egghelp/eggheads community

Detecting Nickname Trojan

2007-06-04T23:21:22-04:00

## whatever you want to do - do it here

could someone please add a command to ban the spam bot nick for 1minute ?

Statistics: Posted by silverboy — Mon Jun 04, 2007 11:21 pm

Detecting Nickname Trojan

2006-12-30T07:40:28-04:00

Maybe he killed by his own wormlist
on this 3 days, i'm abble seen taht spam anymore, maybe they got effect from tsunami on taiwan too

BTW for this problem, i using Antidrone by sKy

Statistics: Posted by chandra Sha — Sat Dec 30, 2006 7:40 am

Detecting Nickname Trojan

2006-12-29T17:36:40-04:00

The source of that wormspreader is killed, there won't be a upgrade of that wormlist.

The author of that wormspreader is killed? what, electricity shock from his own PC or some other wormspreader-dude murdered him?

Statistics: Posted by Sir_Fz — Fri Dec 29, 2006 5:36 pm

Detecting Nickname Trojan

2006-12-29T17:04:40-04:00

It's a worm using a fixed nicklist.

Code:

set wormnicks "aldora alysia amalina amorita anita april ara aretina barbra becky bella bettina blenda briana bridget caitlin camille cara carla carmen catherin chelsea cindy clarissa damita danielle daria diana donna dora doris ebony eden eliza emily erika eve evelyn faith gale gilda gloria haley helga holly ida idona iris isabel ivana ivory janet jessica jewel joanna julie juliet kacey kali kara kassia katrin katrina kyle lady lara laura linda lisa lolita lynn maia mary melody mimi mona myra nadia naomi natalie nicole nora nova olga olivia pamela peggy queen rachel rae rita rosa ruby sharon silver ula uma valda valora vanessa vicky violet vivian wendy willa xandra xenia xylia zenia zilya zoe"if {[regexp {[1-3][0-9]$} $nick] && [regexp {[a-zA-Z]$} [string range $nick 0 end-2]] } {            if { ![string equal [lsearch -exact [split $wormnicks] [string range $nick 0 end-2]] -1]} {## whatever you want to do - do it here}}

The advantage is, it doesn't catch nicks like Dieter19 or Manuela22. The source of that wormspreader is killed, there won't be a upgrade of that wormlist.

Statistics: Posted by Garp — Fri Dec 29, 2006 5:04 pm

Detecting Nickname Trojan

2006-12-29T14:15:26-04:00

Code:

if {[regexp {^[A-Z].*?[0-9]{2}![A-Z]} $nick!$uhost]} {# the user matches your description}

Exactly, only the script I've wrote has more checks just to make sure (at least increase probability) that the user is indeed a drone.

It checks the following:
1) The ident is made up of alphabets only
2) First alphabet in nick is uppercase followed by at least 2 lowercase alphabets and ends with 2 integers.
3) Ident has at least 4 consecutive alphabets that are not vowels (excluding y)
4) Number of uppercase alphabets in ident is less than or equal to 6 (this is probably useless)

Statistics: Posted by Sir_Fz — Fri Dec 29, 2006 2:15 pm

Detecting Nickname Trojan

2006-12-29T12:06:41-04:00

Code:

if {[regexp {^[A-Z].*?[0-9]{2}![A-Z]} $nick!$uhost]} {# the user matches your description}

Statistics: Posted by user — Fri Dec 29, 2006 12:06 pm

Detecting Nickname Trojan

2006-12-28T20:12:00-04:00

this case, all of these bots have their idents resolved. that make them special for me.

Code:

set id [lindex [split [maskhost $uhost] "!"] 1]

This will return user@host and not user.
That's ok. they always using nick like this: Lara22, Kelly20, Sarah19. and with idents: User@host (not user@host), so there's 3 point that make the bots different with user (some hopefully ). It's:
1. First Character of bot nickname is Capital letter, ex: Lara22, Kelly20, etc.
2. First Character of bot ident is Capital letter, ext: User@host (not user@host).
3. Always there the 2number behind the botnick ex: Lara22, Kelly20.

Statistics: Posted by Reynaldo — Thu Dec 28, 2006 8:12 pm

Detecting Nickname Trojan

2006-12-28T07:51:22-04:00

If there is a ~ it will be removed, if not then it stays as it is. Some of these bots don't have their idents resolved.

