Spam Bots

If you have trouble on your server with spam, drones/zombies/bots or proxies

Moderator: Supporters

Post Reply
RadioClick
Posts: 15
Joined: Sat Dec 18, 2010 2:03 pm

Spam Bots

Post by RadioClick » Mon Oct 29, 2018 2:29 pm

Hello, i have some problem with the spam bots and i don't know how to stop him.
I use blacklist like dnsblacklist.co.uk or dronebl.org.
I also use the spamfilter for the website and the irc adress irc.freenode.net but now use other language and i don't know wich one is:
[PRIVMSG #ChatRomanesc: 'A fascinatіng bⅼοg ᴡһerе frᥱеnoԁᥱ staff ⅿᥱⅿber Matthew mѕt Trout recoᥙᥒts һіѕ eⲭperiᥱncеѕ of еyе-raping уoᥙng cһⅰldrᥱᥒ https://MattSTrоut.соⅿ/'] [Spam/Advertising]

[Spamfilter] zayita!zayita@61.223.157.42 matches filter 'https': [PRIVMSG #System: 'А fɑѕcinatiᥒg blog wһеre frееᥒodе ѕtаff ⅿеmbеr Matthеw mѕt Trഠᥙt recⲟ∪nts һiѕ exреrⅰences of eуе-raping ỿoung ϲhiⅼԁrᥱᥒ https://MattSТroᥙt.cⲟⅿ/'] [Spam/Advertising]

[Spamfilter] k_j!k_j@117.7.246.99 matches filter 'https': [PRIVMSG #wWe: 'Read wһat IRᏟ ⅰnveѕtіɡative ϳοurnaⅼіsts һаvе uᥒcoᴠеred ഠn the frеeᥒoԁe ⲣеԁоphiⅼia ѕcɑᥒdal https:⧸᜵ᥱnсyclopediаdraⅿatica.rs∕ᖴreᥱᥒoԁegate'] [Spam/Advertising]

(15:24) <zayita> /!\ AΤΤN: Τhіs cһanᥒeⅼ haѕ mഠ∨eԁ to irϲ.freeᥒoԁe.nеt #/jοiᥒ ᜵!\
(15:24) <zayita> І tһouɡht you guỿs migһt be intereѕted ⅰn tһis blog by freеnοdе ѕtaff meⅿber Βrуɑn klഠᥱri Οstеrgɑarԁ httⲣѕ://bryɑᥒοѕtеrgaɑrⅾ․coⅿ/
(15:24) <zayita> Read ᴡһat ΙRC іnvеstⅰɡatiᴠе јoᥙrᥒaⅼіsts hɑvе uᥒcoᴠereԁ oᥒ the freеᥒoԁe peԁophⅰⅼⅰa scɑnⅾaⅼ һttрѕ˸/∕еnⅽyϲⅼopeԁiadraⅿatⅰϲa.rs/Frᥱeᥒodeɡate

Somebody can help me?
No signal

CrazyCat
Posts: 82
Joined: Thu Apr 28, 2005 1:05 pm
Location: France
Contact:

Re: Spam Bots

Post by CrazyCat » Mon Oct 29, 2018 3:48 pm

The only solution I found was to install m_listrestrict and to put a delay of 180s. The bots fed up before they can spam.
I'm currently Image

RadioClick
Posts: 15
Joined: Sat Dec 18, 2010 2:03 pm

Re: Spam Bots

Post by RadioClick » Mon Oct 29, 2018 4:12 pm

But this module i must install or we have installed on unrealircd 4?
No signal

CrazyCat
Posts: 82
Joined: Thu Apr 28, 2005 1:05 pm
Location: France
Contact:

Re: Spam Bots

Post by CrazyCat » Tue Oct 30, 2018 7:15 am

You have to install it:
Copy the source of m_listrestrict.c (https://gitgud.malvager.net/Wazakindjes ... restrict.c) in the src/modules/third/ directory of your unreal sources, then make and make install.
After that, add in your unrealircd.conf file:

Code: Select all

loadmodule "third/m_listrestrict";
And add the settings at the end of this file:

Code: Select all

listrestrict {
    connectdelay 180;
    needauth 0;
    exceptions {
        all "kiwibot@109.169.31.12";
        all "atte@eagle.netsplit.de";
    };
};
(the exceptions are mine, not mandatory)

Rehash and it will work
I'm currently Image

CrazyCat
Posts: 82
Joined: Thu Apr 28, 2005 1:05 pm
Location: France
Contact:

Re: Spam Bots

Post by CrazyCat » Tue Oct 30, 2018 1:25 pm

New way: they just connect and quit with ##freenodegate as quit message.
Solution:

