new bot spammers help please

If you have trouble on your server with spam, drones/zombies/bots or proxies

Moderator: Supporters

Post Reply
Orobas
Posts: 18
Joined: Sun Apr 05, 2020 9:25 am

new bot spammers help please

Post by Orobas »

just had a new spammer type appear and my regex isnt too good sadly with this one... due to where it is on the user name...

we can do the username easy enough with (?-i)^[A-Z][a-z]{2,}[0-9]{3}!(~)?*@* ?? ... but i'm not sure how to put this on the realname field..

Looking for a kill on user (u) on a regex filter .. we're unreal 5.2 and we need a block on the realname field please

(https://Pam815.com/) is the current field.. but this does change.. the 3 digit variation is always there though before the .com

I know we start with a /spamfilter add -regex u kill - botspammer

but its the ending i cant work out
alhoceima
Posts: 32
Joined: Mon Jul 18, 2016 10:35 pm

Re: new bot spammers help please

Post by alhoceima »

you could try using the antirandom module
Syzop
UnrealIRCd head coder
Posts: 2112
Joined: Sat Mar 06, 2004 8:57 pm
Location: .nl
Contact:

Re: new bot spammers help please

Post by Syzop »

I would match on 3 digits followed by .com in the realname, that sounds sufficiently unique to catch this without many false positives.
That should be as easy as:

Code: Select all

:.*[0-9]{3}\.com
To explain:
  • As you know 'u' bans are placed on nick!user@host:realname, so we start the regex with : to make sure the nick!user@host part of it gets skipped/ignored (well there is the possibility of IPv6 with : in it but that's not an issue in this case)
  • The .* allows any string to follow, since there could be anything before the 123.com stuff.
  • Then the [0-9]{3} means it must match exactly 3 digits
  • And finally the \.com means it should contain .com directly after those digits.
You can make it more complex but in this case it's not really needed I think. You can also always tweak it later if needed.
Orobas
Posts: 18
Joined: Sun Apr 05, 2020 9:25 am

Re: new bot spammers help please

Post by Orobas »

Hiya Syzop ..

oh!!! i went all ott whilst i was waiting with ([A-Z][a-z]{2,}[0-9]{3})!.+:http.+\1\.com lmao!!!

many thanks for the followup .. you're a star
Last edited by Orobas on Tue Jun 29, 2021 5:54 pm, edited 2 times in total.
Orobas
Posts: 18
Joined: Sun Apr 05, 2020 9:25 am

Re: new bot spammers help please

Post by Orobas »

Hiya Syzop ..

oh!!! i went all ott with ([A-Z][a-z]{2,}[0-9]{3})!.+:http.+\1\.com lmao!!!!

many thanks for the followup .. you're a star
alhoceima
Posts: 32
Joined: Mon Jul 18, 2016 10:35 pm

Re: new bot spammers help please

Post by alhoceima »

this is a never ending game of them evading by changing patern and you having to find a regex for it
alhoceima
Posts: 32
Joined: Mon Jul 18, 2016 10:35 pm

Re: new bot spammers help please

Post by alhoceima »

instead i would target the actuall abuse instead of nicknames
Orobas
Posts: 18
Joined: Sun Apr 05, 2020 9:25 am

Re: new bot spammers help please

Post by Orobas »

oh we have... and its very effective ... i just wanted to go a bit more proactive
Post Reply