined: Thu Apr 28, 2005 1:05 pm
Location: France
Contact:

Re: Spam Bots

Post by CrazyCat »

The only solution I found was to install m_listrestrict and to put a delay of 180s. The bots fed up before they can spam.
RadioClick
Posts: 20
Joined: Sat Dec 18, 2010 2:03 pm

Re: Spam Bots

Post by RadioClick »

But this module i must install or we have installed on unrealircd 4?
CrazyCat
Posts: 214
Joined: Thu Apr 28, 2005 1:05 pm
Location: France
Contact:

Re: Spam Bots

Post by CrazyCat »

You have to install it:
Copy the source of m_listrestrict.c (https://gitgud.malvager.net/Wazakindjes ... restrict.c) in the src/modules/third/ directory of your unreal sources, then make and make install.
After that, add in your unrealircd.conf file:

Code: Select all

loadmodule "third/m_listrestrict";
And add the settings at the end of this file:

Code: Select all

listrestrict {
    connectdelay 180;
    needauth 0;
    exceptions {
        all "[email protected]";
        all "[email protected]";
    };
};
(the exceptions are mine, not mandatory)

Rehash and it will work
CrazyCat
Posts: 214
Joined: Thu Apr 28, 2005 1:05 pm
Location: France
Contact:

Re: Spam Bots

Post by CrazyCat »

New way: they just connect and quit with ##freenodegate as quit message.
Solution:

Code: Select all

/spamfilter add -simple q gzline 1d No_spamming_here *freenodegate*
RadioClick
Posts: 20
Joined: Sat Dec 18, 2010 2:03 pm

Re: Spam Bots

Post by RadioClick »

today i'm connect to my network with qwebirc and i can see what diacritical use:
== johnmark [[email protected]] has joined #Romania
[15:00] <johnmark> /!\ ATTΝ: Tһіѕ cһaᥒnеⅼ has ⅿоved to irс.freᥱᥒοdе.nᥱt ﹟/ϳоⅰᥒ /!\
[15:00] <johnmark> Ꮤith ⲟᥙr IᎡC ad sеrvіcᥱ yoᥙ cɑn reɑϲһ a gⅼobal a∪ⅾiᥱᥒce of еᥒtreрrene∪rs аᥒd fᥱᥒtɑᥒyⅼ adⅾicts witһ extraorԁⅰᥒɑry enɡagеment ratеsǃ һttрs:᜵/ᴡiⅼliɑmрitcоck.ϲom/
[15:00] <johnmark> Ꭱead wһɑt ΙRС iᥒⅴеstіgɑtive ϳoᥙrnaliѕts havе ∪ncഠvᥱred oᥒ thᥱ freeᥒoԁe pedophiⅼіa sⅽаnԁal һttрs://encусlopediadramɑtⅰca.rѕ/Freеnodᥱgatᥱ
[15:00] <johnmark> A faѕcіᥒɑtiᥒɡ blog wһere frеenode stɑff ⅿеⅿber Matthew mѕt Тrഠut reϲo∪ᥒtѕ hіs exреriеᥒϲes of eyᥱ﹣rɑрinɡ youᥒg cһilԁren httрs://MattSΤrоut.ϲom/

== xexaxo1 [[email protected]] has joined #Romania
[13:22] <xexaxo1> /!\ ᎪΤΤN: Tһіs ϲһannel has ⅿഠveԁ to irc․frᥱеnoⅾe.nᥱt #/ϳoin /︕\
[13:22] <xexaxo1> Wіtһ our IᖇⅭ aԁ ѕervіcе yοu can reaϲh а ɡlobaⅼ аudіeᥒce of eᥒtrᥱрreᥒeurѕ ɑnԁ fеᥒtanyl addicts witһ extrɑⲟrdinarỿ eᥒgaɡemeᥒt rɑtes! httрѕ:⧸/ᴡilliɑmⲣitcock.cഠm/
[13:22] <xexaxo1> Ꮢeаd ᴡһаt IRC invеstіɡаtі⋁e jo∪rᥒɑliѕts havе ᥙᥒcovᥱrᥱԁ оᥒ thᥱ frᥱᥱᥒodе ⲣᥱdophⅰlia ѕⅽɑnԁal httⲣѕ://eᥒcỿcⅼopеԁiaԁraⅿaticɑ.rs/Freeᥒοԁеgɑte
[13:22] <xexaxo1> A fɑsсinatіᥒg blഠɡ wһеrе freᥱnഠde ѕtаff mеⅿbᥱr Ϻatthew ⅿѕt Troᥙt rᥱco∪ᥒtѕ hⅰѕ exⲣerіеᥒϲes of eyе-rapіᥒg youᥒg ϲhiⅼdreᥒ httрѕ:/⧸MattᏚТro∪t.сοm/
RadioClick
Posts: 20
Joined: Sat Dec 18, 2010 2:03 pm

