Floods with 4400+ bots

You can post in here ideas and comments on how you think we could improve things on undernet.
Posts: 21

Floods with 4400+ bots

Post by LordPimp »

Well, it just so happens that some lamer by the nick Baadshah has some how managed to load over 4000 bots onto Undernet! Most of them are from *!*@*.rr.com so its probably wise to ignore that ISP completly and place it in your X ban list. I have mailed a fraction of the logs to abuse@undernet.org but they never get back anyways, so I thought id warn the general users!

User avatar
Posts: 40
Location: Larnaca, Cyprus

Post by Stefano »

Thanks for informing the users LordPimp. I also have to inform users, when they notice such actions happening, to contact any of the servers' opers/admins. (email addresses can be found by typing /ADMINS and/or /MOTD )

My Regards,
Stefano Sordini

Posts: 21

Post by LordPimp »

Well I mailed some logs to abuse@undernet.org how ever this kind of situation seriously needs live support! 4400+ bots are a lot of bots! The ISPs should be contacted! Each IP address has 3 - 4 clones. Anyways I found more regular flood ISPs so I thought Id post them here!


If you want to ban the asshole who is doing all this! Then *!*@Baadshah.users.undernet.org
Ban that. Hes a lame script kiddie! He floods and calls him self a hacker!
These flooders usually reside in #lahori or #sweetpakistan although now they have more secretive and random channels where they launch their attack. But while they flood their bots are sitting on some channel, so they can keep track! Currently the channels I know that they flood are #darkhats #karachi #delusion #sensation ... Dont know if others get hit.

Hope it helps

User avatar
Posts: 13
Location: Canada

Post by _`_ »

Most of the ISP's you mentioned are major service providers, with literally thousands of connections.

One point to consider is that if a user is connected via firewall then all the internal addresses appear same (clones) to the external world. As far as I see I havent seen any solution from Undernet for this problem (how can these users can have different X-ids ? because the cable provider does not give out isp email addresses to the LAN users .. so if they connect without masking their ip with X .. then they are mostly treated as clones on the network).

Secondly, the flooders mostly use spoofed ip addresses. i.e., utilizing the misconfigured wingate/proxy servers of certain providers. And if you notice, then all the time these flooders seem to have a total different range of ip addresses (which are mostly spoofed ones).

Another new type of flood i have been observing lately is via the different X-ids. The flooders seem to have dozens of extra X-ids and are now getting the clones logged to X first and then they join a channel (so +r has no effect) and after a certain amount is gathered in the channel then suddenly they start text/notice/message flooding at the channel. Workaround can be +m but if the channel already is +m then all of them have to be devoiced and banned.

Posts: 12

Post by Garp »

The source LordPimp mentioned is a mode +s or +p registered channel named #lahori.

I have nearly the same bans in our channel ... 26 only against this flooding idiots.

He told I should name him "father" then he would stop this flooding! can you believe that? It shows how mad they are.

The channel 'owner' works with different nicks and changes between them, such as MOLAjutt Lahori and Ussman.

Intention and motor of their flooding is religious stuff. They are from pakistan and their intention is to 'bring all people of pakistan to the right path'.

I mailed to cservice-abuse about it. Reaction: zero.
I asked in #cservice about it. THey told me that they deal with x .
I visited some oper chans. The "best" advice was to set the channel on +mi. Or - even better - on +mirk "this_channel_is_dead"

I have no solution.

Fact is that the religious fanatics think, this is a good network to earn merits in nirvana. I think we should do something against it.

Zero tolerance against flooders and spammers. I think we should act before they destroy "our" most beloved network.

We need coordinated actions against this people. We need an exchange about experiences in the past. We need a better protection for channels with 100+ users cause they are the main target.

Partnership for a idiot free undernet!

User avatar
Posts: 13
Location: Canada

Post by _`_ »

1. If four americans make a flood channel no one says "its americans" ! just like that #lahori even if it is what you say it is, does not represent pakistan or the voice of its people (although lahore is a major city of pakistan). I dont think you should use words like religious fanatics or blame a whole nation because of some people. Please refrain from biased comments.

2. +m is a good solution against text-based floods. +r saves unregistered ones from joining. and +i can be done if you are not able to set +r at the time of flood. Also additionaly take advantage of the limit setting functions of X and set auto limits to the channel. The solutions told to you do work ! so try them.

3. As I said above earlier, most of the ISP's mentioned in the first post are MAJOR service providers of europe and usa mostly. Thousands of people use these connections (infact I am even now connected from one ISP mentioned in that list). If a few connections are compromised, I dont agree that these ISP's should be banned from using Undernet. That would leave thousands of users shifting to other irc networks.

