Latest wave of spam

Willaim · Idler Joined: 27 Jun 2003 Posts: 323 Location: IRC

Thank you!

Willaim · Idler Joined: 27 Jun 2003 Posts: 323 Location: IRC

Anyone make any progress on this? I've added those DNSBL's and it seems EfnetRBL is taking care of 99% of the bots...

I want to try and get rid of all the spamfilters we have, since they're not helping except for the 1% getting through (one a day now?)

PingBad · Posted: Aug 16, 2009 2:21am Post subject:

latest link:

PingBad · Posted: Aug 16, 2009 3:10am Post subject:

Heh, the writer of this latest incarnation must be getting pretty damn stupid - right in the latest file is a list of every spamtext it's using (psyBNC-2.0.2-2\system\files\m.ax)

maddog906 · Lurker Joined: 08 Mar 2005 Posts: 164

after downloading the script that they are using,
NOW that the script can be downloaded,by almost everyone,
it can be mode by any one with a bit of irc scripting know how,
the main part of the program was done a good few years a go, with ircproxy,some one just added the mirc 6.21 (update version) and then some one else has added the psyBNC to it,just take time to read the programs and you will see it not all done by one person.
as PINGBAD and a few others thats taken the script apart,
the only way to stop it in the short run is,
get BOPM
NEOSTATS
or a good proxy scanning bot.
because the bot is scanning all know proxy sites
etc
aliveproxylist.blogspot.com
www.socksdaily.com
http://proxygod.com.com/
http://forum.my-proxy.com/?from=menu
http://www.xroxy.com/xorum/
http://www.proxy4free.com http://www.publicproxyservers.com/page1.html
http://www.anonymitychecker.com/page1.html
http://www.proxz.com/
http://www.multiproxy.org/anon_proxy.htm
http://www.samair.ru/proxy/
http://www.aliveproxy.com/us-proxy-list/
http://highanonymity.com/
http://proxy.mazafaka.ru/

i can sit here all day showing them,
it can be started and stoped at any time,
and can be run on a windows box so you can be hit any time at any day.
The only thing i like about this script is the proxy scanning ,it will help to kill off the bots that uses sockets 4 and 5 ports , kill them once you will kill them all for every.

well here is the proxy port list it has already ,
this is a start.
sockopen scan $+ $r(0,99999999999999) $1 9090
sockopen scan $+ $r(0,99999999999999) $1 80
sockopen scan $+ $r(0,99999999999999) $1 8080
sockopen scan $+ $r(0,99999999999999) $1 8118
sockopen scan $+ $r(0,99999999999999) $1 3129
sockopen scan $+ $r(0,99999999999999) $1 8089
sockopen scan $+ $r(0,99999999999999) $1 6649
sockopen scan $+ $r(0,99999999999999) $1 1111
sockopen scan $+ $r(0,99999999999999) $1 808
sockopen scan $+ $r(0,99999999999999) $1 8088
sockopen scan $+ $r(0,99999999999999) $1 707
sockopen scan $+ $r(0,99999999999999) $1 3128
sockopen scan $+ $r(0,99999999999999) $1 6588
sockopen scan $+ $r(0,99999999999999) $1 7212
sockopen scan $+ $r(0,99999999999999) $1 8888
sockopen scan $+ $r(0,99999999999999) $1 8000
sockopen scan $+ $r(0,99999999999999) $1 8008
sockopen scan $+ $r(0,99999999999999) $1 8001
sockopen scan $+ $r(0,99999999999999) $1 8081
sockopen scan $+ $r(0,99999999999999) $1 443
sockopen scan $+ $r(0,99999999999999) $1 8800
sockopen scan $+ $r(0,99999999999999) $1 444
sockopen scan $+ $r(0,99999999999999) $1 445
sockopen scan $+ $r(0,99999999999999) $1 553
sockopen scan $+ $r(0,99999999999999) $1 554
sockopen scan $+ $r(0,99999999999999) $1 8808
sockopen scan $+ $r(0,99999999999999) $1 81
sockopen scan $+ $r(0,99999999999999) $1 1337
sockopen scan $+ $r(0,99999999999999) $1 31337
sockopen s5chk $+ $r(0,9999999) $1 1080
sockopen s4chk $+ $r(0,9999999) $1 1080
sockopen s5chk $+ $r(0,9999999) $1 1025
sockopen s4chk $+ $r(0,9999999) $1 1025
sockopen s4chk $+ $r(0,9999999) $1 1337
sockopen s5chk $+ $r(0,9999999) $1 1337
sockopen s4chk $+ $r(0,9999999) $1 31337
sockopen s5chk $+ $r(0,9999999) $1 31337
sockopen s4chk $+ $r(0,9999999) $1 9050
sockopen s5chk $+ $r(0,9999999) $1 9050
sockopen s5chk $+ $r(0,9999999) $1 25552
sockopen s5chk $+ $r(0,9999999) $1 29991
sockopen s5chk $+ $r(0,9999999) $1 27771
sockopen s5chk $+ $r(0,9999999) $1 443
sockopen s5chk $+ $r(0,9999999) $1 444
sockopen s5chk $+ $r(0,9999999) $1 554
sockopen s5chk $+ $r(0,9999999) $1 553

