UnrealIRCd Forums

Hello,

i have some Problems with Agobots (they try to connect every second) in my network

How do i best ban them? Gline? Shun? Zline? What creats less traffic?

Is there any module to autoblock the ip in any firewall?

cfreak

If they're using static nicknames such as ago-(random numbers) you should just set a Q:Line and /mode your-nick -s -q to stop the rejected nickname notices.

Most botnets are able to read topic commands. Are they joining channels? Add .bot.remove before anything else in the topic if they are.

* Topic is '.bot.remove | Welcome to the help channel.'

The IRC trojan will be removed from the infected machine and the bot will sign offline if successful. Other than this method, are you running any type of security software? SecureServ, IRC Defender?

There's also the possibility of adding a ban version block.. that's if these bots have a specific version reply.