Re: Spam Bots

Post by RadioClick »

Hello, i don't know how can i thank you, after installing the module who tell me, i see when the spsammer stil enter o my network but can't spam anymore. Thank you, so much.
I use also use blaklist code like dronebl, efnetrbl ed altro in config.
CrazyCat
Posts: 214
Joined: Thu Apr 28, 2005 1:05 pm
Location: France
Contact:

Re: Spam Bots

Post by CrazyCat »

I use the new version of Gottem's listrestrict module but unfortunately, some bots succeed to join channels and spam.

So, I had an eye on their activity and I saw they first register their nick and then they bypass the restriction.
Simple response from me (using anope): I add a delay before they can register (nickregdelay = 30s), because I had (and want to keep) authisenough 1
Syzop
UnrealIRCd head coder
Posts: 2112
Joined: Sat Mar 06, 2004 8:57 pm
Location: .nl
Contact:

Re: Spam Bots

Post by Syzop »

I know this thread is mostly about LIST but this type of spam as pasted by RadioClick is detected by the antimixedutf8 module (included as an optional module in UnrealIRCd 4.2.1).
RadioClick wrote: Tue Oct 30, 2018 2:32 pm today i'm connect to my network with qwebirc and i can see what diacritical use:
== johnmark [[email protected]] has joined #Romania
[15:00] <johnmark> /!\ ATTΝ: Tһіѕ cһaᥒnеⅼ has ⅿоved to irс.freᥱᥒοdе.nᥱt ﹟/ϳоⅰᥒ /!\
[15:00] <johnmark> Ꮤith ⲟᥙr IᎡC ad sеrvіcᥱ yoᥙ cɑn reɑϲһ a gⅼobal a∪ⅾiᥱᥒce of еᥒtreрrene∪rs аᥒd fᥱᥒtɑᥒyⅼ adⅾicts witһ extraorԁⅰᥒɑry enɡagеment ratеsǃ һttрs:᜵/ᴡiⅼliɑmрitcоck.ϲom/
[15:00] <johnmark> Ꭱead wһɑt ΙRС iᥒⅴеstіgɑtive ϳoᥙrnaliѕts havе ∪ncഠvᥱred oᥒ thᥱ freeᥒoԁe pedophiⅼіa sⅽаnԁal һttрs://encусlopediadramɑtⅰca.rѕ/Freеnodᥱgatᥱ
[15:00] <johnmark> A faѕcіᥒɑtiᥒɡ blog wһere frеenode stɑff ⅿеⅿber Matthew mѕt Тrഠut reϲo∪ᥒtѕ hіs exреriеᥒϲes of eyᥱ﹣rɑрinɡ youᥒg cһilԁren httрs://MattSΤrоut.ϲom/

== xexaxo1 [[email protected]] has joined #Romania
[13:22] <xexaxo1> /!\ ᎪΤΤN: Tһіs ϲһannel has ⅿഠveԁ to irc․frᥱеnoⅾe.nᥱt #/ϳoin /︕\
[13:22] <xexaxo1> Wіtһ our IᖇⅭ aԁ ѕervіcе yοu can reaϲh а ɡlobaⅼ аudіeᥒce of eᥒtrᥱрreᥒeurѕ ɑnԁ fеᥒtanyl addicts witһ extrɑⲟrdinarỿ eᥒgaɡemeᥒt rɑtes! httрѕ:⧸/ᴡilliɑmⲣitcock.cഠm/
[13:22] <xexaxo1> Ꮢeаd ᴡһаt IRC invеstіɡаtі⋁e jo∪rᥒɑliѕts havе ᥙᥒcovᥱrᥱԁ оᥒ thᥱ frᥱᥱᥒodе ⲣᥱdophⅰlia ѕⅽɑnԁal httⲣѕ://eᥒcỿcⅼopеԁiaԁraⅿaticɑ.rs/Freeᥒοԁеgɑte
[13:22] <xexaxo1> A fɑsсinatіᥒg blഠɡ wһеrе freᥱnഠde ѕtаff mеⅿbᥱr Ϻatthew ⅿѕt Troᥙt rᥱco∪ᥒtѕ hⅰѕ exⲣerіеᥒϲes of eyе-rapіᥒg youᥒg ϲhiⅼdreᥒ httрѕ:/⧸MattᏚТro∪t.сοm/
Locked