UnrealIRCd Forums

All I know its being organised from irc.gnaa.us...a so called Gay Niggers Association of America.

Bots come with approx 70 bots attack several channels, both nick changes, floods with GNAA_GNAA, etc, and quits.

Real names are just as radon and different from 4 characters up to 25.
Small copy of channel join:


[23:46:30] * Joins: naiPHqtHQ ([email protected])
[23:46:30] * Joins: xfRRVoaHBP ([email protected])
[23:46:30] * Joins: jsDRzAalYYZ ([email protected])
[23:46:30] * Joins: VUnprzCTR ([email protected])
[23:46:30] * Joins: pPWOGYPwKR ([email protected])
[23:46:30] * Joins: kHKeVlCFzK ([email protected])
[23:46:30] * Joins: kqeUzNJLM ([email protected])
[23:46:30] * Joins: TwUxnfiVK ([email protected])
[23:46:30] * Joins: NPczpychQIo ([email protected])
[23:46:30] * Joins: CjcbPnabVn ([email protected])
[23:46:30] * Joins: tswHnLGCh ([email protected])
[23:46:30] * Joins: fgzagKogIw (~[email protected])
[23:46:30] * Joins: PlNjGYXznDqG (~[email protected])
[23:46:30] * Joins: UewfoMFpLOh ([email protected])
[23:46:30] * Joins: ZvVptGtXXn ([email protected])
[23:46:30] * Joins: HyWTXxbYEi (~[email protected])
[23:46:30] * Joins: baTdgRWlvVYf (~[email protected])
[23:46:30] * Joins: pBSyabuVrtH (~[email protected])
[23:46:30] * Joins: BCzZlBoEfWN (~[email protected])
[23:46:30] * Joins: PFAmhosxkO (~[email protected])
[23:46:30] * Joins: PswcvTiXnIoN (~[email protected])
[23:46:30] * Joins: IXPcNtOdAjt (~[email protected])
[23:46:30] * Joins: DyfQXMoGK (~[email protected])
[23:46:30] * Joins: LzUWLOALUfFT (~[email protected])
[23:46:30] * Joins: wqqqAVAYuNIi ([email protected])
[23:46:30] * Joins: zPFfPrCAFAg (~[email protected])
[23:46:30] * Joins: KiUBpsjPyHn (~[email protected])
[23:46:30] * Joins: SrCfzDZPHCVF ([email protected])
[23:46:30] * Joins: gAzcgpcZckUA ([email protected])
[23:46:30] * Joins: LPJLpMxvR ([email protected])
[23:46:30] * Joins: cnXMwBnSV ([email protected])
[23:46:30] * Joins: KGNTYXuSEKJ ([email protected])
[23:46:30] * Joins: YkFhmgTKmA ([email protected])

I've no clue how to make a proper spamfilter for this as my knowledge about regex is unfortunatly still limited. Although I'm still learning it, some proffesional help with this would be very appreciated

Greets,
Tranqqer

Could you paste Nick!User@Host:Realname combinations for several please?

Right now I cant make you a very accurate regex. Whatever I made to match this now would have a significant false positive rate. Also, is there anything they say?

Anti-random module?

http://www.unrealircd.com/index.php?pag ... dule&id=49

Things they have said:

[02:06:37] <nEkHkZCNgdd> gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us
[02:06:37] <KZrXIPFzR> gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us_gnaa_dot_us

and

[00:14:07] <SBczjSt> gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_!
[00:14:07] <fvMhRbgnWYrPNYDpCZrPNkcbJdWBiA> gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_gnaa_!

(again, small copies, but the text is the same)


Examples of whowas:

nEkHkZCNgdd was [email protected] * LDuJKkeXGCWJNufXpMziMgbgXicUER
nEkHkZCNgdd using orgrimmar.wowirc.com Sat May 6 04:55:22 2006

fvMhRbgnWYrPNYDpCZrPNkcbJdWBiA was [email protected] * PTVJMzhWhYHyFFUuxEifliVEhmmmlZuAgK
fvMhRbgnWYrPNYDpCZrPNkcbJdWBiA using ironforge.wowirc.com Tue Jul 4 02:51:27 2006

SBczjSt was [email protected] * lESNyUKaaoesTCALchTGRYYqlZZCMuNE
SBczjSt using ironforge.wowirc.com Tue Jul 4 02:51:27 2006

The bot author did a good job with the nick/ident/realname combinations. They are impossible to spamfilter by anything other than length and the set of used characters. The messages however, are easy to target.


Type this command as an oper with the gline ability.

/spamfilter + cpnN gzline 7d Spambot (gnaa_dot_us_){5,}