End of year 2025 spam waves again
Posted: Fri Dec 26, 2025 9:25 am
Initial spam wave on Dec 24/25
Central Block List (CBL) has been working out well to protect dozens of UnrealIRCd networks. It auto-submits to DroneBL (almost 2000 IPs the first 24 hours), so the rest of the IRC community benefited. Lots of IRC networks did not see much spam Dec 24/25 thanks to these IPs being in DroneBL already due to CBL DroneBL submissions. Spammers also targeted some networks directly, separate from the IRC-wide spam waves. Networks like Libera Chat, which are doing everything they can and (presumably) also submitting to DroneBL. Everyone in the IRC community doing their part.
Second wave on night of Dec 26
On the night (UTC) of December 25 to December 26 two things happened. Spammers stopped re-using IP addresses and Central Block List didn't pick up the spam that night. The CBL detection was fixed on the morning of Dec 26, stopping 100% of the spam again. However, protecting the rest of the IRC community by sharing the IPs to DroneBL is no longer effective, as IPs are only used once, and on next network they use a new IP.
How to counter this spam?
If you are an UnrealIRCd network then consider subscribing to Central Block List. Submissions require manual vetting by us to see if you are a legit network but once you are allowed in on CBL it is very effective.
Oh yeah, and if you do use CBL you may see it is very effective in the status window or logs while still showing a warning with "Central blocklist is too slow to respond". That message is incorrect and harmless.
(This post may be expanded/edited later)
Central Block List (CBL) has been working out well to protect dozens of UnrealIRCd networks. It auto-submits to DroneBL (almost 2000 IPs the first 24 hours), so the rest of the IRC community benefited. Lots of IRC networks did not see much spam Dec 24/25 thanks to these IPs being in DroneBL already due to CBL DroneBL submissions. Spammers also targeted some networks directly, separate from the IRC-wide spam waves. Networks like Libera Chat, which are doing everything they can and (presumably) also submitting to DroneBL. Everyone in the IRC community doing their part.
Second wave on night of Dec 26
On the night (UTC) of December 25 to December 26 two things happened. Spammers stopped re-using IP addresses and Central Block List didn't pick up the spam that night. The CBL detection was fixed on the morning of Dec 26, stopping 100% of the spam again. However, protecting the rest of the IRC community by sharing the IPs to DroneBL is no longer effective, as IPs are only used once, and on next network they use a new IP.
How to counter this spam?
If you are an UnrealIRCd network then consider subscribing to Central Block List. Submissions require manual vetting by us to see if you are a legit network but once you are allowed in on CBL it is very effective.
Oh yeah, and if you do use CBL you may see it is very effective in the status window or logs while still showing a warning with "Central blocklist is too slow to respond". That message is incorrect and harmless.
(This post may be expanded/edited later)