Melts NickChecker against flood bots

[R] · Post by **[R]** » Sun Oct 24, 2004 10:29 am

Hello,

Hm Well.. I have seen a script... called as Nickchecker...
What do you think about this script?
Is it good? Or does the script ban normal users?

Write what do you think about this script .. maybe I install it.

Greets & Thx

[R]

############################################
Meltdowns NickChecker V0.1 (25-09-2004)

http://scripts.udp.at
############################################

Alchera · Post by **Alchera** » Sun Oct 24, 2004 10:47 am

How about you install it and inform us if it's good?

awyeah · Post by **awyeah** » Sun Oct 24, 2004 10:49 am

Well what does the script do? Check nicks? Check bad nicks? or something? If so I can give you other better scripts than this.

[R] · Post by **[R]** » Sun Oct 24, 2004 10:50 am

Not a good idea... I have a big channel and dont want a kick channel

.. hmm What do you think?

Edit:

Code: Select all

#################################################################
# Meltdowns NickChecker V0.1 (25-09-2004)                      	#
#                                                               #
# http://scripts.udp.at                                         #
# 								#
# Script detects suspicious nicknames on /join and bans them.   #
#								#
# It detects the nicks by following consonants, which make	#
# no sense. Rate is at about 90%.				#
#								#
# Activate it for a chan with .chanset #CHANNEL +nickcheck	#
#                                                               #
# Contact: meltdown@gmx.at | #meltdown on quakenet              #
#                                                               #
# [! LEAVE THESE CREDITS INTACT. !] thx...                      #
#								#
#################################################################

#
# Bantime in seconds
set check(bantime) "600"


bind join - * checkthisnick

setudef flag nickcheck

set check(kmessage) "You were detected as a Spam/Flood-bot. To join this channel, pls change your nick to something... erm...normal"

set check(cons) "bcdfghjklmnpqrstvxyz"
set check(good) "tt ll ss"
set check(affixture) "off bnc \[ \] afk"

proc checkthisnick { nick uhois hand chan} {
global check
if {[lsearch -exact [channel info $chan] +nickcheck] == -1} {return 0}
set const_count 0
set score 0
set txt [list $nick]

# basic l337-translat0r
        set txt [string map "0 o 1 l 3 e 7 t 4 a" $txt]

# Remove double-cons
	foreach x [split $check(good)] {
		set txt [string map -nocase "$x \"\"" $txt]
	}
# Remove "off","bnc" etc and lower score
	foreach x [split $check(affixture)] {
		if {[string match -nocase *$x* $txt]} {
			set txt [string map -nocase "$x \"\"" $txt]
			set score [expr $score - 10]
		}
	}

# Check cons frequency
	for {set x 0} {$x<[string length $txt]} {incr x} {
		if {[string last [string index $txt $x] $check(cons)] > -1} {
			incr const_count
			if {$const_count >= 3} { set score [expr $score+10] }
		} else {
			set const_count 0
		}
	
	}
  if {$score >= 30} { 
	putlog "Found suspicious nickname in $chan: $nick ($score)"
	pushmode $chan +b "$nick!*@*"
	flushmode $chan
	putkick $chan $nick "$check(kmessage) -blub"
	utimer $check(bantime) "[list pushmode $chan -b "$nick!*@*"]"
  }
}

The script.

Ps: I need a script that detect generated nicks like this:

w0v43

... and BAN them.

Alchera · Post by **Alchera** » Sun Oct 24, 2004 10:53 am

awyeah wrote:If so I can give you other better scripts than this.

I wouldn't be making such a broad statement as this without first testing the script yourself to see just what it does or how good it is. You're also hinting your scripts are better than anyone else's; possibly not the case.

demond · Post by **demond** » Sun Oct 24, 2004 11:03 am

I've been using this (as part of spambuster.tcl) for a pretty effective detection of random or semi-randomly generated nicks, commonly used by spammers and floodbots:

Code: Select all

proc sb:score {str} {
	set score 0
	set vowel "aeiouy"
	set cnant "bcdfghjklmnpqrstvwxz"
	set other "{}\\\[\\\]-_^`|\\\\"
	set digit "0123456789"
	set str [string tolower $str]
	incr score [llength [regexp -all -inline \[$vowel\]{3,} $str]]
	incr score [llength [regexp -all -inline \[$cnant\]{3,} $str]]
	incr score [llength [regexp -all -inline \[$other\]{2,} $str]]
	incr score [llength [regexp -all -inline \[$digit\]{2,} $str]]
	incr score [llength [regexp -all -inline \[$vowel$other\]{4,} $str]]
	incr score [llength [regexp -all -inline \[$cnant$other\]{4,} $str]]
	incr score [llength [regexp -all -inline \[$vowel$digit\]{4,} $str]]
	incr score [llength [regexp -all -inline \[$cnant$digit\]{4,} $str]]
	incr score [llength [regexp -all -inline \[$other$digit\]{3,} $str]]
	incr score $score
}

awyeah · Post by **awyeah** » Sun Oct 24, 2004 11:09 am

Demond would this only give randomnly generated nicks? with vowels or without vowels?

