egghelp/eggheads community

autoupdate botnet (all files)

2004-09-26T22:20:41-04:00

I agree but we're not dealing with intelligence here LOL

Statistics: Posted by Alchera — Sun Sep 26, 2004 10:20 pm

autoupdate botnet (all files)

2004-09-26T22:01:12-04:00

well, you might have a point here... still, IMHO it's much easier (and much more practised, I'd imagine) using windrones for masspam than writing/modifying tcl scripts and setting up eggdrops - and quite more effective, since you can't really ban/kline thousands of infected hosts

Statistics: Posted by demond — Sun Sep 26, 2004 10:01 pm

autoupdate botnet (all files)

2004-09-26T21:44:07-04:00

demond, I use DALnet and if you also do you'd know what these "petty" little individuals get up to and to make it worse they are getting access to shells (sharing) and setting up eggdrops which, up until recently they couldn't because of financial restraints etc etc and eggdrop does it so much better than mIRC.

Statistics: Posted by Alchera — Sun Sep 26, 2004 9:44 pm

autoupdate botnet (all files)

2004-09-26T21:26:37-04:00

PS: Anyone getting hold of such a script will use it for the exact opposite intention. It just makes spamming channels so much easier.

nothing could be further from truth - unless by "anyone" you mean those who will modify the script to actually spam instead of scanning for spam - and I believe those would be very few, petty individuals - as opposed to all others who will use it on its intended purpose

Statistics: Posted by demond — Sun Sep 26, 2004 9:26 pm

autoupdate botnet (all files)

2004-09-26T21:26:03-04:00

Haha, okay I will implement some of these. However, adding all of these would really piss aHa badly.

Statistics: Posted by awyeah — Sun Sep 26, 2004 9:26 pm

autoupdate botnet (all files)

2004-09-26T21:23:24-04:00

Here's the full list:

*!*@*.straynet.com
*!*@*.azcappy.com
*!*starship@*
*!*@*.inactive.org
*!*@*.faint.org
*!*@high-explosives.com
*!*@laggin.com
*!*@dalnet-rox.org
*!*charliem@*

And enjoy peace and quiet from aHa and his stupid ideas forever!

Statistics: Posted by Alchera — Sun Sep 26, 2004 9:23 pm

autoupdate botnet (all files)

2004-09-26T21:18:29-04:00

Yes, but all aren't using the same vhost are they. The idents are common throughout the network so there akicked on almost every channel, heh.

Plus one thing, the bots have girly nicks with letters in the nicks replaced by ], [, }, or { somewhere, which make them more easier to spot.

Statistics: Posted by awyeah — Sun Sep 26, 2004 9:18 pm

autoupdate botnet (all files)

2004-09-26T21:14:15-04:00

This stops almost all of those cyclers: *!*@dalnet-rox.org

PS: It doesn't "rox" me one little bit.

Statistics: Posted by Alchera — Sun Sep 26, 2004 9:14 pm

autoupdate botnet (all files)

2004-09-26T20:47:09-04:00

Yes you can, but spambuster's bots do not cycle fast, they have a delay, which makes them hard to detect.

On DALnet just add: *!starship@*, *!charliem@*, *!massads@* to chanserv's akick. These are a few ident's which I remember are used by 'aHa' and his massads bots.

Yes it can be used the other way around, but I don't think it has the ability to message and spam only if modified. It just retreive spam messages, paste them on a specific massads channel or to specific opers or kline the host themself if they are opered.

Statistics: Posted by awyeah — Sun Sep 26, 2004 8:47 pm

autoupdate botnet (all files)

2004-09-26T19:30:41-04:00

awyeah does that mean myself and every other channel founder will have to add yet more "sticky" bans to stop those annoying cycling things? I have managed to block every single one of them on DALnet so far.

PS: Anyone getting hold of such a script will use it for the exact opposite intention. It just makes spamming channels so much easier.

Statistics: Posted by Alchera — Sun Sep 26, 2004 7:30 pm

autoupdate botnet (all files)

2004-09-26T13:39:43-04:00

...and that channel list gets updated every hour

Statistics: Posted by demond — Sun Sep 26, 2004 1:39 pm

autoupdate botnet (all files)

2004-09-26T12:15:00-04:00

awyeah, both

actually, the channel roaming is implemented by picking random channels with a configurable minimum number of users from a list which is populated by doing /list on connect; whois'ing on join has another, statistical purpose - as you might have seen already, spambuster generates (on-the-fly) spam stats webpage by channel, server and host/domain

Statistics: Posted by demond — Sun Sep 26, 2004 12:15 pm

autoupdate botnet (all files)

2004-09-26T08:12:22-04:00

*demond* I was trying to make a similar yet simpler script like spambuster for IRCOps to catch and kill spammers throughout the network

I only want to ask, how do you make the bot join and part random channels? on the network, Do you generate a /list of channels on the network, save it to an array or list? And then make the bot pick a random one and join. Or by whois'ing each user on a channel then joining each channel every user is on, something like that?

Statistics: Posted by awyeah — Sun Sep 26, 2004 8:12 am

autoupdate botnet (all files)

2004-09-18T20:33:21-04:00

mm yes, but there's also description in english for each and every single option; anyway, contact me online if you need more information

Statistics: Posted by demond — Sat Sep 18, 2004 8:33 pm

autoupdate botnet (all files)

2004-09-16T21:27:01-04:00

Hi demond, yes but more than 50% document is not in english, that's why i had asked.

thanks

Statistics: Posted by mm — Thu Sep 16, 2004 9:27 pm