flooders

[mm]

Hi, i was wonderinf if someone has a script to ban these type of flooders

i8148 (~e9993@201.22.23.44)
h4053 (~g8767@66.78.67.34)
e9044(~k8765@24.23.56.67)

they usually use nicks with numbers and ident with numbers having "~", I'll appreciate it.

[avilon]

Code: Select all

bind join - "*" badident

proc badident {nick host hand chan} {
   if {![isbotnick $nick] && [botisop $chan]} {
    if {[regexp {^~[a-z]{1}[0-9]{2,5}$} [lindex [split $host @] 0]]} {
      newchanban $chan *!*@[lindex [split $host @] 1] $::botnick "bad ident"
      }
   }
} 

[mm]

thanks avilon, this will ban if there is 1 number in ident? can we make it with the nick combination that if nick has 3+ numbers and ident has 3+numbers including ~ then detect and ban.. oh also i have noticed they don't have "vowels" in their nicks..


thanks again

[demond]

Code: Select all

scan $host {%[^@]} ident
set nick_digits [llength [regexp -all -inline -- {[0-9]} $nick]]
set ident_digits [llength [regexp -all -inline -- {[0-9]} $ident]]
set no_vowels [regexp {[aeiouy]} $nick]
if {$no_vowels && $nick_digits >= 3 && $ident_digits >= 3} {
  # ban it
}

[mm]

demond, thank you so much. you are the best

[demond]

oops... maybe I'm not correction:

Code: Select all

scan $host {%[^@]} ident
set nick_digits [llength [regexp -all -inline -- {[0-9]} $nick]]
set ident_digits [llength [regexp -all -inline -- {[0-9]} $ident]]
set vowels [regexp {[aeiouy]} $nick]
if {!$vowels && $nick_digits >= 3 && $ident_digits >= 3} {
  # ban it
}

[mm]

Thank you demond, you are my hero. one more request, is there anyway to check the random nick and idents like

wxwSjIu (~ovjughtx@p83.129.2.63)
JiWqPlO (~bsqrnooc@23.111.23.34)
cPMlosL (~npyjqfgv@80.217.88.97)
yjptqGn (~ngohrhvp@83.129.2.63)
adrsnxu (~ydabjylt@80.217.88.97)

and sometime they use

i556565y (~zlebots@24.3.46.214)
u133194x (~ljfhooqv@213.163.29.58)
f639374j (~chvueri@212.103.191.71)

thanks again

[demond]

as slennox noted in another thread, detecting drone nicks is rather academic problem - in practice, a clever flooder will beat any detection script by changing the nick/ident generation algorithm as needed; implementing an effective (semi)random nick/ident detector is not easy, and it will never be 100% accurate (i.e. will be giving false positives on some really weird nicks of innocent lamers)

nevertheless, a proc of mine (which is feeded with $nick$ident string) I find useful enough to detect suspected spammers works by assigning a "spam" score based on the frequency of particular digit-vowel-consonant-punctuation character combinations:

Code: Select all

proc sb:score {str} {
	set score 0
	set vowel "aeiouy"
	set cnant "bcdfghjklmnpqrstvwxz"
	set other "{}\\\[\\\]-_^`|\\\\"
	set digit "0123456789"
	set str [string tolower $str]
	incr score [llength [regexp -all -inline \[$vowel\]{3,} $str]] ;# 3 and more adjacent vowels
	incr score [llength [regexp -all -inline \[$cnant\]{3,} $str]] ;# 3 and more adjacent consonants
	incr score [llength [regexp -all -inline \[$other\]{2,} $str]] ;# 2 and more adjacent punctuation chars
	incr score [llength [regexp -all -inline \[$digit\]{2,} $str]] ;# 2 and more adjacent digits
	incr score [llength [regexp -all -inline \[$vowel$other\]{4,} $str]] ;# 4 or more adjacent vowel/punctuation chars
	incr score [llength [regexp -all -inline \[$cnant$other\]{4,} $str]] ;# 4 or more adjacent consonant/punctuation chars
	incr score [llength [regexp -all -inline \[$vowel$digit\]{4,} $str]] ;# 4 or more adjacent vowel/digits
	incr score [llength [regexp -all -inline \[$cnant$digit\]{4,} $str]] ;# 4 or more adjacent consonant/digits
	incr score [llength [regexp -all -inline \[$other$digit\]{3,} $str]] ;# 3 or more adjacent puncuation/digits
	incr score $score ;# double the score
}

the higher the score, the more likely that user is actually a drone/spam/floodbot with (semi)randomly generated nick/ident; of course, you need to experiment what score threshold will work for you - I use 18

however, if your flood problem is caused by rapidly joining drones, you better use some ready-made protection script, detecting the join flood rather than nick/ident patterns

[mm]

thanks again demond, your procedure will be perfect, if some innocent will get hit then those innocent will be lame innocents. But how do i set this procedure with your origional codes?

thanks again.

[demond]

Code: Select all

set threshold 18
bind join - * check_drone
proc check_drone {nick uhost hand chan} {
  if [matchattr $hand of|of $chan] return ;# it's an op/friend, skip the check
  scan $uhost {%[^@]} ident ;# obtain ident
  if {[sb:score $nick!$ident] > $::threshold} {
    newchanban $chan [maskhost $nick!$uhost] checker "possible drone"
    putkick $chan $nick "possible drone; if you are not, contact mm for unban"
  }
}

[demond]

or, if you wish to ban by host rather than by uhost mask:

Code: Select all

set threshold 18
bind join - * check_drone
proc check_drone {nick uhost hand chan} {
  if [matchattr $hand of|of $chan] return ;# it's an op/friend, skip the check
  scan $uhost {%[^@]@%s} ident host ;# obtain ident & host
  if {[sb:score $nick!$ident] > $::threshold} {
    newchanban $chan *!*@$host checker "possible drone"
    putkick $chan $nick "possible drone; if you are not, contact mm for unban"
  }
} 

[mm]

Thank you millions, God bless you.

[mm]

sorry to bug you again, do you think i should combine your these codes

Code: Select all

scan $host {%[^@]} ident 
set nick_digits [llength [regexp -all -inline -- {[0-9]} $nick]] 
set ident_digits [llength [regexp -all -inline -- {[0-9]} $ident]] 
set vowels [regexp {[aeiouy]} $nick] 
if {!$vowels && $nick_digits >= 3 && $ident_digits >= 3} { 
  # ban it 
} 

with the new ones or new ones will cover everything?

Thanks again

[demond]

if you use [sb:score], there's no need of the first one

however, don't forget to experiment with the threshold first: on the party line, type .tcl sb:score variousnickidentcombinationshere

[mm]

OK, Thank you very much. I'll let you the results.

regards