| View previous topic :: View next topic |
| Author |
Message |
mm
Halfop
Joined: 01 Jul 2004
Posts: 78
|
 Posted: Sun Jun 12, 2005 11:46 am Post subject: flooders |
 |
|
Hi, i was wonderinf if someone has a script to ban these type of flooders
i8148 (~e9993@201.22.23.44)
h4053 (~g8767@66.78.67.34)
e9044(~k8765@24.23.56.67)
they usually use nicks with numbers and ident with numbers having "~", I'll appreciate it.
_________________
MM |
|
| Back to top |
|
 |
avilon
Halfop
Joined: 13 Jul 2004
Posts: 64
Location: Germany
|
| Posted: Sun Jun 12, 2005 12:47 pm Post subject: |
|
|
| Code: | bind join - "*" badident
proc badident {nick host hand chan} {
if {![isbotnick $nick] && [botisop $chan]} {
if {[regexp {^~[a-z]{1}[0-9]{2,5}$} [lindex [split $host @] 0]]} {
newchanban $chan *!*@[lindex [split $host @] 1] $::botnick "bad ident"
}
}
} |
|
|
| Back to top |
|
|
mm
Halfop
Joined: 01 Jul 2004
Posts: 78
|
| Posted: Sun Jun 12, 2005 3:06 pm Post subject: |
|
|
thanks avilon, this will ban if there is 1 number in ident? can we make it with the nick combination that if nick has 3+ numbers and ident has 3+numbers including ~ then detect and ban.. oh also i have noticed they don't have "vowels" in their nicks..
thanks again
_________________
MM |
|
| Back to top |
|
|
demond
Revered One
Joined: 12 Jun 2004
Posts: 3073
Location: San Francisco, CA
|
| Posted: Sun Jun 12, 2005 3:50 pm Post subject: |
|
|
| Code: |
scan $host {%[^@]} ident
set nick_digits [llength [regexp -all -inline -- {[0-9]} $nick]]
set ident_digits [llength [regexp -all -inline -- {[0-9]} $ident]]
set no_vowels [regexp {[aeiouy]} $nick]
if {$no_vowels && $nick_digits >= 3 && $ident_digits >= 3} {
# ban it
}
|
|
|
| Back to top |
|
|
mm
Halfop
Joined: 01 Jul 2004
Posts: 78
|
| Posted: Sun Jun 12, 2005 3:58 pm Post subject: |
|
|
demond, thank you so much. you are the best
_________________
MM |
|
| Back to top |
|
|
demond
Revered One
Joined: 12 Jun 2004
Posts: 3073
Location: San Francisco, CA
|
| Posted: Sun Jun 12, 2005 4:17 pm Post subject: |
|
|
oops... maybe I'm not  correction:
| Code: |
scan $host {%[^@]} ident
set nick_digits [llength [regexp -all -inline -- {[0-9]} $nick]]
set ident_digits [llength [regexp -all -inline -- {[0-9]} $ident]]
set vowels [regexp {[aeiouy]} $nick]
if {!$vowels && $nick_digits >= 3 && $ident_digits >= 3} {
# ban it
}
|
|
|
| Back to top |
|
|
mm
Halfop
Joined: 01 Jul 2004
Posts: 78
|
| Posted: Sun Jun 12, 2005 6:07 pm Post subject: |
|
|
Thank you demond, you are my hero. one more request, is there anyway to check the random nick and idents like
wxwSjIu (~ovjughtx@p83.129.2.63)
JiWqPlO (~bsqrnooc@23.111.23.34)
cPMlosL (~npyjqfgv@80.217.88.97)
yjptqGn (~ngohrhvp@83.129.2.63)
adrsnxu (~ydabjylt@80.217.88.97)
and sometime they use
i556565y (~zlebots@24.3.46.214)
u133194x (~ljfhooqv@213.163.29.5
f639374j (~chvueri@212.103.191.71)
thanks again
_________________
MM |
|
| Back to top |
|
|
demond
Revered One
Joined: 12 Jun 2004
Posts: 3073
Location: San Francisco, CA
|
| Posted: Sun Jun 12, 2005 8:50 pm Post subject: |
|
|
as slennox noted in another thread, detecting drone nicks is rather academic problem - in practice, a clever flooder will beat any detection script by changing the nick/ident generation algorithm as needed; implementing an effective (semi)random nick/ident detector is not easy, and it will never be 100% accurate (i.e. will be giving false positives on some really weird nicks of innocent lamers)
nevertheless, a proc of mine (which is feeded with $nick$ident string) I find useful enough to detect suspected spammers works by assigning a "spam" score based on the frequency of particular digit-vowel-consonant-punctuation character combinations:
| Code: |
proc sb:score {str} {
set score 0
set vowel "aeiouy"
set cnant "bcdfghjklmnpqrstvwxz"
set other "{}\\\[\\\]-_^`|\\\\"
set digit "0123456789"
set str [string tolower $str]
incr score [llength [regexp -all -inline \[$vowel\]{3,} $str]] ;# 3 and more adjacent vowels
incr score [llength [regexp -all -inline \[$cnant\]{3,} $str]] ;# 3 and more adjacent consonants
