Spam Bots

If you have trouble on your server with spam, drones/zombies/bots or proxies

Moderator: Supporters

Post Reply
RadioClick
Posts: 15
Joined: Sat Dec 18, 2010 2:03 pm

Spam Bots

Post by RadioClick » Mon Oct 29, 2018 2:29 pm

Hello, i have some problem with the spam bots and i don't know how to stop him.
I use blacklist like dnsblacklist.co.uk or dronebl.org.
I also use the spamfilter for the website and the irc adress irc.freenode.net but now use other language and i don't know wich one is:
[PRIVMSG #ChatRomanesc: 'A fascinatіng bⅼοg ᴡһerе frᥱеnoԁᥱ staff ⅿᥱⅿber Matthew mѕt Trout recoᥙᥒts һіѕ eⲭperiᥱncеѕ of еyе-raping уoᥙng cһⅰldrᥱᥒ https://MattSTrоut.соⅿ/'] [Spam/Advertising]

[Spamfilter] zayita!zayita@61.223.157.42 matches filter 'https': [PRIVMSG #System: 'А fɑѕcinatiᥒg blog wһеre frееᥒodе ѕtаff ⅿеmbеr Matthеw mѕt Trഠᥙt recⲟ∪nts һiѕ exреrⅰences of eуе-raping ỿoung ϲhiⅼԁrᥱᥒ https://MattSТroᥙt.cⲟⅿ/'] [Spam/Advertising]

[Spamfilter] k_j!k_j@117.7.246.99 matches filter 'https': [PRIVMSG #wWe: 'Read wһat IRᏟ ⅰnveѕtіɡative ϳοurnaⅼіsts һаvе uᥒcoᴠеred ഠn the frеeᥒoԁe ⲣеԁоphiⅼia ѕcɑᥒdal https:⧸᜵ᥱnсyclopediаdraⅿatica.rs∕ᖴreᥱᥒoԁegate'] [Spam/Advertising]

(15:24) <zayita> /!\ AΤΤN: Τhіs cһanᥒeⅼ haѕ mഠ∨eԁ to irϲ.freeᥒoԁe.nеt #/jοiᥒ ᜵!\
(15:24) <zayita> І tһouɡht you guỿs migһt be intereѕted ⅰn tһis blog by freеnοdе ѕtaff meⅿber Βrуɑn klഠᥱri Οstеrgɑarԁ httⲣѕ://bryɑᥒοѕtеrgaɑrⅾ․coⅿ/
(15:24) <zayita> Read ᴡһat ΙRC іnvеstⅰɡatiᴠе јoᥙrᥒaⅼіsts hɑvе uᥒcoᴠereԁ oᥒ the freеᥒoԁe peԁophⅰⅼⅰa scɑnⅾaⅼ һttрѕ˸/∕еnⅽyϲⅼopeԁiadraⅿatⅰϲa.rs/Frᥱeᥒodeɡate

Somebody can help me?
No signal

CrazyCat
Posts: 84
Joined: Thu Apr 28, 2005 1:05 pm
Location: France
Contact:

Re: Spam Bots

Post by CrazyCat » Mon Oct 29, 2018 3:48 pm

The only solution I found was to install m_listrestrict and to put a delay of 180s. The bots fed up before they can spam.
I'm currently Image

RadioClick
Posts: 15
Joined: Sat Dec 18, 2010 2:03 pm

Re: Spam Bots

Post by RadioClick » Mon Oct 29, 2018 4:12 pm

But this module i must install or we have installed on unrealircd 4?
No signal

CrazyCat
Posts: 84
Joined: Thu Apr 28, 2005 1:05 pm
Location: France
Contact:

Re: Spam Bots

Post by CrazyCat » Tue Oct 30, 2018 7:15 am

You have to install it:
Copy the source of m_listrestrict.c (https://gitgud.malvager.net/Wazakindjes ... restrict.c) in the src/modules/third/ directory of your unreal sources, then make and make install.
After that, add in your unrealircd.conf file:

Code: Select all

loadmodule "third/m_listrestrict";
And add the settings at the end of this file:

Code: Select all

listrestrict {
    connectdelay 180;
    needauth 0;
    exceptions {
        all "kiwibot@109.169.31.12";
        all "atte@eagle.netsplit.de";
    };
};
(the exceptions are mine, not mandatory)