Code:

set id [lindex [split [maskhost $uhost] "!"] 1]

This will return user@host and not user.

Statistics: Posted by Sir_Fz — Thu Dec 28, 2006 7:51 am

Detecting Nickname Trojan

2006-12-27T22:39:57-04:00

Code:

set id [string trimleft [lindex [split $u @] 0] ~]

Drones nick, they are using identd without ~ on it

Code:

set id [lindex [split [maskhost $uhost] "!"] 1]

Statistics: Posted by Reynaldo — Wed Dec 27, 2006 10:39 pm

Detecting Nickname Trojan

2006-12-26T23:07:11-04:00

You're lucky, I have written this sometime in the past and I found it on my HD:

Code:

bind join - * bitchkickproc bitchkick {n u h c} { set id [string trimleft [lindex [split $u @] 0] ~] if {[botisop $c] && [string is alpha $id] && [regexp {[A-Z][a-z]{2,}\d{2}$} $n nm] && [regexp {[^aeiou]{4}} [lindex [split $u @] 0] im] && [regexp -all {[A-Z]} $id] <= 6} {  putquick "KICK $c $n :Spammer bot detected. (*$nm!$im*) - Banned 120 minutes."  putquick "mode $c +b [set bm *!*@[lindex [split $u @] 1]]"  timer 120 [list pushmode $c -b $bm]  putlog "Detected \002$n\002!\002[lindex [split $u @] 0]\002 on \002$c\002." }}

Statistics: Posted by Sir_Fz — Tue Dec 26, 2006 11:07 pm

Detecting Nickname Trojan

2006-12-26T22:43:22-04:00

for detecting only 2 numbers of nickname

Code:

set check [regsub -all {[0-9]} $nick "" shortnick]if { $check <= 1 || $check >= 3 } {       # the nickname consits only 1 digit or more then 3 (so it can`t be that type for drone) }

This proc for detect Capital letter

Code:

proc isupper {letter} {set caps {A B C D E F G H IJ K L M N O P Q RS T U V W X Y Z}if {[lsearch -exact $caps $letter] > -1} {return 1} else {return 0}}

how to detect isupper fist character of nick and isupper first character of identd? or i can use this code?

Code:

if {[isupper [string index $nick 1]] && [isupper [string index $uhost 1]] } {

Statistics: Posted by Reynaldo — Tue Dec 26, 2006 10:43 pm

Detecting Nickname Trojan

2006-12-22T00:07:04-04:00

Try the Search function in future as there is almost always a solution already posted.

As an example:
antidrone.tcl against bots like agra55, valendra23, vicky75

Just use "drone" or "drone AND nick" for your search criterion and you should easily find what you're after.

Statistics: Posted by Alchera — Fri Dec 22, 2006 12:07 am

Detecting Nickname Trojan

2006-12-22T20:28:48-04:00

Camille27 (UmacCwm@220.??.???.??) has joined #chan

First character of nickname always using Capital letter and the end of nick always 2 number(s), and First character of Identd using Capital letter without ~ character and nick is not GUEST???. that's what i mean a Drone nick.

Statistics: Posted by Reynaldo — Thu Dec 21, 2006 11:11 pm

Detecting Nickname Trojan

2006-12-21T21:23:33-04:00

Translate it to pseudo or explain what a 'spam nick' is, then we might be able to help you.

Statistics: Posted by Sir_Fz — Thu Dec 21, 2006 9:23 pm

Detecting Nickname Trojan

2006-12-21T21:08:54-04:00

Code:

on *:join:#: {  if ($me !isop $chan) { halt }  if ( $right($nick,2) isnum 0-99 ) && ( $asc($left($nick,1)) isnum 65-90 ) && ( $asc($left($address,1)) isnum 65-90 ) && ( $left($nick,5) != Guest ) && ( $left($nick,3) != ERR ) && ( $right($nick,3) !isnum ) {      .kick $chan $nick Spam! }

The script i made for my mirc, and it works fine.
anyone can help me to translate in to tcl scripts?

Statistics: Posted by Reynaldo — Thu Dec 21, 2006 9:08 pm