This woke me up a bit and i started looking a bit further to what is going on, during the next few mins i noticed a few more of these logging on. I found 2 locked rooms with about 100 users in each that where new. We have a small network of about 20 rooms or so and an average of about 250 users, so I knew something was up.[2K]-118127 (~[email protected] => ravetrax-7BA9C5EE.lu.dl.cox.net) (is an IRC Operator) connected to the network (irc.ravetrax.net).
Well I jumped into one of the rooms and saw that these where bots running scanns such as this:
This repeats from each bot about every 30 mins if left in a room, otherwise if the bot is kicked off the network without a gline or simluar, it will return in 30 mins to start scanning again.4:22am | [NT]-634110 -> on February 28 2005 at 09:16:09 AM Scanning NT: 151.126.0.0-151.126.255.255
4:22am | [NT]-634110 -> on February 28 2005 at 09:16:09 AM Scanning NT: 32.39.0.0-32.39.255.255
4:22am | [NT]-634110 -> on February 28 2005 at 09:16:09 AM Scanning NT: 40.110.0.0-40.110.255.255
4:22am | [NT]-634110 -> on February 28 2005 at 09:16:09 AM Scanning NT: 227.181.0.0-227.181.255.255
4:22am | [NT]-634110 -> on February 28 2005 at 09:16:10 AM Scanning NT: 225.218.0.0-225.218.255.255
4:22am | [NT]-634110 -> on February 28 2005 at 09:16:10 AM Scanning NetBios: 58.73.0.0 to 58.73.255.255
4:25am | [NT]-634110 -> Copying the files and running them on IP: \\
Well I instally glined the entire bunch and wrote a script to keep them off. But over the last 4 days we have killed over 1500 of these bots attempting to join and start scanning, all have very simular patterns in there nicks and all are attempting to join the same room.
The channel is called "#MANiAC" and all the bots have the following patterns to there names: [XP], [2K], [NT], T3
Has anyone every seen these or have any idea wtf they are?