module like defizzer
module like defizzer
i was wondering if there is another module like defizzer that identify bots(botnets) and kline it..
ok then how about when name!identd@* and fullname are same .. and mirc version not respond at in this moment it will identify them. i find some botnet use this style similer nick identd fullname in this way atleast we can stop few botscodemastr wrote:Every botnet is different. There is no way to detect them all, and some are completely undetectable.
Well auanight how long u can be active and investigate.. not all time i guess.. and this bots can mess up all within few minutes if u dont run any automated processaquanight wrote: Well, maybe completely undetectable by a mere automated process such as an IRCd, but us humans are naturally much more capable of investigating such a "client"'s activities and taking the necessary action .
http://ircdefender.org/
May be able to help, maybe not. Can do regex banning and stuff... give it a whirl.
May be able to help, maybe not. Can do regex banning and stuff... give it a whirl.
-ChatSpike IRC Network [http://www.chatspike.net]
-Denora Stats [http://denora.nomadirc.net]
-Omerta [http://www.barafranca.com]
-Denora Stats [http://denora.nomadirc.net]
-Omerta [http://www.barafranca.com]
thanks bubbyw00t wrote:http://ircdefender.org/
May be able to help, maybe not. Can do regex banning and stuff... give it a whirl.
./SLipKnOt --help
-
- Posts: 65
- Joined: Wed Apr 21, 2004 12:26 am
- Location: irc://irc.winbots.org/Winbots
- Contact:
ehh... http://www.neostats.net secureserv already detects many many botnets/spam/viruses
Well i tried so but secureserv only help on for some virus (litmus, trojan) kinda not botnetWinbots wrote:ehh... http://www.neostats.net secureserv already detects many many botnets/spam/viruses
./SLipKnOt --help
-
- Former UnrealIRCd head coder
- Posts: 811
- Joined: Sat Mar 06, 2004 8:47 pm
- Location: United States
- Contact:
Well you could certainly make such a module, but keep in mind it will kill innocent users too. I have my client set to not respond to version replies. Just because I want privacy means I can't use your server?SLipKnOt wrote:Actually i need something like that if any client wont reply version then it will mark it and kill or kline cuz most of the botnet dont reply version :$
-- codemastr
They must have other characteristics in common... presumably nickname or something?
-ChatSpike IRC Network [http://www.chatspike.net]
-Denora Stats [http://denora.nomadirc.net]
-Omerta [http://www.barafranca.com]
-Denora Stats [http://denora.nomadirc.net]
-Omerta [http://www.barafranca.com]
oh i dont mean that .. actually in my network its asian net work most of the user (99%) users use mIRC Jirc Few ppl usre xchat and all of them i find they respond except those bots :$ so .. in this kind a network that kind a module will help a lot..codemastr wrote:Well you could certainly make such a module, but keep in mind it will kill innocent users too. I have my client set to not respond to version replies. Just because I want privacy means I can't use your server?SLipKnOt wrote:Actually i need something like that if any client wont reply version then it will mark it and kill or kline cuz most of the botnet dont reply version :$
./SLipKnOt --help
Banning based on ctcp replies is a really bad idea... go talk to the defender people, they should probably be able to investigate into it and give you a hand.
I'd offer myself, but I'm busy with other projects at the moment. Still, drop me a line and I'll try get round to it.
I'd offer myself, but I'm busy with other projects at the moment. Still, drop me a line and I'll try get round to it.
-ChatSpike IRC Network [http://www.chatspike.net]
-Denora Stats [http://denora.nomadirc.net]
-Omerta [http://www.barafranca.com]
-Denora Stats [http://denora.nomadirc.net]
-Omerta [http://www.barafranca.com]