Need help on fight against the floods

finkoisti · Post by **finkoisti** » Wed Mar 16, 2005 1:41 pm

In our server we have lot of problem with floods and almoust allways the address and nick is something like this...

(19:26:40) —› join: (a2328) (c3915@1A5B6A8C.F0E56F7E.1991392E.IP)

and that nick part I have fix with one script to ban everyone who has at least two numbers on nick...so in this way.. "*00*" "*01*" "*02*"........"*99*"

but who to ban those peoples also with their identify part on host??
I'm try to use that banmask.tcl script but it doesn't work and I don't know why??

I have try many ways, if I put ex *!*00*@* it bans everuone one the channel. if I try !*00*@* or just *00*@* it doesn't work at all...

So how to fix it??

Please help me fast, I'm really pist of on those flooders....

Adrenalin · Post by **Adrenalin** » Wed Mar 16, 2005 2:49 pm

Same kind of bots flood channel of my country Moldova, but after puting these bans.. I don't seen them again..

?????!~?0???@*
?????!~?1???@*
?????!~?2???@*
?????!~?3???@*
?????!~?4???@*
?????!~?5???@*
?????!~?6???@*
?????!~?7???@*
?????!~?8???@*
?????!~?9???@*

Bots from my Network don't have identd, so they all have the ~ in the ident. From your example i see what they don't have the ~, so you can try put these bans.

?????!?0???@*
?????!?1???@*
?????!?2???@*
?????!?3???@*
?????!?4???@*
?????!?5???@*
?????!?6???@*
?????!?7???@*
?????!?8???@*
?????!?9???@*

Hope that helps.

finkoisti · Post by **finkoisti** » Wed Mar 16, 2005 3:44 pm

I don't think that helps.. because the question mark is one mark ( number or character ) so then te nick or host have to be as long as you have put on the bans....

awyeah · Post by **awyeah** » Thu Mar 17, 2005 1:22 am

This is not an eggdrop or tcl problem. It is just related to which banmask is more efficient against flood bots.

Kurupt · Post by **Kurupt** » Thu Mar 17, 2005 5:48 am

same problem for me the bots start the ident with a lether folowed by numbers i made something like that if the ident start with 1 lether and 2 digits afther do ...

Code: Select all

  if {[regexp {^~{0,1}[[:lower:]]\d{2}.*$} [lindex [split $uhost @] 0]]} {

Galadhrim · Post by **Galadhrim** » Thu Mar 17, 2005 2:33 pm

We've had the same problems. The people seem to not like us having a Online Radio Station. I simply banned all their hostmask on the 2nd level: ie *!*@*.myisp.com Seemed to work. It was a temp ban so ppl from that ISP can join later on

Alchera · Post by **Alchera** » Thu Mar 17, 2005 6:10 pm

I use the following to take care of consonant nicks and numerical idents:

Code: Select all

# Use: .chanset #channel +/-spambot to enable/disable spambot.

set lock_modes "cmR"
set kmsg "Spam Bot: It's been nice knowing you.. well actually, it hasn't."

# Set this to the ban mask type you want,
#      0 - *!user@host.domain
#      1 - *!*user@host.domain
#      2 - *!*@host.domain
#      3 - *!*user@*.domain
#      4 - *!*@*.domain
#      5 - nick!user@host.domain
#      6 - nick!*user@host.domain
#      7 - nick!*@host.domain
#      8 - nick!*user@*.domain
#      9 - nick!*@*.domain
#     You can also specify a type of 10 to 19 which correspond to masks 0 to 9.
#     But if the host.domain is a;
#       hostname = Instead of using a * wildcard to replace portions of the
#                  host.domain, it replaces the numbers in the host.domain with
#                  a '?' (question mark) wildcard.
#       ip       = It will mask as normal, with no '?' (question mark)
#                  replacements as does hostname.
#     examples:
#       maskhostbytype MC_8!mc8@austin001.rr.com 3 => *!*mc8@*.rr.com
#       maskhostbytype MC_8!mc8@austin001.rr.com 13 => *!*mc8@austin???.rr.com
#     credits:
#       mIRC - using its numbering system for [type].
#     returns:
#       - <nick!user@host.domain> masked accordingly.
set ban_type 13

#########################################################################
##################### DO NOT EDIT BELOW THIS LINE!! #####################
#########################################################################

# Check to see if mc.more_tools script is loaded.
if {![info exists mc_moretools(loaded)] } {putloglev o * "*** Can't load Antispam Bot TCL -- mc.more_tools TCL required.";return}

setudef flag spambot
set unlockin 60

bind join - * join:spambot:check
proc join:spambot:check {nick uhost hand chan} {
    if {[isbotnick $nick] || [matchattr $hand f|f $chan] || ![botisop $chan] || ![channel get $chan spambot]} {return}
    regexp {^([^@]+)} $uhost _ ident
    if {[regexp -nocase {^[^aeiou_^-`]{4,}$} $nick] || [regexp {.*[0-9]} $ident] && ([string length $ident] > 5)} {
      putquick "MODE $chan +$::lock_modes" -next
      if {[regexp {([0-9]$){1}} $ident]} {set banmask \
        "*!*[string range $ident end end]*@*"
      } else {set banmask [maskhostbytype $nick!$uhost $::ban_type]}
      putquick "MODE $chan +b $banmask" -next
      putquick "KICK $chan $nick :$::kmsg"
      putquick "notice $nick :$::kmsg"
      putloglev c * "Anti Spam Bot: $nick has been kicked from $chan. Consonant Nick or Numerical Ident \[$nick!$ident\]"
      utimer $::unlockin [list chan:unlock $chan]
    }
}

##
# unlock
proc chan:unlock {chan} {
  set tmp [split [string trim [lindex [split [getchanmode $chan]] 0] "+"] ""]
  if {[regexp -all [join [split $::lock_modes ""] "|"] $tmp] == [string length $::lock_modes]} {
    putquick "MODE $chan -$::lock_modes" -next
  }
  return
}

### End ###

NOTE: More Tools v3.1 has to be loaded first.

For numerical nicks, just change:

Code: Select all

[regexp -nocase {^[^aeiou_^-`]{4,}$} $nick]