Posts: 435
Location: Netherlands

Post by OUTsider »

uhm, if you can set +i, then you are also able to set +r :)
Don't bother reading, I'm just the lame botlender, right ?

User avatar
Posts: 56
Location: UK, London

Post by K8oard »

There is one thing You can do (I`m talking to the one that posts this Topic), just enable the +i (invite channel mode) like OUTsider said and also +r channel mode. The +r mode (registered) stands only for users/bots which are not logged in (logged in with a valid username) so noone which is not logged in, will not join that specific channel, so my ideea is that those wasn`t bots, those things was drones, 100% so this way You there is the only thing You can do, to set the +r (mode #Channel +r) for a while and ban the main IP adress, I meant the second IP class. The point is that noone can login any drones on Undernet, so that`s why You`ll see more connections on our network, just cause the users loads as many clients as he can, just to flood Undernet... I believe. There is one thing You can do also, ban the IDentD that the bots/drones are connected with, cause if there is a shell account, they all will run with the same IDentD... :devil:
Muzik,...It`s my life...!!!

Posts: 12

Post by Garp »

It was not my intention to accuse pakistan to be a bad country, not was my intention to abuse somebodies believe.

Fact is that I got this reasons:
- your channel is against allah
- close it or you get flooded

The channel I am talking about has an average usercount of currently 114. We have ll days joining people with around 1000 different nicks.

What does channelmode +restiricted mean for our users? It means the channel is empty.

What does channelmode +key mean for our users? It means the channel is empty.

What does channelmode +invite mean?

All this methods archive what the flooders wants to archive - the channel should be closed, because this guys "think" it is against their believe.

Channelmodes +irk means - the flooders get what they want.

About maintaining a limit: on Aug 28 the channel was flooded by more then 200 bots. Userpeak since them was 218. Userpeak now is 420.

Check this: (I have anonymisized the chan for some reasons but the original log is availible on request. Just send me a private message.

Code: Select all

[23:01] #chan: mode change '+l 148' by anonymous!~anonymous@anonymous.users.undernet.org