Because I am using one currently on a large IRC channel meaning various of nicks, join and part in secs so I need this to be perfect and not kick innocent users.

I am just using something simple as this which I made, the same combinations in 'nonsensenick' (one of the addons of the mIRC Oz Script).

Code: Select all

set userident [string trimleft [string tolower [lindex [split $uhost "@"] 0]] "~"]
  if {([string length $userident] >= 4) && ([string length $nick] >= 7) && ([string length $nick] <= 11) && (![regexp -nocase "a" $nick]) && (![regexp -nocase "e" $nick]) && (![regexp -nocase "i" $nick]) && (![regexp -nocase "o" $nick]) && (![regexp -nocase "u" $nick]) && (![regexp -nocase "mrs" $nick]) && (![regexp -nocase "mr" $nick]) && (![regexp -nocase "xyz" $nick]) && (![regexp -nocase "dj" $nick]) && (![regexp -nocase "chr" $nick]) && (![regexp -nocase "fr" $nick]) && (![regexp -nocase "msn" $nick]) && (![regexp -nocase "dr" $nick]) && (![regexp "\[-|_aeiouxyz0\]" $nick]) && (([regexp {^[^aeiou_^-`]+$} $nick] && [regexp {[^0-9]?$} $nick]) || [regexp {^[A-z][0-9]{1,}$} $nick] || [regexp {^(\w){3}(\d){2}\w(\d){3}$} $nick] || [regexp "_\[0-9\]\[0-9\]$" $nick] || [regexp "^\[a-z\]\[a-z\]-" $nick] || [regexp "\[0-9\]\[0-9\]\[0-9\]$" $nick] || [regexp -nocase "gv" $nick] || [regexp -nocase "gz" $nick] || [regexp -nocase "qb" $nick] || [regexp -nocase "qc" $nick] || [regexp -nocase "qd" $nick] || [regexp -nocase "qf" $nick] || [regexp -nocase "qg" $nick] || [regexp -nocase "qh" $nick] || [regexp -nocase "qk" $nick] || [regexp -nocase "qm" $nick] || [regexp -nocase "qn" $nick] || [regexp -nocase "qp" $nick] || [regexp -nocase "qj" $nick] || [regexp -nocase "qr" $nick] || [regexp -nocase "qs" $nick] || [regexp -nocase "qt" $nick] || [regexp -nocase "qw" $nick] || [regexp -nocase "qv" $nick] || [regexp -nocase "qx" $nick] || [regexp -nocase "qz" $nick] || [regexp -nocase "xd" $nick] || [regexp -nocase "xf" $nick] || [regexp -nocase "xg" $nick] || [regexp -nocase "xh" $nick] || [regexp -nocase "xk" $nick] || [regexp -nocase "xm" $nick] || [regexp -nocase "xn" $nick] || [regexp -nocase "xq" $nick] || [regexp -nocase "xr" $nick] || [regexp -nocase "xt" $nick] || [regexp -nocase "xv" $nick] || [regexp -nocase "xz" $nick] || [regexp -nocase "zb" $nick] || [regexp -nocase "zc" $nick] || [regexp -nocase "zd" $nick] || [regexp -nocase "zf" $nick] || [regexp -nocase "zh" $nick] || [regexp -nocase "zm" $nick] || [regexp -nocase "zq" $nick] || [regexp -nocase "zr" $nick] || [regexp -nocase "zt" $nick] || [regexp -nocase "zv" $nick] || [regexp -nocase "zx" $nick] || [regexp -nocase "kz" $nick] || [regexp -nocase "lx" $nick] || [regexp -nocase "vb" $nick] || [regexp -nocase "vf" $nick] || [regexp -nocase "vg" $nick] || [regexp -nocase "vh" $nick] || [regexp -nocase "vk" $nick] || [regexp -nocase "vm" $nick] || [regexp -nocase "vn" $nick] || [regexp -nocase "vq" $nick] || [regexp -nocase "vx" $nick] || [regexp -nocase "vw" $nick] || [regexp -nocase "wj" $nick] || [regexp -nocase "jwm" $nick] || [regexp -nocase "ql" $nick] || [regexp -nocase "qy" $nick] || [regexp -nocase "xb" $nick] || [regexp -nocase "xc" $nick] || [regexp -nocase "xj" $nick] || [regexp -nocase "xl" $nick] || [regexp -nocase "xp" $nick] || [regexp -nocase "xs" $nick] || [regexp -nocase "xw" $nick] || [regexp -nocase "zg" $nick] || [regexp -nocase "zj" $nick] || [regexp -nocase "zk" $nick] || [regexp -nocase "zl" $nick] || [regexp -nocase "zn" $nick] || [regexp -nocase "zp" $nick] || [regexp -nocase "zs" $nick] || [regexp -nocase "zw" $nick] || [regexp -nocase "zx" $nick] || [regexp -nocase "zy" $nick] || [regexp -nocase "vc" $nick] || [regexp -nocase "vd" $nick] || [regexp -nocase "wx" $nick] || [regexp -nocase "vp" $nick] || [regexp -nocase "vs" $nick] || [regexp -nocase "vt" $nick] || [regexp -nocase "vp" $nick] || [regexp -nocase "vy" $nick] || [regexp -nocase "vz" $nick] || [regexp -nocase "wq" $nick] || [regexp -nocase "wx" $nick] || [regexp -nocase "wz" $nick]) > 0} {

