How to remove [XP-*] bots?

sharstine · none Joined: 07 Jul 2004 Posts: 48

Hi there,

A user recently visited our network and brought about 200 bots with him. I have no history on the bots, and I am looking for a way to get rid of them.

All of the botnames begin with [XP-*]. Here are a couple examples:

[XP-42985]
[XP-43019]
[XP-29928]

All of the bots have a different ident and hostname (they are connected through proxies), which makes banning them impossible from what I can see. When you issue /kill's, they simply reconnect.

They each have "AlShaLa7y BoT wWw.AlShaLa7y.TK " as their actual name.

Example: [XP-42985] is yesuto@211.106.228.190 * AlShaLa7y BoT wWw.AlShaLa7y.TK

I visited this website, and it was very useless for me. I actually spoke with the user who has the bots connected to our network, but neither one of us can understand each other. He speaks Arabic, and I've been on with him all day about this.

Any advice would be helpful. We use Ultimate3.0.1 in conjunction with anope1.7.10.

Thank you.

PingBad · Posted: Jul 24, 2005 10:57pm Post subject:

try global klines. Eventually, you'll ban off their proxies, thus the bots couldn't connect.

Willaim · Idler Joined: 27 Jun 2003 Posts: 321 Location: IRC

You could run IRC-Defender and set the level lower, it might pick up their weird idents and nicknames...

FiXato · none Joined: 31 Mar 2004 Posts: 41

or try an SQLine for [XP*]*

dotslasher · Newbie Joined: 03 Apr 2004 Posts: 81 Location: Belgium

or a real name ban against "AlShaLa7y BoT wWw.AlShaLa7y.TK"

DeadNotBuried · none Joined: 01 Mar 2004 Posts: 43

SecureServ from NeoStats has had definitions in for a while now which will detect and ban those bots, if you sign up for an account to get the updated definition files