Update: Check out this article on using Eggdrop and Blacktools to fight these bots.
I've been watching a channel get attacked by bot-nets, being flooded day after day, for about two weeks. The attacker is spamming nasty stuff for hours at a time, flooding the channel and sometimes flooding users with notices and versions. It's basically a DOS (denial of service) attack. The Ops are trying everything they can think of to end it each time it happens. They've bounced around setting channel mode +m, +i, +r, even +s and +p. They've tried manually banning host address. I just watched an Op start banning entire subnets – example: mode +b *!*@24.*.
There are simply too many clients in this bot-net to keep up.
One Op argued for banning all VPNs. I can tell you that this attacker is not only using VPNs – it's a bot-net of compromised machines. There are plenty of non-VPN ips including FQDLs. I'm wondering if that old mIRC script hack is responsible.
Their M.O. is pretty simple. They mass join with 5-10+ bots, deliver their payload, and exit quickly. Sometimes they change nicks between attacks (random), and come back in, again delivering their spam, changing nicks, and exiting. Rinse and Repeat. This makes it very hard for an Op to ban individual nicks, and we all know that typing out hundreds of address ban masks takes way too long. See below for some examples.
One way is to set channel mode +r (Undernet registered and logged in users only) and wait it out. Sure, you can set +m (moderated – +voice only can chat), but that kills the channel and doesn't stop the flooders – they can still be sending ctcps and notices to the users from inside and outside the channel. You can set mode +i (invite required to join the channel), though that keeps everyone out and any flooders already inside will keep going. With these bots, that is not really a problem, as they exit the channel quickly after delivering their spam payload. At least with mode +r anyone who really wants to come in certainly can, and the bots/drones can not. Note: unregistered users will not be able to talk in channel while's it's +r. They won't be kicked out, but can't talk. Since most people are chatting in private, this seems optimal.
These are not meant to be permanent modes for a public channel.
The easy answer: Set mode +i or +r and wait it out. Announce to your channel users they can register on Undernet and get a user name. Setting mode +r does not remove anyone currently in the channel – it only applies to new users entering the channel. They can script a login alias in about a minute – for mIRC:
/xlogin {
/msg X@channels.undernet.org login [username] [password]
/mode $me +x
}
Note: +x is optional if you want the Undernet Host mask, E.G. yournick!~yourident@username.users.undernet.org. You will still be logged in and flagged as Registered, and can enter and chat in +r channels.
(For non-mIRC users, or any client that doesn't allow scripting or aliases, etc, it's easy to create the /msg and /mode lines and store it in a text file, then copy and paste when needed. )
It's really that simple. If a channel is set to mode +r, type /xlogin, and join the channel. Note: you can't unset +x and clear your Undernet host mask. You need to reconnect to the server. Bummer.
Whether you use +i or +r, the bots will give up pretty quickly and things can go back to normal. Don't forget to unset +i or +r to check.
Sample Log Entries:
[11/13-05:06] * Joins #[channelname]: ymzsxz (~pkni@45.174.171.234)
[11/13-05:06] * Joins #[channelname]: juusu (~jcznt@108.161.57.241)
[11/13-05:06] * Joins #[channelname]: wjfqhma (~kbowd@171.241.93.232)
[11/13-05:06] * Parts #[channelname]: ymzsxz (~pkni@45.174.171.234) (You have a little dick of corpse , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !)
[11/13-05:06] * Parts #[channelname]: wjfqhma (~kbowd@171.241.93.232) (You have a little dick of corpse , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !)
[11/13-05:06] * Parts #[channelname]: juusu (~jcznt@108.161.57.241) (You have a little dick of corpse , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !)
[11/13-05:07] * Joins #[channelname]: ajnfkcv (~oxvk@181.129.176.172)
[11/13-05:07] * Joins #[channelname]: recquwx (~xtogt@176.192.16.226)
[11/13-05:07] * Joins #[channelname]: hvxrcfv (~mwd@103.95.40.169)
[11/13-05:07] * [op name] sets #[channelname] mode: +i
Nick and Ident Changing – notice the time stamps and IP addresses:
[10/13-15:46] * Joins #[channelname]: oysdqr (~funs@187.24.136.103)
[10/13-15:46] * Parts #[channelname]: oysdqr (~funs@187.24.136.103) (49,56You have a little penis of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !)
[10/13-16:30] * Joins #[channelname]: erjss (~hbbsh@187.24.136.103)
[10/13-16:30] * Parts #[channelname]: erjss (~hbbsh@187.24.136.103) ( You have a little penis of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !)
[10/13-16:46] * Joins #[channelname]: erjss (~hbbsh@187.24.136.103)
[10/13-16:46] * Parts #[channelname]: erjss (~hbbsh@187.24.136.103) ( You have a little penis of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !)
[10/13-16:47] * Joins #[channelname]: erjss (~hbbsh@187.24.136.103)
[10/13-16:47] * Parts #[channelname]: erjss (~hbbsh@187.24.136.103)
Notices:
05[10/3-09:04] -mokqod:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -offoyzt:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -ezmpmrp:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -jrkws:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -eioyeqg:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -jivlnb:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -xlyze:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -hexhjqc:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -mmqeuz:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -cxfbs:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -flwvjqq:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -evftkzq:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -inrvxg:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -xlyze:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -jivlnb:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -hexhjqc:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -mmqeuz:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -cxfbs:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -flwvjqq:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -evftkzq:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -inrvxg:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -xzvnt:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
05[10/3-09:04] -wswnvz:#[channelname]- You have a little dlck of corpses , You are a loser deviant , I will dismember you in pieces , I DISMEMBER you !
CTCP Floods. Here they are trying to flood me with VERSION:
04[9/12-06:21] [bwwdfq:#[channelname] VERSION]
01[9/12-06:21] -> -vapmo- [VERSION reply]: FBIScript 7Delta2.2 ©2021
04[9/12-06:21] [vapmo:#[channelname] VERSION]
01[9/12-06:21] -> -vapmo- [VERSION reply]: FBIScript 7Delta2.2 ©2021
04[9/12-06:21] [vapmo:#[channelname] VERSION]
01[9/12-06:21] -> -vbmjn- [VERSION reply]: FBIScript 7Delta2.2 ©2021
04[9/12-06:21] [vbmjn:#[channelname] VERSION]
01[9/12-06:21] -> -vbmjn- [VERSION reply]: FBIScript 7Delta2.2 ©2021
04[9/12-06:21] [vbmjn:#[channelname] VERSION]
01[9/12-06:21] -> -fccszws- [VERSION reply]: FBIScript 7Delta2.2 ©2021
04[9/12-06:21] [fccszws:#[channelname] VERSION]
01[9/12-06:21] -> -fccszws- [VERSION reply]: FBIScript 7Delta2.2 ©2021
04[9/12-06:21] [fccszws:#[channelname] VERSION]
01[9/12-06:21] -> -mqxelr- [VERSION reply]: FBIScript 7Delta2.2 ©2021
04[9/12-06:21] [mqxelr:#[channelname] VERSION]
01[9/12-06:21] -> -mqxelr- [VERSION reply]: FBIScript 7Delta2.2 ©2021
04[9/12-06:21] [mqxelr:#[channelname] VERSION]
01[9/12-06:21] -> -oicmvsb- [VERSION reply]: FBIScript 7Delta2.2 ©2021