Code: Select all

/spamfilter add -simple q gzline 1d No_spamming_here *freenodegate*
I'm currently Image

RadioClick
Posts: 15
Joined: Sat Dec 18, 2010 2:03 pm

Re: Spam Bots

Post by RadioClick » Tue Oct 30, 2018 2:32 pm

today i'm connect to my network with qwebirc and i can see what diacritical use:
== johnmark [johnmark@FA3061E.1B3E67A9.C871B668.IP] has joined #Romania
[15:00] <johnmark> /!\ ATTΝ: Tһіѕ cһaᥒnеⅼ has ⅿоved to irс.freᥱᥒοdе.nᥱt ﹟/ϳоⅰᥒ /!\
[15:00] <johnmark> Ꮤith ⲟᥙr IᎡC ad sеrvіcᥱ yoᥙ cɑn reɑϲһ a gⅼobal a∪ⅾiᥱᥒce of еᥒtreрrene∪rs аᥒd fᥱᥒtɑᥒyⅼ adⅾicts witһ extraorԁⅰᥒɑry enɡagеment ratеsǃ һttрs:᜵/ᴡiⅼliɑmрitcоck.ϲom/
[15:00] <johnmark> Ꭱead wһɑt ΙRС iᥒⅴеstіgɑtive ϳoᥙrnaliѕts havе ∪ncഠvᥱred oᥒ thᥱ freeᥒoԁe pedophiⅼіa sⅽаnԁal һttрs://encусlopediadramɑtⅰca.rѕ/Freеnodᥱgatᥱ
[15:00] <johnmark> A faѕcіᥒɑtiᥒɡ blog wһere frеenode stɑff ⅿеⅿber Matthew mѕt Тrഠut reϲo∪ᥒtѕ hіs exреriеᥒϲes of eyᥱ﹣rɑрinɡ youᥒg cһilԁren httрs://MattSΤrоut.ϲom/

== xexaxo1 [xexaxo1@6AF020E.6CD1C29A.3237A7EA.IP] has joined #Romania
[13:22] <xexaxo1> /!\ ᎪΤΤN: Tһіs ϲһannel has ⅿഠveԁ to irc․frᥱеnoⅾe.nᥱt #/ϳoin /︕\
[13:22] <xexaxo1> Wіtһ our IᖇⅭ aԁ ѕervіcе yοu can reaϲh а ɡlobaⅼ аudіeᥒce of eᥒtrᥱрreᥒeurѕ ɑnԁ fеᥒtanyl addicts witһ extrɑⲟrdinarỿ eᥒgaɡemeᥒt rɑtes! httрѕ:⧸/ᴡilliɑmⲣitcock.cഠm/
[13:22] <xexaxo1> Ꮢeаd ᴡһаt IRC invеstіɡаtі⋁e jo∪rᥒɑliѕts havе ᥙᥒcovᥱrᥱԁ оᥒ thᥱ frᥱᥱᥒodе ⲣᥱdophⅰlia ѕⅽɑnԁal httⲣѕ://eᥒcỿcⅼopеԁiaԁraⅿaticɑ.rs/Freeᥒοԁеgɑte
[13:22] <xexaxo1> A fɑsсinatіᥒg blഠɡ wһеrе freᥱnഠde ѕtаff mеⅿbᥱr Ϻatthew ⅿѕt Troᥙt rᥱco∪ᥒtѕ hⅰѕ exⲣerіеᥒϲes of eyе-rapіᥒg youᥒg ϲhiⅼdreᥒ httрѕ:/⧸MattᏚТro∪t.сοm/
No signal

RadioClick
Posts: 15
Joined: Sat Dec 18, 2010 2:03 pm

Re: Spam Bots

Post by RadioClick » Tue Oct 30, 2018 10:41 pm

Hello, i don't know how can i thank you, after installing the module who tell me, i see when the spsammer stil enter o my network but can't spam anymore. Thank you, so much.
I use also use blaklist code like dronebl, efnetrbl ed altro in config.
No signal

CrazyCat
Posts: 82
Joined: Thu Apr 28, 2005 1:05 pm
Location: France
Contact:

Re: Spam Bots

Post by CrazyCat » Thu Nov 08, 2018 8:26 am

I use the new version of Gottem's listrestrict module but unfortunately, some bots succeed to join channels and spam.

So, I had an eye on their activity and I saw they first register their nick and then they bypass the restriction.
Simple response from me (using anope): I add a delay before they can register (nickregdelay = 30s), because I had (and want to keep) authisenough 1
I'm currently Image

Post Reply