incr score [llength [regexp -all -inline \[$other\]{2,} $str]] ;# 2 and more adjacent punctuation chars
incr score [llength [regexp -all -inline \[$digit\]{2,} $str]] ;# 2 and more adjacent digits
incr score [llength [regexp -all -inline \[$vowel$other\]{4,} $str]] ;# 4 or more adjacent vowel/punctuation chars
incr score [llength [regexp -all -inline \[$cnant$other\]{4,} $str]] ;# 4 or more adjacent consonant/punctuation chars
incr score [llength [regexp -all -inline \[$vowel$digit\]{4,} $str]] ;# 4 or more adjacent vowel/digits
incr score [llength [regexp -all -inline \[$cnant$digit\]{4,} $str]] ;# 4 or more adjacent consonant/digits
incr score [llength [regexp -all -inline \[$other$digit\]{3,} $str]] ;# 3 or more adjacent puncuation/digits
incr score $score ;# double the score
}
|
the higher the score, the more likely that user is actually a drone/spam/floodbot with (semi)randomly generated nick/ident; of course, you need to experiment what score threshold will work for you - I use 18
however, if your flood problem is caused by rapidly joining drones, you better use some ready-made protection script, detecting the join flood rather than nick/ident patterns |
|
| Back to top |
|
|
mm
Halfop
Joined: 01 Jul 2004
Posts: 78
|
| Posted: Sun Jun 12, 2005 9:11 pm Post subject: |
|
|
thanks again demond, your procedure will be perfect, if some innocent will get hit then those innocent will be lame innocents. But how do i set this procedure with your origional codes?
thanks again.
_________________
MM |
|
| Back to top |
|
|
demond
Revered One
Joined: 12 Jun 2004
Posts: 3073
Location: San Francisco, CA
|
| Posted: Sun Jun 12, 2005 9:28 pm Post subject: |
|
|
| Code: |
set threshold 18
bind join - * check_drone
proc check_drone {nick uhost hand chan} {
if [matchattr $hand of|of $chan] return ;# it's an op/friend, skip the check
scan $uhost {%[^@]} ident ;# obtain ident
if {[sb:score $nick!$ident] > $::threshold} {
newchanban $chan [maskhost $nick!$uhost] checker "possible drone"
putkick $chan $nick "possible drone; if you are not, contact mm for unban"
}
}
|
|
|
| Back to top |
|
|
demond
Revered One
Joined: 12 Jun 2004
Posts: 3073
Location: San Francisco, CA
|
| Posted: Sun Jun 12, 2005 9:36 pm Post subject: |
|
|
or, if you wish to ban by host rather than by uhost mask:
| Code: |
set threshold 18
bind join - * check_drone
proc check_drone {nick uhost hand chan} {
if [matchattr $hand of|of $chan] return ;# it's an op/friend, skip the check
scan $uhost {%[^@]@%s} ident host ;# obtain ident & host
if {[sb:score $nick!$ident] > $::threshold} {
newchanban $chan *!*@$host checker "possible drone"
putkick $chan $nick "possible drone; if you are not, contact mm for unban"
}
}
|
|
|
| Back to top |
|
|
mm
Halfop
Joined: 01 Jul 2004
Posts: 78
|
| Posted: Sun Jun 12, 2005 10:19 pm Post subject: |
|
|
Thank you millions, God bless you.
_________________
MM |
|
| Back to top |
|
|
mm
Halfop
Joined: 01 Jul 2004
Posts: 78
|
| Posted: Sun Jun 12, 2005 10:35 pm Post subject: |
|
|
sorry to bug you again, do you think i should combine your these codes
| Code: | scan $host {%[^@]} ident
set nick_digits [llength [regexp -all -inline -- {[0-9]} $nick]]
set ident_digits [llength [regexp -all -inline -- {[0-9]} $ident]]
set vowels [regexp {[aeiouy]} $nick]
if {!$vowels && $nick_digits >= 3 && $ident_digits >= 3} {
# ban it
} |
with the new ones or new ones will cover everything?
Thanks again
_________________
MM |
|
| Back to top |
|
|
demond
Revered One
Joined: 12 Jun 2004
Posts: 3073
Location: San Francisco, CA
|
| Posted: Sun Jun 12, 2005 11:04 pm Post subject: |
|
|
if you use [sb:score], there's no need of the first one
however, don't forget to experiment with the threshold first: on the party line, type .tcl sb:score variousnickidentcombinationshere |
|
| Back to top |
|
|
mm
Halfop
Joined: 01 Jul 2004
Posts: 78
|
| Posted: Sun Jun 12, 2005 11:10 pm Post subject: |
|
|
OK, Thank you very much. I'll let you the results.
regards
_________________
MM |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