[23:02] Sisliden_ (~foo@adsluser-467.adsl.ttnet.net.tr) joined #chan.
[23:02] Psix (No@ joined #chan.
[23:02] ojyijw (~imnnlj@clt25-76-076.carolina.rr.com) joined #chan.
[23:02] ojyijw (~imnnlj@clt25-76-076.carolina.rr.com) left #chan.
[23:02] prssrk (~frzqyj@clt25-76-076.carolina.rr.com) joined #chan.
[23:02] prssrk (~frzqyj@clt25-76-076.carolina.rr.com) left #chan.
[23:02] qpezvl (Debbie94@ joined #chan.
[23:02] qpezvl (Debbie94@ left #chan.
[23:02] eutdyk (Ron53@ joined #chan.
[23:02] eutdyk (Ron53@ left #chan.
[23:02] qshsrm (~wmyfbv@dhcp065-025-141-142.columbus.rr.com) joined #chan.
[23:02] qshsrm (~wmyfbv@dhcp065-025-141-142.columbus.rr.com) left #chan.
[23:02] gqjuja (~ympgkl@CPE-65-31-241-15.new.rr.com) joined #chan.
[23:02] gqjuja (~ympgkl@CPE-65-31-241-15.new.rr.com) left #chan.
[23:02] nezfch (~qcmrmw@dhcp16653084.neo.rr.com) joined #chan.
[23:02] nezfch (~qcmrmw@dhcp16653084.neo.rr.com) left #chan.
[23:02] mwomka (~seivhd@ joined #chan.
[23:02] mwomka (~seivhd@ left #chan.
[23:02] ujpjgt (Tony8@ joined #chan.
[23:02] ujpjgt (Tony8@ left #chan.
[23:02] envbpw (Tony8@ joined #chan.
[23:02] envbpw (Tony8@ left #chan.
[23:02] qtaxpl (zserms@ joined #chan.
[23:02] qtaxpl (zserms@ left #chan.
[23:02] qdbqyb (~znqcjp@pool-151-203-197-34.bos.east.verizon.net) joined #chan.
[23:02] qdbqyb (~znqcjp@pool-151-203-197-34.bos.east.verizon.net) left #chan.
[23:02] eilxvp (~stdqik@ joined #chan.
[23:02] eilxvp (~stdqik@ left #chan.
[23:02] hosecz (~ynrssr@6532107hfc247.tampabay.rr.com) joined #chan.
[23:02] hosecz (~ynrssr@6532107hfc247.tampabay.rr.com) left #chan.
[23:02] bstbvn (~akxmlr@cpe-024-165-153-245.midsouth.rr.com) joined #chan.
[23:02] bstbvn (~akxmlr@cpe-024-165-153-245.midsouth.rr.com) left #chan.
[23:02] hotykh (~ynfzsf@ joined #chan.
[23:02] hotykh (~ynfzsf@ left #chan.
[23:02] krkuqh (~chrmyq@ joined #chan.
[23:02] krkuqh (~chrmyq@ left #chan.
[23:02] spwpkq (Mike96@commons10k1.mo24.107.50.77.charter-stl.com) joined #chan.
[23:02] spwpkq (Mike96@commons10k1.mo24.107.50.77.charter-stl.com) left #chan.
[23:02] xjthvq (~bojuvk@dhcp024-209-097-012.woh.rr.com) joined #chan.
[23:02] xjthvq (~bojuvk@dhcp024-209-097-012.woh.rr.com) left #chan.
[23:02] jckvmu (L0fRg555@24-29-151-71.nyc.rr.com) joined #chan.
[23:02] jckvmu (L0fRg555@24-29-151-71.nyc.rr.com) left #chan.
[23:02] bwsmpa (~loptca@CPE-65-30-125-90.kc.rr.com) joined #chan.
[23:02] bwsmpa (~loptca@CPE-65-30-125-90.kc.rr.com) left #chan.
[23:02] oxwhzt (~hugjiy@CPE-65-28-14-5.kc.rr.com) joined #chan.
[23:02] oxwhzt (~hugjiy@CPE-65-28-14-5.kc.rr.com) left #chan.
[23:02] igpugp (~iydzqx@ptd-24-198-2-67.maine.rr.com) joined #chan.
[23:02] igpugp (~iydzqx@ptd-24-198-2-67.maine.rr.com) left #chan.
[23:02] vfwank (~axbeyp@dhcp024-209-028-015.cinci.rr.com) joined #chan.
[23:02] vfwank (~axbeyp@dhcp024-209-028-015.cinci.rr.com) left #chan.
[23:02] rzutkt (~bkbmnv@ptd-24-198-2-67.maine.rr.com) joined #chan.
[23:02] rzutkt (~bkbmnv@ptd-24-198-2-67.maine.rr.com) left #chan.
[23:02] nqggrs (~fsfnkz@ptd-24-198-2-67.maine.rr.com) joined #chan.
[23:02] nqggrs (~fsfnkz@ptd-24-198-2-67.maine.rr.com) left #chan.
[23:02] glwmbk (~wskzws@h00065b804de8.ne.client2.attbi.com) joined #chan.
[23:02] glwmbk (~wskzws@h00065b804de8.ne.client2.attbi.com) left #chan.
[23:02] fysjic (~fsxrmy@rrcs-central-65-31-76-57.biz.rr.com) joined #chan.
[23:02] fysjic (~fsxrmy@rrcs-central-65-31-76-57.biz.rr.com) left #chan.
[23:02] fgibjb (~rsfqrh@12-237-96-205.client.attbi.com) joined #chan.
