Anyone seen these???

These are old archives. They are kept for historic purposes only.
Post Reply
droolin
Posts: 42
Joined: Sat Dec 04, 2004 7:27 pm
Location: USA - Ohio
Contact:

Anyone seen these???

Post by droolin »

In the last couple days, we have been getting hit by a series of bots that seem to be a spin off the girl/boy bot from awhile back. where it says, hi im a girl are you a boy. And it asks you to join them for chat off a url.
Follows is a spattering of the nicks that they seem to be:

Code: Select all

BrIDgeTc was [email protected] * denax
HElEnaY is [email protected] * yegey
alLISoNa is [email protected] * nacede
AGnESY is [email protected] * qacoh
CAthAriNeQ is [email protected] * nonef
SUzYD is [email protected] * fimura
CaTaRiNAD is [email protected] * tehul
CAthAriNeQ is [email protected] * nonef
EMilIeg ([email protected])
Follows is the spamfilters I set for when they do say something, which do work.

Code: Select all

F p gline 0 162149 10800 Freaken_girl_boy_spam_bot [email protected] i'm a girl\. are you a boy\?
F p gline 0 170364 10800 Freaken_sex_spam_bot_begone. [email protected] http:\/\/sexpartner
Does anyone know of a way to stop these suckers on the way in the door.?
Ive received no reply on version, ping, time, or anything else on them.
Any help is appriceated.

droolin
Hornyness is a perpetual thang. The hornier you are, the hornier your going to be.
Syzop
UnrealIRCd head coder
Posts: 2112
Joined: Sat Mar 06, 2004 8:57 pm
Location: .nl
Contact:

Post by Syzop »

the nick looks like a real name coming from a namelist + a random letter attached to it, but.. I suppose you were that far already ;).
droolin
Posts: 42
Joined: Sat Dec 04, 2004 7:27 pm
Location: USA - Ohio
Contact:

lol, yea I was

Post by droolin »

Im trying to see if I can find a name list any place. I don't see anything like this mentioned in the irc security list. But, I'm still looken.
I have seen that the number of upper and lower case letters vary too. Anything from 4 upper in the complete name to more.
Just was hopeing someone had a possible solution.


droolin
Hornyness is a perpetual thang. The hornier you are, the hornier your going to be.
aquanight
Official supporter
Posts: 862
Joined: Tue Mar 09, 2004 10:47 pm
Location: Boise, ID

Post by aquanight »

I think w00t's seen those on dalnet or something a few times...

Probably easiest way to find the namelist is the actually have a copy of the bot... ;)
w00t
Posts: 1136
Joined: Thu Mar 25, 2004 3:31 am
Location: Nowra, Australia

Post by w00t »

Yup, I've seen them around - and until recently I had a copy of the bot :/ if I'd known, I would've saved a copy before I formatted that drive :p
-ChatSpike IRC Network [http://www.chatspike.net]
-Denora Stats [http://denora.nomadirc.net]
-Omerta [http://www.barafranca.com]
droolin
Posts: 42
Joined: Sat Dec 04, 2004 7:27 pm
Location: USA - Ohio
Contact:

do you rember the bot name?

Post by droolin »

Do you happen to rember the official bot name? Ill hunt and peck my way through google to see if I can find a copy of it. Actualy, do you rember the description everyone called it by???
I was calling it girl/boy. But, I doubt thats what everyone else called it.

Thanks for the reply. Very much appriceated.

droolin
Hornyness is a perpetual thang. The hornier you are, the hornier your going to be.
w00t
Posts: 1136
Joined: Thu Mar 25, 2004 3:31 am
Location: Nowra, Australia

Post by w00t »

no, unfortunatly.. I got it to take a look at it myself when I saw it on dalnet a few months back (~4-5?) but didn't get time to follow it up past getting the .exe..
-ChatSpike IRC Network [http://www.chatspike.net]
-Denora Stats [http://denora.nomadirc.net]
-Omerta [http://www.barafranca.com]
White_Magic
Posts: 267
Joined: Tue Jan 18, 2005 3:24 pm
Location: Scotland - United Kingdom

Post by White_Magic »

Code: Select all

BrIDgeTc was [email protected] * denax 

HElEnaY is [email protected] * yegey 

alLISoNa is [email protected] * nacede 

AGnESY is [email protected] * qacoh 

CAthAriNeQ is [email protected] * nonef 

SUzYD is [email protected] * fimura 

CaTaRiNAD is [email protected] * tehul 

CAthAriNeQ is [email protected] * nonef 

EMilIeg ([email protected]) 
we`ll i gues its a risk but,
every ident and realname, every second letter (character) is a vowel
but then again nearly every word matchs this regex :P
just something i spottted thou
i spend 4 hrs a day gaming and 14hrs on irc, for 5days a week, im not an addict :D
aquanight
Official supporter
Posts: 862
Joined: Tue Mar 09, 2004 10:47 pm
Location: Boise, ID

Post by aquanight »

At least it can be filtered though ;)

/spamfilter add u kill - Suspected_drone .+!~([^aeiou][aeiou])*[^aeiou]?@.+:([^aeiou][aeiou])*[^aeiou]?$
droolin
Posts: 42
Joined: Sat Dec 04, 2004 7:27 pm
Location: USA - Ohio
Contact:

ya know, ive looked at that

Post by droolin »

I did not see that, I swear. All I seen was random letters.
I put the spam filter you sugested in, and so far. Have seen only one innocent. I'm sure it will be more. I expanded on the kill message, to assist any innocent user that gets taken out. I'll watch.
Whats intresting is. We have random letter bots also joining, that i loaded the antirandom module for. The ones getting through, are also being caught by this spamfilter.
Have to thank you for the help. Even if I don't keep this spamfilter, it's something I didn't know about those bots that I now do. Very much appriceated.

droolin
Hornyness is a perpetual thang. The hornier you are, the hornier your going to be.
Post Reply