Rehash and it will work
I'm currently Image

CrazyCat
Posts: 84
Joined: Thu Apr 28, 2005 1:05 pm
Location: France
Contact:

Re: Spam Bots

Post by CrazyCat » Tue Oct 30, 2018 1:25 pm

New way: they just connect and quit with ##freenodegate as quit message.
Solution:

Code: Select all

/spamfilter add -simple q gzline 1d No_spamming_here *freenodegate*
I'm currently Image

RadioClick
Posts: 15
Joined: Sat Dec 18, 2010 2:03 pm

Re: Spam Bots

Post by RadioClick » Tue Oct 30, 2018 2:32 pm

today i'm connect to my network with qwebirc and i can see what diacritical use:
== johnmark [johnmark@FA3061E.1B3E67A9.C871B668.IP] has joined #Romania
[15:00] <johnmark> /!\ ATTΝ: Tһіѕ cһaᥒnеⅼ has ⅿоved to irс.freᥱᥒοdе.nᥱt ﹟/ϳоⅰᥒ /!\
[15:00] <johnmark> Ꮤith ⲟᥙr IᎡC ad sеrvіcᥱ yoᥙ cɑn reɑϲһ a gⅼobal a∪ⅾiᥱᥒce of еᥒtreрrene∪rs аᥒd fᥱᥒtɑᥒyⅼ adⅾicts witһ extraorԁⅰᥒɑry enɡagеment ratеsǃ һttрs:᜵/ᴡiⅼliɑmрitcоck.ϲom/
[15:00] <johnmark> Ꭱead wһɑt ΙRС iᥒⅴеstіgɑtive ϳoᥙrnaliѕts havе ∪ncഠvᥱred oᥒ thᥱ freeᥒoԁe pedophiⅼіa sⅽаnԁal һttрs://encусlopediadramɑtⅰca.rѕ/Freеnodᥱgatᥱ
[15:00] <johnmark> A faѕcіᥒɑtiᥒɡ blog wһere frеenode stɑff ⅿеⅿber Matthew mѕt Тrഠut reϲo∪ᥒtѕ hіs exреriеᥒϲes of eyᥱ﹣rɑрinɡ youᥒg cһilԁren httрs://MattSΤrоut.ϲom/

== xexaxo1 [xexaxo1@6AF020E.6CD1C29A.3237A7EA.IP] has joined #Romania
[13:22] <xexaxo1> /!\ ᎪΤΤN: Tһіs ϲһannel has ⅿഠveԁ to irc․frᥱеnoⅾe.nᥱt #/ϳoin /︕\
[13:22] <xexaxo1> Wіtһ our IᖇⅭ aԁ ѕervіcе yοu can reaϲh а ɡlobaⅼ аudіeᥒce of eᥒtrᥱрreᥒeurѕ ɑnԁ fеᥒtanyl addicts witһ extrɑⲟrdinarỿ eᥒgaɡemeᥒt rɑtes! httрѕ:⧸/ᴡilliɑmⲣitcock.cഠm/
[13:22] <xexaxo1> Ꮢeаd ᴡһаt IRC invеstіɡаtі⋁e jo∪rᥒɑliѕts havе ᥙᥒcovᥱrᥱԁ оᥒ thᥱ frᥱᥱᥒodе ⲣᥱdophⅰlia ѕⅽɑnԁal httⲣѕ://eᥒcỿcⅼopеԁiaԁraⅿaticɑ.rs/Freeᥒοԁеgɑte
[13:22] <xexaxo1> A fɑsсinatіᥒg blഠɡ wһеrе freᥱnഠde ѕtаff mеⅿbᥱr Ϻatthew ⅿѕt Troᥙt rᥱco∪ᥒtѕ hⅰѕ exⲣerіеᥒϲes of eyе-rapіᥒg youᥒg ϲhiⅼdreᥒ httрѕ:/⧸MattᏚТro∪t.сοm/
No signal

RadioClick
Posts: 15
Joined: Sat Dec 18, 2010 2:03 pm

Re: Spam Bots

Post by RadioClick » Tue Oct 30, 2018 10:41 pm

Hello, i don't know how can i thank you, after installing the module who tell me, i see when the spsammer stil enter o my network but can't spam anymore. Thank you, so much.
I use also use blaklist code like dronebl, efnetrbl ed altro in config.
No signal

CrazyCat
Posts: 84
Joined: Thu Apr 28, 2005 1:05 pm
Location: France
Contact:

Re: Spam Bots

Post by CrazyCat » Thu Nov 08, 2018 8:26 am

I use the new version of Gottem's listrestrict module but unfortunately, some bots succeed to join channels and spam.

