getting a mass of botnets of late and i have finally found one single common factor which i need help with banning
looking at snotice i can see they all have ip number direct after the @ on the user ident@
for example..
*** Notice -- Client connecting on port 6667: Ryan ([email protected]) [clients] at 19:02:37 on 25/06/2011 on server
*** Notice -- Client connecting on port 6667: Norroar_ ([email protected] [clients] at 19:04:39 on 25/06/2011 on server
*** Notice -- Client connecting on port 6667: Coolness ([email protected]) [clients] at 19:04:50 on 25/06/2011 on server
*** Notice -- Client connecting on port 6667: omi ([email protected]) [clients] at 08:34:50 on 25/06/2011 on server
i have been through a full 48 hour log and all botnets are in this pattern [email protected]
we're running unrealircd3.2.8.1 with anope1.8.5
regex help please on numerics
-
- Head of Support
- Posts: 2085
- Joined: Tue Jun 15, 2004 8:50 pm
- Location: Chino Hills, CA, US
- Contact:
Re: regex help please on numerics
Having an IP address in the connection notice simply means their IP addresses could not be resolved to a host. This is not a good way to tell which users are bots and which are not.
To better tell which users are bots and which are not, you should look at messages they may be sending to channels (both messages to the channels, and part messages), look at quit messages, and also look for any channels they are crowding in.
If they are all in 1 channel, simply stay in that channel and gline anyone who joins that is not human. There might also be commands you can send to the bots though the topic or messages that can make them remove themselves.
Also BE SURE you are running a BOPM or other bad people monitoring program as these would cut down on how many bots join. You can get instructions for setting up a BOPM here: http://unreal.x-tab.org/faq#InstallBOPM
To better tell which users are bots and which are not, you should look at messages they may be sending to channels (both messages to the channels, and part messages), look at quit messages, and also look for any channels they are crowding in.
If they are all in 1 channel, simply stay in that channel and gline anyone who joins that is not human. There might also be commands you can send to the bots though the topic or messages that can make them remove themselves.
Also BE SURE you are running a BOPM or other bad people monitoring program as these would cut down on how many bots join. You can get instructions for setting up a BOPM here: http://unreal.x-tab.org/faq#InstallBOPM
Re: regex help please on numerics
figured might be the case...
we got bopm irc defender and blsb running. but we got kiddies proxying like hell and thats the exact format they are all coming in with [email protected]![Sad :(](./images/smilies/icon_sad.gif)
bopm etc are going mental but still getting some past all 3
we got bopm irc defender and blsb running. but we got kiddies proxying like hell and thats the exact format they are all coming in with [email protected]
![Sad :(](./images/smilies/icon_sad.gif)
bopm etc are going mental but still getting some past all 3
-
- Head of Support
- Posts: 2085
- Joined: Tue Jun 15, 2004 8:50 pm
- Location: Chino Hills, CA, US
- Contact:
Re: regex help please on numerics
A BOPM is not a perfect solution, and there will always be some that get through. The only perfect solution would be to not run an IRCd and use another networks services to fill your needs (let them worry about it).
Again, you should look for a control pattern or other patterns in messages and realnames. All botnets have some kind of pattern or control channel, even the ones used specifically for flooding and are 'random'.
Again, you should look for a control pattern or other patterns in messages and realnames. All botnets have some kind of pattern or control channel, even the ones used specifically for flooding and are 'random'.
Re: regex help please on numerics
dug up everything i had from snotice logs and there was a pattern
nick [email protected]
getting partial matches on nick and idents.. for example
nick [email protected]
getting partial matches on nick and idents.. for example
then the next set that came in a few secs later was11<03:00pm> * Joins: coyotebd (~[email protected])
11<03:00pm> * Joins: coyoterz (~[email protected])
11<03:00pm> * Joins: coyotent (~[email protected])
11<03:00pm> * Joins: coyoteuc (~[email protected])
11<03:00pm> * Joins: coyoteea (~[email protected])
11<03:00pm> * Joins: coyotefr (~[email protected])
11<03:00pm> * Joins: coyotehx (~[email protected])
11<03:00pm> * Joins: coyotelw (~[email protected])
11<03:00pm> * Joins: coyoteao (~[email protected])
11<03:00pm> * Joins: coyoteff (~[email protected])
11<03:00pm> * Joins: coyotezq (~[email protected])
11<04:59pm> * Joins: chatirc2 (~[email protected])
11<04:59pm> * Joins: chatirc6382 (~[email protected])
11<05:00pm> * Joins: chatirc7396 (~[email protected])
11<05:00pm> * Joins: chatirc137 (~[email protected])
11<05:00pm> * Joins: chatirc1745 (~[email protected])
11<05:00pm> * Joins: chatirc5030 (~[email protected])
11<05:00pm> * Joins: chatirc1344 (~[email protected])
11<05:00pm> * Joins: chatirc3327 (~[email protected])
11<05:00pm> * Joins: chatirc7179 (~[email protected])
11<05:00pm> * Joins: chatirc2504 (~[email protected])
11<05:00pm> * Joins: chatirc6064 (~[email protected])
11<05:00pm> * Joins: chatirc3286 (~[email protected])
11<05:00pm> * Joins: chatirc9867 (~[email protected])
11<05:00pm> * Joins: chatirc1833 (~[email protected])
11<05:00pm> * Joins: chatirc2410 (~[email protected])
11<05:00pm> * Joins: chatirc8981 (~[email protected])
11<05:00pm> * Joins: chatirc1981 (~[email protected])
-
- Head of Support
- Posts: 2085
- Joined: Tue Jun 15, 2004 8:50 pm
- Location: Chino Hills, CA, US
- Contact:
Re: regex help please on numerics
These are probably generated by clonesx or something similar. Check the spamfilters forums for many spamfilters to match.
You can also take care of patterns like this very easily:
/gline ~coyote@* 180d Due to abusive connections using this ident, it has been blocked. Please change your ident and reconnect.
You can also take care of patterns like this very easily:
/gline ~coyote@* 180d Due to abusive connections using this ident, it has been blocked. Please change your ident and reconnect.
Re: regex help please on numerics
and ~chatirc@*
The good thing about ClonesX is that they have a very predictable pattern and are easy to gline even if they use proxies.
The good thing about ClonesX is that they have a very predictable pattern and are easy to gline even if they use proxies.
Configuration - https://www.unrealircd.org/docs/Configuration
FAQ - https://www.unrealircd.org/docs/FAQ
FAQ - https://www.unrealircd.org/docs/FAQ
new...
i just can say that this is totally new for me, so thanks...
regards,
sally.
regards,
sally.