im ircop on a server.. now da thing is we been havin some proxy clone floods 4 few weeks... herez a sample whois of da flooder

hpawbiyqweyr was hpawbiyq@123.123.adsl.bellsouth.net * hpawbiyqweyrb

what i noticed is the flood script uses the 12 characters for nick and the whole nick is included in the "real name" part

as an ircop i hav access to the snotices naturally... so i was wondering if ne1 can help me code a script that will kline the nicks on connect (based on the condition that the nick is 12 characters long and *isin* real name)

thx in advance

Are these proxies open? if so why not use a bopm in your ircd/services ? you can add extra dnsbls in the code

Fire

problem is lot of them seem to be legit ips and are not picked by services... we suspect they might be part of a botnet.. either way, even the proxies elude our services

Sounds like a RAW is the best method to check these, though perhaps snotice is... I don't deal with ircop stuff. But, whichever event you use, you can just do:

if ($len($1) == 12 && $1 isin $5) { kline command }

Note that $1 and $5 would be changed if those aren't the first and 5th "word" in the event. I'm using the one you displayed, where the first "word" is the nick and the fifth is the name.

PM me an example of the snotice you see if you dont mind. I may have experience that could be useful to you.

Fire

if you would like to know what thay are if there real ips it is ushally from trojan bots seen my network get flooded with over 20,000 of them at once my network went down fast

..,.?".

Here, you can borrow some of my punctuation marks.

-genius_at_work