[23:02] fgibjb (~rsfqrh@12-237-96-205.client.attbi.com) left #chan.
[23:02] gcvsbe (~lfnsgx@rdu74-172-126.nc.rr.com) joined #chan.
[23:02] gcvsbe (~lfnsgx@rdu74-172-126.nc.rr.com) left #chan.
[23:02] hugjrv (~hmxgml@rdu74-172-126.nc.rr.com) joined #chan.
[23:02] hugjrv (~hmxgml@rdu74-172-126.nc.rr.com) left #chan.
[23:02] qclxci (~ztteyf@CPE-65-27-78-62.mn.rr.com) joined #chan.
[23:02] qclxci (~ztteyf@CPE-65-27-78-62.mn.rr.com) left #chan.
[23:02] pvdmvk (~bdkgwt@ joined #chan.
[23:02] pvdmvk (~bdkgwt@ left #chan.
[23:02] wyswpv (~ytvggb@cpe-066-061-017-209.midsouth.rr.com) joined #chan.
[23:02] wyswpv (~ytvggb@cpe-066-061-017-209.midsouth.rr.com) left #chan.
[23:02] wkbign (~mgbwjb@ joined #chan.
[23:02] wkbign (~mgbwjb@ left #chan.
[23:02] gjrowt (~pfdvmp@ joined #chan.
[23:02] gjrowt (~pfdvmp@ left #chan.
[23:02] phdqfd (~dsyieu@ joined #chan.
[23:02] phdqfd (~dsyieu@ left #chan.
[23:02] jfqowy (~kxqkcf@ joined #chan.
[23:02] jfqowy (~kxqkcf@ left #chan.
[23:02] rqrxow (~fjohlb@CPE-65-25-228-211.mn.rr.com) joined #chan.
[23:02] rqrxow (~fjohlb@CPE-65-25-228-211.mn.rr.com) left #chan.
[23:02] llravl (~wohpjp@c-67-167-77-66.client.comcast.net) joined #chan.
[23:02] llravl (~wohpjp@c-67-167-77-66.client.comcast.net) left #chan.
[23:02] vassey (~ulowdo@CPE-24-29-181-95.new.rr.com) joined #chan.
[23:02] vassey (~ulowdo@CPE-24-29-181-95.new.rr.com) left #chan.
[23:02] acdgzd (~ublzyr@CPE-65-28-159-246.new.rr.com) joined #chan.
[23:02] acdgzd (~ublzyr@CPE-65-28-159-246.new.rr.com) left #chan.
[23:02] lnvahz (~izvrgx@ joined #chan.
[23:02] lnvahz (~izvrgx@ left #chan.
[23:02] ihzwtv (~gzjrch@CPE-65-28-178-8.neb.rr.com) joined #chan.
[23:02] ihzwtv (~gzjrch@CPE-65-28-178-8.neb.rr.com) left #chan.
[23:02] lbubhj (~ocvlxb@dhcp024-209-097-012.woh.rr.com) joined #chan.
[23:02] lbubhj (~ocvlxb@dhcp024-209-097-012.woh.rr.com) left #chan.
[23:02] lcwqlu (~irwkzs@CPE-65-29-185-98.wi.rr.com) joined #chan.
[23:02] lcwqlu (~irwkzs@CPE-65-29-185-98.wi.rr.com) left #chan.
[23:02] hniumb (~slrkue@12-239-187-198.client.attbi.com) joined #chan.
[23:02] hniumb (~slrkue@12-239-187-198.client.attbi.com) left #chan.
[23:02] zdfyvk (~rbfosp@dhcp024-209-047-166.neo.rr.com) joined #chan.
[23:02] zdfyvk (~rbfosp@dhcp024-209-047-166.neo.rr.com) left #chan.
[23:02] enlqjh (~ezvotm@bgm-24-24-68-183.stny.rr.com) joined #chan.
[23:02] enlqjh (~ezvotm@bgm-24-24-68-183.stny.rr.com) left #chan.
[23:02] akhiap (~hljxax@ joined #chan.
[23:02] akhiap (~hljxax@ left #chan.
[23:02] uczyyb (qflgb@dhcp024-209-209-088.cinci.rr.com) joined #chan.
[23:02] uczyyb (qflgb@dhcp024-209-209-088.cinci.rr.com) left #chan.
[23:02] kpqwyt (~kcygfv@CPE-65-30-71-10.kc.rr.com) joined #chan.
[23:02] kpqwyt (~kcygfv@CPE-65-30-71-10.kc.rr.com) left #chan.
[23:02] iivzkb (~ykvtap@CPE-65-28-159-246.new.rr.com) joined #chan.
[23:02] iivzkb (~ykvtap@CPE-65-28-159-246.new.rr.com) left #chan.
[23:02] svsxuy (~ighryr@CPE-65-29-149-203.wi.rr.com) joined #chan.
[23:02] svsxuy (~ighryr@CPE-65-29-149-203.wi.rr.com) left #chan.
[23:02] lpfbum (~iluphd@dhcp065-025-025-244.neo.rr.com) joined #chan.
[23:02] lpfbum (~iluphd@dhcp065-025-025-244.neo.rr.com) left #chan.
[23:02] npsyip (~qrrmlp@CPE-65-27-110-203.mn.rr.com) joined #chan.
[23:02] npsyip (~qrrmlp@CPE-65-27-110-203.mn.rr.com) left #chan.
[23:02] excdfz (~pakxce@CPE-65-28-98-159.kc.rr.com) joined #chan.
[23:02] excdfz (~pakxce@CPE-65-28-98-159.kc.rr.com) left #chan.
[23:02] ntkims (Cornelius4@ joined #chan.
[23:02] ntkims (Cornelius4@ left #chan.
[23:02] subsco (~mvrvxe@ joined #chan.
[23:02] subsco (~mvrvxe@ left #chan.
[23:02] tvipth (~lvsavg@cpe-66-68-210-33.rgv.rr.com) joined #chan.
[23:02] tvipth (~lvsavg@cpe-66-68-210-33.rgv.rr.com) left #chan.
[23:02] mbofdh (frans57@ip503cee6c.speed.planet.nl) joined #chan.
[23:02] mbofdh (frans57@ip503cee6c.speed.planet.nl) left #chan.
[23:02] nsbjgj (cpzzgy@ joined #chan.
[23:02] nsbjgj (cpzzgy@ left #chan.
[23:02] lgpgjw (knhyn@ joined #chan.
[23:02] lgpgjw (knhyn@ left #chan.
[23:02] jiutzl (Tim72@ joined #chan.
[23:02] jiutzl (Tim72@ left #chan.
[23:02] usvrjr (Tim72@ joined #chan.
[23:02] usvrjr (Tim72@ left #chan.
[23:02] twdmcw (cyxfra@ joined #chan.
[23:02] twdmcw (cyxfra@ left #chan.
[23:02] uqtbtq (Cornelius4@ joined #chan.
[23:02] uqtbtq (Cornelius4@ left #chan.
[23:02] mehoci (Henry92@lsanca1-ar52-4-63-205-104.lsanca1.dsl-verizon.net) joined #chan.
[23:02] mehoci (Henry92@lsanca1-ar52-4-63-205-104.lsanca1.dsl-verizon.net) left #chan.
[23:02] hfnjff (ScottK49@ joined #chan.
[23:02] hfnjff (ScottK49@ left #chan.
[23:02] kukurw (lavjm@ joined #chan.
[23:02] kukurw (lavjm@ left #chan.
[23:02] ufraen (shane6@CPE-65-30-227-181.mn.rr.com) joined #chan.
[23:02] ufraen (shane6@CPE-65-30-227-181.mn.rr.com) left #chan.
[23:02] tdzikq (~hotsfh@ joined #chan.
[23:02] tdzikq (~hotsfh@ left #chan.
[23:02] wryrhk (Fredie15@CPE-65-27-8-63.kc.rr.com) joined #chan.
[23:02] wryrhk (Fredie15@CPE-65-27-8-63.kc.rr.com) left #chan.
[23:02] unxzse (~jhwmjw@12-239-187-198.client.attbi.com) joined #chan.
[23:02] unxzse (~jhwmjw@12-239-187-198.client.attbi.com) left #chan.
[23:02] mvvboh (~lqomno@ joined #chan.
[23:02] mvvboh (~lqomno@ left #chan.
[23:02] cubzlp (~vhucfc@ joined #chan.
[23:02] cubzlp (~vhucfc@ left #chan.
[23:02] ffepwf (~ejiksa@2416426hfc170.tampabay.rr.com) joined #chan.
[23:02] ffepwf (~ejiksa@2416426hfc170.tampabay.rr.com) left #chan.
[23:02] aixdes (Matt52@ joined #chan.
[23:02] aixdes (Matt52@ left #chan.
[23:02] zlyflq (Cathy34@ joined #chan.
[23:02] zlyflq (Cathy34@ left #chan.
[23:02] ctpqoj (lavjm@ joined #chan.
[23:02] ctpqoj (lavjm@ left #chan.
[23:02] sygfoz (~csthbr@ joined #chan.
[23:02] sygfoz (~csthbr@ left #chan.
[23:02] ljmnmj (~zeygtw@ joined #chan.
[23:02] ljmnmj (~zeygtw@ left #chan.
[23:02] zbawqd (~gkhclw@ joined #chan.
[23:02] zbawqd (~gkhclw@ left #chan.
[23:02] bkkqdj (~kqpbpm@ joined #chan.
[23:02] bkkqdj (~kqpbpm@ left #chan.
[23:02] poygqr (ScottK49@66-91-244-66.san.rr.com) joined #chan.
[23:02] poygqr (ScottK49@66-91-244-66.san.rr.com) left #chan.
[23:02] ezemqw (~zhedlm@cpe-66-91-92-196.hawaii.rr.com) joined #chan.
[23:02] ezemqw (~zhedlm@cpe-66-91-92-196.hawaii.rr.com) left #chan.
[23:02] radstd (~pxyamb@cpe-66-8-146-166.hawaii.rr.com) joined #chan.
[23:02] radstd (~pxyamb@cpe-66-8-146-166.hawaii.rr.com) left #chan.
[23:02] chiwrd (blqx@ joined #chan.
[23:02] chiwrd (blqx@ left #chan.
[23:02] qfbfrw (kmsav@ joined #chan.
[23:02] qfbfrw (kmsav@ left #chan.
[23:02] nykaof (~cxycso@ joined #chan.
[23:02] nykaof (~cxycso@ left #chan.
[23:02] vnaapi (~wnsuau@cpe-66-91-59-134.hawaii.rr.com) joined #chan.
[23:02] vnaapi (~wnsuau@cpe-66-91-59-134.hawaii.rr.com) left #chan.
[23:02] Eternity^ (~levi@ left #chan.
[23:02] lqdohz (~zhlvdo@653289hfc76.tampabay.rr.com) joined #chan.
[23:02] lqdohz (~zhlvdo@653289hfc76.tampabay.rr.com) left #chan.
[23:02] jnnqlr (cdhpo@ joined #chan.
[23:02] jnnqlr (cdhpo@ left #chan.
[23:02] sqgdri (cdhpo@ joined #chan.
[23:02] sqgdri (cdhpo@ left #chan.
[23:02] xjbtoa (fzaaqkb@ joined #chan.
[23:02] xjbtoa (fzaaqkb@ left #chan.
[23:02] stwczv (~rbemfn@clt74-87-028.carolina.rr.com) joined #chan.
[23:02] stwczv (~rbemfn@clt74-87-028.carolina.rr.com) left #chan.
[23:02] hdufib (~bsnjgn@ joined #chan.
[23:02] hdufib (~bsnjgn@ left #chan.
[23:02] mnzyin (uwqku@cs6669180-133.houston.rr.com) joined #chan.
[23:02] mnzyin (uwqku@cs6669180-133.houston.rr.com) left #chan.
[23:02] zkipja (~ttfokc@ joined #chan.
[23:02] zkipja (~ttfokc@ left #chan.
[23:02] kbpofe (~rasqet@jh49791-0.student.appstate.edu) joined #chan.
[23:02] kbpofe (~rasqet@jh49791-0.student.appstate.edu) left #chan.
[23:02] ouoctm (~wwvzzo@ joined #chan.
[23:02] ouoctm (~wwvzzo@ left #chan.
[23:02] apogxz (~vmfkie@clt25-100-115.carolina.rr.com) joined #chan.
[23:02] apogxz (~vmfkie@clt25-100-115.carolina.rr.com) left #chan.
[23:02] btyfmx (Donnetta48@CPE-65-31-194-202.neb.rr.com) joined #chan.
[23:02] btyfmx (Donnetta48@CPE-65-31-194-202.neb.rr.com) left #chan.
[23:02] tbshun (Freddy25@dhcp024-209-026-250.cinci.rr.com) joined #chan.
[23:02] tbshun (Freddy25@dhcp024-209-026-250.cinci.rr.com) left #chan.
[23:02] ypvvvr (Chaz68@24-29-139-252.nyc.rr.com) joined #chan.
[23:02] ypvvvr (Chaz68@24-29-139-252.nyc.rr.com) left #chan.
[23:02] ttuyqo (~zgdmym@h0030f12810fe.ne.client2.attbi.com) joined #chan.
[23:02] ttuyqo (~zgdmym@h0030f12810fe.ne.client2.attbi.com) left #chan.
[23:02] pmowel (~awlhui@ joined #chan.
[23:02] pmowel (~awlhui@ left #chan.
[23:02] fabgbs (~ighoeo@CPE-65-27-127-235.mn.rr.com) joined #chan.
[23:02] fabgbs (~ighoeo@CPE-65-27-127-235.mn.rr.com) left #chan.
[23:02] ipwsjv (~ihjlyi@ joined #chan.
[23:02] ipwsjv (~ihjlyi@ left #chan.
[23:02] nsihbw (osagie50@ joined #chan.
[23:02] nsihbw (osagie50@ left #chan.
[23:02] pheodo (~crhpez@cvg-65-27-241-94.cinci.rr.com) joined #chan.
[23:02] pheodo (~crhpez@cvg-65-27-241-94.cinci.rr.com) left #chan.
[23:02] xdfnuh (~edehow@CPE-65-31-237-2.neb.rr.com) joined #chan.
[23:02] xdfnuh (~edehow@CPE-65-31-237-2.neb.rr.com) left #chan.
[23:02] bzzifn (~lnvezl@ joined #chan.
[23:02] bzzifn (~lnvezl@ left #chan.
[23:02] bbahhw (~huulfl@ joined #chan.
[23:02] bbahhw (~huulfl@ left #chan.
[23:02] rqxpji (~cbmyhz@cs6710132-45.houston.rr.com) joined #chan.
[23:02] rqxpji (~cbmyhz@cs6710132-45.houston.rr.com) left #chan.
[23:02] spgfvr (~acqtmn@ joined #chan.
[23:02] spgfvr (~acqtmn@ left #chan.
[23:02] qzlybf (~awppin@cpe-24-24-224-205.socal.rr.com) joined #chan.
[23:02] qzlybf (~awppin@cpe-24-24-224-205.socal.rr.com) left #chan.
[23:02] vojpbc (~qmurqi@lsanca2-ar32-4-63-082-101.lsanca2.dsl-verizon.net) joined #chan.
[23:02] vojpbc (~qmurqi@lsanca2-ar32-4-63-082-101.lsanca2.dsl-verizon.net) left #chan.
[23:02] vrodjj (~pzazwp@ joined #chan.
[23:02] vrodjj (~pzazwp@ left #chan.
[23:02] bsnncn (frans@ joined #chan.
[23:02] bsnncn (frans@ left #chan.
[23:02] dtpyqx (loiizic@h68-145-246-170.cg.shawcable.net) joined #chan.
[23:02] dtpyqx (loiizic@h68-145-246-170.cg.shawcable.net) left #chan.
[23:02] psevqe (~rmznet@ joined #chan.
[23:02] psevqe (~rmznet@ left #chan.
[23:02] yhoneb (chicos1@APlessis-Bouchard-111-1-11-74.w81-50.abo.wanadoo.fr) joined #chan.
[23:02] yhoneb (chicos1@APlessis-Bouchard-111-1-11-74.w81-50.abo.wanadoo.fr) left #chan.
[23:02] eqfyqc (~escdmc@dhcp065-025-094-198.neo.rr.com) joined #chan.
[23:02] eqfyqc (~escdmc@dhcp065-025-094-198.neo.rr.com) left #chan.
[23:02] isgatx (~wcrtkc@cpe-66-91-48-5.hawaii.rr.com) joined #chan.
[23:02] isgatx (~wcrtkc@cpe-66-91-48-5.hawaii.rr.com) left #chan.
[23:02] jbhbac (frans@ip503cee6c.speed.planet.nl) joined #chan.
[23:02] jbhbac (frans@ip503cee6c.speed.planet.nl) left #chan.
[23:02] kpwamj (frans@ joined #chan.
[23:02] kpwamj (frans@ left #chan.
[23:02] okeufl (Jonas95@h83n3fls20o1055.bredband.comhem.se) joined #chan.
[23:02] okeufl (Jonas95@h83n3fls20o1055.bredband.comhem.se) left #chan.
[23:02] lkpats (~rymmxc@ joined #chan.
[23:02] lkpats (~rymmxc@ left #chan.
[23:02] bawgls (rbminges7@ joined #chan.
[23:02] bawgls (rbminges7@ left #chan.
[23:02] fiaybq (eesqrqi@dhcp065-025-071-142.neo.rr.com) joined #chan.
[23:02] fiaybq (eesqrqi@dhcp065-025-071-142.neo.rr.com) left #chan.
[23:02] murrns (pxpamwd@dhcp065-025-071-142.neo.rr.com) joined #chan.
[23:02] murrns (pxpamwd@dhcp065-025-071-142.neo.rr.com) left #chan.
[23:02] vcxtox (Ron53@ joined #chan.
[23:02] vcxtox (Ron53@ left #chan.
[23:02] iejvhk (yqrbdzr@CPE-65-28-54-234.kc.rr.com) joined #chan.
[23:02] iejvhk (yqrbdzr@CPE-65-28-54-234.kc.rr.com) left #chan.
[23:02] yrcxxm (tvxta@CPE-65-28-54-234.kc.rr.com) joined #chan.
[23:02] yrcxxm (tvxta@CPE-65-28-54-234.kc.rr.com) left #chan.
[23:02] okysqz (smfejos@ joined #chan.
[23:02] okysqz (smfejos@ left #chan.
[23:02] axdxcu (zlshyrv@ joined #chan.
[23:02] axdxcu (zlshyrv@ left #chan.
[23:02] kmmrzj (Tiffany94@ joined #chan.
[23:02] kmmrzj (Tiffany94@ left #chan.
[23:02] xeotkx (Tiffany94@ joined #chan.
[23:02] xeotkx (Tiffany94@ left #chan.
[23:02] wbkdhy (wmrmvhb@CPE-65-28-54-234.kc.rr.com) joined #chan.
[23:02] wbkdhy (wmrmvhb@CPE-65-28-54-234.kc.rr.com) left #chan.
[23:02] mxebnx (ruth85@ joined #chan.
[23:02] mxebnx (ruth85@ left #chan.
[23:02] jjcsse (ruth85@ joined #chan.
[23:02] jjcsse (ruth85@ left #chan.
[23:02] yzkmqq (Fredie15@ joined #chan.
[23:02] yzkmqq (Fredie15@ left #chan.
[23:02] vopfwo (Fredie15@ joined #chan.
[23:02] vopfwo (Fredie15@ left #chan.
[23:02] izubwj (Rob21@ joined #chan.
[23:02] izubwj (Rob21@ left #chan.
[23:02] wxvbxt (l313kO1@ joined #chan.
[23:02] wxvbxt (l313kO1@ left #chan.
[23:02] dlcfok (~qswxov@200-207-51-223.dsl.telesp.net.br) joined #chan.
[23:02] dlcfok (~qswxov@200-207-51-223.dsl.telesp.net.br) left #chan.
[23:02] ospgbf (~fkqvhd@197.Red-80-59-44.pooles.rima-tde.net) joined #chan.
[23:02] ospgbf (~fkqvhd@197.Red-80-59-44.pooles.rima-tde.net) left #chan.
[23:02] xvsmes (~hpcevl@ joined #chan.
[23:02] xvsmes (~hpcevl@ left #chan.
[23:02] ugvaod (~huhidi@ joined #chan.
[23:02] ugvaod (~huhidi@ left #chan.
[23:02] yozaaf (Randy54@dhcp065-025-060-164.neo.rr.com) joined #chan.
[23:02] yozaaf (Randy54@dhcp065-025-060-164.neo.rr.com) left #chan.
[23:02] zmjzxa (mlnju@ma-rockland2a-22.albyny.adelphia.net) joined #chan.
[23:02] zmjzxa (mlnju@ma-rockland2a-22.albyny.adelphia.net) left #chan.
[23:02] wqmlau (Randy54@ joined #chan.
[23:02] wqmlau (Randy54@ left #chan.
[23:02] ltgspv (Mike96@ joined #chan.
[23:02] ltgspv (Mike96@ left #chan.
[23:02] jdeikx (kevin38@ joined #chan.
[23:02] mjemjx (~gunqcu@CPE-65-28-3-58.kc.rr.com) joined #chan.
[23:02] mjemjx (~gunqcu@CPE-65-28-3-58.kc.rr.com) left #chan.
[23:02] jdeikx (kevin38@ left #chan.
[23:02] ijfyte (ruth85@ joined #chan.
[13:57:22] (our_bot): [zPeak] Peak statistics.
[13:57:24] (our_bot): [zPeak] Peaked at 420 users
[13:57:26] (our_bot): [zPeak] On Thu Aug 28 17:14:27 2003
That's about setting a limit.