Look's messy right?
I'll change it into a list and would use a foreach loop to do a string match on each element that should do it as well.

[R] · Post by **[R]** » Sun Oct 24, 2004 11:14 am

Scripts in english!
Not that [censored].. sry

Spambuster.tcl sucks

Alchera · Post by **Alchera** » Sun Oct 24, 2004 11:33 am

Und NickChecker ist Deutsch? Nein!

***Edited***

Code: Select all

#################################################################
# Meltdowns NickChecker V0.1 (25-09-2004)
#
# http://scripts.udp.at
# 
# Script detects suspicious nicknames on /join and bans them.
#
# It detects the nicks by following consonants, which make
# no sense. Rate is at about 90%.
#
# Activate it for a chan with .chanset #CHANNEL +nickcheck
# 
# Contact: meltdown@gmx.at | #meltdown on quakenet
# 
# [! LEAVE THESE CREDITS INTACT. !] thx...
#
#################################################################

[R] It would help if you actually read the information at the top of these scripts.

[R] · Post by **[R]** » Sun Oct 24, 2004 11:37 am

Hallo,

Nein NickChecker von Meld ist english.
Aber spambuster.tcl ist 'ne komische Sprache...

Greets

[R]

demond · Post by **demond** » Sun Oct 24, 2004 11:38 am

@awyeah:

naturally, you will never have 100% accuracy - neither with your solution nor with mine, not with any other - and innocents are going to be shitlisted; but at least those would be pretty lame innocents

as you might have already noticed, in spambuster I set the default score threshold to 17; based on my experience, I'd say it has a success rate of around 95% (out of 20, 19 are real/potential spammers and 1 is innocent) on a lame channel, and virtually 100% on a channel with clueful ppl only

a "lame innocent" would have an idiotic nick:

Code: Select all

<(saavik> [10:06] spambuster v2.6: spam nick [[[mmm]]]!zzzzzzzzzz@sp124.spidernetbg.com (score: 18)

btw, spambuster counts the whole $nick!$user

as of the score logic, it assigns score points for:

3 or more adjacent vowels
3 or more adjacent consonants
2 or more adjacent nonalphanum chars
2 or more digits
and a couple more combinations of the above which you can figure out yourself

awyeah · Post by **awyeah** » Sun Oct 24, 2004 12:05 pm

So how would this be used?

Code: Select all

Would I string match or what?

set spamchecknick [sb:score $nick]

proc sb:score {str} {
   set score 0
   set vowel "aeiouy"
   set cnant "bcdfghjklmnpqrstvwxz"
   set other "{}\\\[\\\]-_^`|\\\\"
   set digit "0123456789"
   set str [string tolower $str]
   incr score [llength [regexp -all -inline \[$vowel\]{3,} $str]]
   incr score [llength [regexp -all -inline \[$cnant\]{3,} $str]]
   incr score [llength [regexp -all -inline \[$other\]{2,} $str]]
   incr score [llength [regexp -all -inline \[$digit\]{2,} $str]]
   incr score [llength [regexp -all -inline \[$vowel$other\]{4,} $str]]
   incr score [llength [regexp -all -inline \[$cnant$other\]{4,} $str]]
   incr score [llength [regexp -all -inline \[$vowel$digit\]{4,} $str]]
   incr score [llength [regexp -all -inline \[$cnant$digit\]{4,} $str]]
   incr score [llength [regexp -all -inline \[$other$digit\]{3,} $str]]
   incr score $score
   return $str
}

demond · Post by **demond** » Sun Oct 24, 2004 12:19 pm

in spambuster, I use it like this:

Code: Select all

set score [sb:score $nick!$user]

and then take action depending on score

awyeah · Post by **awyeah** » Sun Oct 24, 2004 12:26 pm

kthx, I'll download spambuster as well and check to see how you utilize various score results to what outputs.

[R] · Post by **[R]** » Sun Oct 24, 2004 1:02 pm

Hello,

Back ² Topic please...
Can you make Melts nickchecker better, for me?
I like this script .. maybe you can fix it...

Thx !! & Greetz

[R]