mIRC Home    About    Download    Register    News    Help

Print Thread
help needed #165014 21/11/06 10:49 AM
Joined: Nov 2006
Posts: 2
C
chipmonk Offline OP
Bowl of petunias
OP Offline
Bowl of petunias
C
Joined: Nov 2006
Posts: 2
im ircop on a server.. now da thing is we been havin some proxy clone floods 4 few weeks... herez a sample whois of da flooder

hpawbiyqweyr was hpawbiyq@123.123.adsl.bellsouth.net * hpawbiyqweyrb

what i noticed is the flood script uses the 12 characters for nick and the whole nick is included in the "real name" part

as an ircop i hav access to the snotices naturally... so i was wondering if ne1 can help me code a script that will kline the nicks on connect (based on the condition that the nick is 12 characters long and *isin* real name)

thx in advance

Re: help needed #165015 21/11/06 11:36 AM
Joined: Jan 2006
Posts: 108
F
Firestarter Offline
Vogon poet
Offline
Vogon poet
F
Joined: Jan 2006
Posts: 108
Are these proxies open? if so why not use a bopm in your ircd/services ? you can add extra dnsbls in the code

Fire

Re: help needed #165016 21/11/06 01:20 PM
Joined: Nov 2006
Posts: 2
C
chipmonk Offline OP
Bowl of petunias
OP Offline
Bowl of petunias
C
Joined: Nov 2006
Posts: 2
Quote:
Are these proxies open? if so why not use a bopm in your ircd/services ? you can add extra dnsbls in the code

Fire


problem is lot of them seem to be legit ips and are not picked by services... we suspect they might be part of a botnet.. either way, even the proxies elude our services

Re: help needed #165017 21/11/06 02:12 PM
Joined: Oct 2004
Posts: 8,330
Riamus2 Offline
Hoopy frood
Offline
Hoopy frood
Joined: Oct 2004
Posts: 8,330
Sounds like a RAW is the best method to check these, though perhaps snotice is... I don't deal with ircop stuff. But, whichever event you use, you can just do:

if ($len($1) == 12 && $1 isin $5) { kline command }

Note that $1 and $5 would be changed if those aren't the first and 5th "word" in the event. I'm using the one you displayed, where the first "word" is the nick and the fifth is the name.


Invision Support
#Invision on irc.irchighway.net
Re: help needed #165018 21/11/06 04:19 PM
Joined: Jan 2006
Posts: 108
F
Firestarter Offline
Vogon poet
Offline
Vogon poet
F
Joined: Jan 2006
Posts: 108
PM me an example of the snotice you see if you dont mind. I may have experience that could be useful to you.

Fire

Re: help needed #165019 22/11/06 04:24 AM
Joined: Jan 2005
Posts: 15
P
paradoxial Offline
Pikka bird
Offline
Pikka bird
P
Joined: Jan 2005
Posts: 15
Quote:
im ircop on a server.. now da thing is we been havin some proxy clone floods 4 few weeks... herez a sample whois of da flooder

hpawbiyqweyr was hpawbiyq@123.123.adsl.bellsouth.net * hpawbiyqweyrb

what i noticed is the flood script uses the 12 characters for nick and the whole nick is included in the "real name" part

as an ircop i hav access to the snotices naturally... so i was wondering if ne1 can help me code a script that will kline the nicks on connect (based on the condition that the nick is 12 characters long and *isin* real name)

thx in advance





if you would like to know what thay are if there real ips it is ushally from trojan bots seen my network get flooded with over 20,000 of them at once my network went down fast

Re: help needed #165020 22/11/06 03:03 PM
Joined: Oct 2005
Posts: 1,741
G
genius_at_work Offline
Hoopy frood
Offline
Hoopy frood
G
Joined: Oct 2005
Posts: 1,741
..,.?".

Here, you can borrow some of my punctuation marks.

-genius_at_work