Initial spam wave on Dec 24/25
Central Block List (CBL) has been working out well to protect dozens of UnrealIRCd networks. It auto-submits to DroneBL (almost 2000 IPs the first 24 hours), so the rest of the IRC community benefited. Lots of IRC networks did not see much spam Dec 24/25 thanks to these IPs being in DroneBL already due to CBL DroneBL submissions. Spammers also targeted some networks directly, separate from the IRC-wide spam waves. Networks like Libera Chat, which are doing everything they can and (presumably) also submitting to DroneBL. Everyone in the IRC community doing their part.
Second wave on night of Dec 26
On the night (UTC) of December 25 to December 26 two things happened. Spammers stopped re-using IP addresses and Central Block List didn't pick up the spam that night. The CBL detection was fixed on the morning of Dec 26, stopping 100% of the spam again. However, protecting the rest of the IRC community by sharing the IPs to DroneBL is no longer effective, as IPs are only used once, and on next network they use a new IP.
How to counter this spam?
If you are an UnrealIRCd network then consider subscribing to Central Block List. Submissions require manual vetting by us to see if you are a legit network but once you are allowed in on CBL it is very effective.
Oh yeah, and if you do use CBL you may see it is very effective in the status window or logs while still showing a warning with "Central blocklist is too slow to respond". That message is incorrect and harmless.
(This post may be expanded/edited later)
End of year 2025 spam waves again
Re: End of year 2025 spam waves again
Most of the spam stopped a few hours after the forum post. So, let's wrap this up: we have welcomed another 20 networks to CBL and these networks should now be (more) protected against future spam saves. As always, better to be prepared than to be overwhelmed and wondering what to do.