So, I had an eye on their activity and I saw they first register their nick and then they bypass the restriction.
Simple response from me (using anope): I add a delay before they can register (nickregdelay = 30s), because I had (and want to keep) authisenough 1
I'm currently Image

Syzop
UnrealIRCd head coder
Posts: 1845
Joined: Sat Mar 06, 2004 8:57 pm
Location: .nl
Contact:

Re: Spam Bots

Post by Syzop » Wed Dec 26, 2018 10:39 am

I know this thread is mostly about LIST but this type of spam as pasted by RadioClick is detected by the antimixedutf8 module (included as an optional module in UnrealIRCd 4.2.1).
RadioClick wrote:
Tue Oct 30, 2018 2:32 pm
today i'm connect to my network with qwebirc and i can see what diacritical use:
== johnmark [johnmark@FA3061E.1B3E67A9.C871B668.IP] has joined #Romania
[15:00] <johnmark> /!\ ATTΝ: Tһіѕ cһaᥒnеⅼ has ⅿоved to irс.freᥱᥒοdе.nᥱt ﹟/ϳоⅰᥒ /!\
[15:00] <johnmark> Ꮤith ⲟᥙr IᎡC ad sеrvіcᥱ yoᥙ cɑn reɑϲһ a gⅼobal a∪ⅾiᥱᥒce of еᥒtreрrene∪rs аᥒd fᥱᥒtɑᥒyⅼ adⅾicts witһ extraorԁⅰᥒɑry enɡagеment ratеsǃ һttрs:᜵/ᴡiⅼliɑmрitcоck.ϲom/
[15:00] <johnmark> Ꭱead wһɑt ΙRС iᥒⅴеstіgɑtive ϳoᥙrnaliѕts havе ∪ncഠvᥱred oᥒ thᥱ freeᥒoԁe pedophiⅼіa sⅽаnԁal һttрs://encусlopediadramɑtⅰca.rѕ/Freеnodᥱgatᥱ
[15:00] <johnmark> A faѕcіᥒɑtiᥒɡ blog wһere frеenode stɑff ⅿеⅿber Matthew mѕt Тrഠut reϲo∪ᥒtѕ hіs exреriеᥒϲes of eyᥱ﹣rɑрinɡ youᥒg cһilԁren httрs://MattSΤrоut.ϲom/

== xexaxo1 [xexaxo1@6AF020E.6CD1C29A.3237A7EA.IP] has joined #Romania
[13:22] <xexaxo1> /!\ ᎪΤΤN: Tһіs ϲһannel has ⅿഠveԁ to irc․frᥱеnoⅾe.nᥱt #/ϳoin /︕\
[13:22] <xexaxo1> Wіtһ our IᖇⅭ aԁ ѕervіcе yοu can reaϲh а ɡlobaⅼ аudіeᥒce of eᥒtrᥱрreᥒeurѕ ɑnԁ fеᥒtanyl addicts witһ extrɑⲟrdinarỿ eᥒgaɡemeᥒt rɑtes! httрѕ:⧸/ᴡilliɑmⲣitcock.cഠm/
[13:22] <xexaxo1> Ꮢeаd ᴡһаt IRC invеstіɡаtі⋁e jo∪rᥒɑliѕts havе ᥙᥒcovᥱrᥱԁ оᥒ thᥱ frᥱᥱᥒodе ⲣᥱdophⅰlia ѕⅽɑnԁal httⲣѕ://eᥒcỿcⅼopеԁiaԁraⅿaticɑ.rs/Freeᥒοԁеgɑte
[13:22] <xexaxo1> A fɑsсinatіᥒg blഠɡ wһеrе freᥱnഠde ѕtаff mеⅿbᥱr Ϻatthew ⅿѕt Troᥙt rᥱco∪ᥒtѕ hⅰѕ exⲣerіеᥒϲes of eyе-rapіᥒg youᥒg ϲhiⅼdreᥒ httрѕ:/⧸MattᏚТro∪t.сοm/

Post Reply