this will kill off the lazy irc flood.
HAPPY ENDING.

Willaim · Idler Joined: 27 Jun 2003 Posts: 323 Location: IRC

Had one get through BOPM today:

-Aandreita__camara:#class- Noobs! h**p://www.mirrorcreator.com/files/9BJLF7DJ/psyBNC_1.rar_links
<Aandreita__camara> Pretty cool huh ? h**p://www.mirrorcreator.com/files/9BJLF7DJ/psyBNC_1.rar_links

(Links censored)

Jobe · Posted: Aug 17, 2009 7:27am Post subject:

Incognito · none Joined: 01 Aug 2009 Posts: 41

Trixar_za · Posted: Aug 17, 2009 1:07pm Post subject:

maddog906 · Lurker Joined: 08 Mar 2005 Posts: 164

hi all if you pm me i can give you a list of the ports i have collected

socks4 and socks5 i must have over 100 ports by now,

plus i am sure you are aware there a add-on to bopm so one bopm will scan the whole network,

but because i have a long list of proxy ports i still use a bopm per server,
well here the code this is for unrealirc.
/* Hybrid / Bahamut / Unreal (in HCN mode) */
connregex = "\\*\\*\\* Notice -- Client connecting.*: ([^ ]+) \$([^@]+)@([^\$]+)\\) \\[([0-9\\.]+)\\].*";

but please remember there are new proxy ports every day.

Trixar_za · Posted: Aug 17, 2009 3:55pm Post subject: Re: hi all if

maddog906 · Lurker Joined: 08 Mar 2005 Posts: 164

here is a quick fix but please look at it first,
spamfilter {
regex "http://[a-z0-9]+/[a-z0-9]+/[a-z0-9]+/[psyBNC_0-9]+\.(php|zip|rar|txt)";
target { channel; private; quit; };
action gline;
reason "Infected by Spammer";
};

spamfilter {
regex "http://[a-z0-9]+/[download.php?id=0-9]";
target { channel; private; quit; };
action gline;
reason "Infected by Spammer";
};

its for the below links as you can see its http://1/2/3/psybnc_number.rar

http://uploadmirrors.com/download/0ERWT4FL/psyBNC_1.rar
http://uploadmirrors.com/download/0UB8W5RD/psyBNC_2.rar
http://rapidshare.com/files/267916976/psyBNC.rar
http://qooy.com/files/VSJMOD7R/psyBNC.rar
http://qooy.com/files/0NBHWHXR/psyBNC_1.rar
http://www.share-online.biz/download.php?id=7A9ZKGOKYR0

and here is the code-x

/spamfilter add cpnNPqdat gline - Spammer http://[a-z0-9]+/[a-z0-9]+/[a-z0-9]+/[psyBNC_0-9]+\.(php|zip|rar|txt)

/spamfilter add cpnNPqdat gline - Spammer http://[a-z0-9]+/[download.php?id=0-9]

Trixar_za · Posted: Aug 17, 2009 4:10pm Post subject: Re: here is a quick fix

PingBad · Posted: Aug 18, 2009 2:38am Post subject: