Need a tcl script to run on an eggdrop and combat spam bots

EviL_SmUrF · Post by **EviL_SmUrF** » Mon Dec 08, 2003 10:08 pm

My network is being flooded with damn spam bots who message everyone with "Clocl here to see my video!" and the video address appears to be http:// + their full hostmask with /me.mpg at the end

If you are interested in creating a tcl script that I can run on an eggdrop that will check to see if that address is valid for everyone that connects to the network (the bot will be opered), I am interested in paying you for it via paypal.

Please contact me at irc.messagebot.net or send me a memo there. My nickname is EviL_SmUrF.

Thanks guys!

Post by **CrazyCat** » Tue Dec 09, 2003 3:38 am

why speaking about money? Can't you understand that a community is a place where everybody helps everybody?

So, about your trouble, you want to verify if the string between http:// and /me.mpg is valid? It's quite stupid

Why don't you just check if you're spammed with an add for me.mpg?

EviL_SmUrF · Post by **EviL_SmUrF** » Tue Dec 09, 2003 9:30 am

because i dont want to give the spammers a chance to even message anyone. i want to grab the hostmask as its connecting (via the server notices to ircops), check to see if http://their-hostmask.com/me.mpg is valid, and if it is, ban the spam bot before they can even message anyone.

Post by **CrazyCat** » Tue Dec 09, 2003 1:57 pm

ok, so you can try using wget or lynx -dump.
If an error is returned, the user may be ok.

But take care, because more of this spams don't work, so not having the $hostmask/me.mpg isn't an evidence...

TALES · Post by **TALES** » Tue Dec 09, 2003 4:49 pm

im on a server where there is also that problem.

what i did was kick ban the user when he join that has done the trick for a while.
now what he or she is doing is join part channel and get nicks who iare in the channel and then msg them.with that msg.

its always a nick like example: `]{a[ , ]`aw{ , }]c ,`a[ etc.. random letters and charactors.

i have tryed the bogus thing in eggdrop.

set kick-bogus 1

for bogus nicks but not effective

i dont know if that set kick-bogus 1 is al you have to do to active that bogus thing ??

Post by **Sir_Fz** » Tue Dec 09, 2003 6:13 pm

As far as I see, there is no kick-bogus setting in eggdrops.

TALES · Post by **TALES** » Tue Dec 09, 2003 7:00 pm

looks like that i have missed read something about that kick-bogus.

EviL_SmUrF · Post by **EviL_SmUrF** » Tue Dec 09, 2003 11:22 pm

so, any ideas guys?

maybe if someone can write me a simple tcl script that if a user joins/parts and it is quicker than a quarter-second or somethin, they get glined? =/

or if someone can try using the wget like someone said?

as u can tell i dont know any tcl at all, so im hoping someone here will help!

kaspo · Post by **kaspo** » Wed Dec 10, 2003 4:55 am

u can use spamcheck.tcl by Torr & MC_8. you can download at http://www.egghelp.org/tclhtml/3478-4-0-0-1-spam.htm
i use this tcl, very good

Post by **Sir_Fz** » Wed Dec 10, 2003 9:44 am

this is a code that checks if nick parts the channel in 1 second or less after joining:

Code: Select all

bind part - * gline:spamer

proc gline:spamer {nick uhost hand chan} {
if {[getchanjoin $nick $chan] >= [expr {[clock seconds]-1}]} {
## gline user
 }
}

you can change the value 1 second to less or more.

stammer · Post by **stammer** » Thu Dec 11, 2003 3:51 am

Why don't you make a eggdrop an ircop and make it to message everyone who join server or network and if it is a spambot gline it

Ofloo · Post by **Ofloo** » Fri Dec 12, 2003 9:18 am

i got a script old script i made for my ircd don't use it for the time being there is a bug in it but it checks ctcp version on connect i would have to read true it but the script connects as a service to the server also is able to get host masks on connect .. if u wanted to so what is it exactly u want maybe i can help u .. if u discribe exactly what u want .. and only if i can do it for free :p lol, well ill try to do my best tho to make the script u want :p

gline not that effective if u where to deny its host just zline its host simple .. if u would do that then they can't even use connect flood cause gline would still show connection while zline kicks it before it trys to connect

witch in the end would be mutch more effective or if u don't mind the connection .. shun them

TALES · Post by **TALES** » Mon Dec 22, 2003 1:05 pm

i use now 2 tcl for this problem 1 bogus nick ban kicker
and 1 realname scan original code by Papillon modified and adjusted by caesar. in the source of the spambot i saw that the real name always is with .com .net .org .ca 1 of the 13 realnames is with out a .domein

scripts works fine for me now but need some adjustments

you can find the 2 scripts here in tcl scripts : bad2pack.zip
http://www.cb3rob.net/~tales/