On my ways to get help in that case I found one helper who told me the probably truth why I can't get help. The guy belongs to a channel with the nice name #hacksquad and they don't do anything against users of that channel cause they have fears to be attacked by themself.

User avatar
Posts: 28
Location: Moldova

Post by adrenalin »

Also i have see many times when ex. 20 bots join in same times a channel with +l ex. 20.. The limit is not all times respected.. I mean if ex. on a channel is 18 users.. And the limit is 20.. And if all the bots join in the same time on the channel can be 22 or more users..
Maybe that is a ircd-bug ?

Posts: 212

Post by puterfixer »

I've seen people joining even that a channel ban was set on their host! Can't think of another explanation than problems during server synchronising after a netsplit and lag. Try to refresh channel mode (set it again).

Most drones are not running an ident (their address has an ~ in front when you whois them), so if you need to ban an entire ISP, it might be a good idea to use this ~ in the banmask, such as *!~*@*.wi.rr.com. This way, normal chatters from that ISP are still able to join.

In the above channel flood, all drones used a six-character nickname; this would have been easily fixed by setting a ban for all people with 6 characters in their nickname, with this banmask: ??????!*@* (six question marks).

Another solution to consider is setting the channel mode to +r, so only people with usernames for X and who are logged in are able to join. I doubt drones will have usernames :)

Drones come from everywhere. I've seen a bad script advertising a fake Romanian porn site, which infected hundreds of .ro hosts, especially from Internet cafes. Asian computers (korean, japanese, chinese) are especially known for their administrators' lack of interest in securing their networks, so there are thousands of insecure proxies or computers there; people tried in vain to contact the administrators and tell them to clean and patch the computers, but nothing happened. Unfortunately, the Internet remains the playground of kiddiots and it's up to us to protect ourselves and learn to have fun while keeping an eye out for problems.

User avatar
Posts: 64
Location: Brasov

Post by Dude »

please tell me more about *.hu. If he has a lot of bots loaded from *.hu he might actuallty live in Hungary. And track his real ip, send info to the police.
Dudes & dudettes

Posts: 21

Post by LordPimp »

I have been quite busy with other things other then IRC. I do log on pretty much every day but for only a brief period. The Floods by the above mentioned people are strictly for gaining a reputation. A sort of "cool" image. They are not religious, they dont care about religion. As for them being hackers and undernet being scared of them, they damn right should be. Because these script kiddies root boxes and share boxes and are also probably behind the laggin of X these days.

A new exploit on IRC servers is the multiple parts. A user/drone joins and parts the channel several times without rejoining. Interesting eh.
You can download the no-partflood from http://www.egghelp.org and set your duration bans to 100 days.

Another interesting thing to do is ban the
ident range of *!*0?@* - *!*9?@*
this bans most drones but not all. Unfortunatly there is much you can do, +r loses you customers as well as +i. +m you need to voice everyone try using SVoice.tcl again you can find this at Egghelp. If anyone is interested in learning or trying to understand more about these floods and wants advice on how to protect their channels you can find me in #absolute

P.S. UnderNet are doing a pretty good job but I think a seperate task force needs to be set up to encounter this problem.