Getting really tired of Supernets spambots reddit / irc ---------------------------------------------------------------------- localtoast · 2018-02-08 23:20 They're every network, on every channel, with garish messages, pinging everyone, and using what I assume is a botnet, so you can't *-Line them. They seem to think their (lack of) rules apply everywhere else. ---------------------------------------------------------------------- Techman- · 2018-02-08 23:37 While Supernets do hold their own series of troll events (April Floods Day, Floodsmas, etc.) this isn't them. It's a Tor user known as "Little Marco" who is obsessed with people like Chrono and has also spammed my network in [an attempt](https://www.reddit.com/r/Techtronix /comments/7upczk/psa_recent_irc_network_spam/) to get me banned on a lot of IRCs. Recently, Marco's spam started getting filtered so he switched to Unicode spam. Depending on what IRCd you use, there are various ways to combat it outside of a spam filter. Are you running a network? ---------------------------------------------------------------------- localtoast · 2018-02-08 23:50 it's not Unicode spam, but rather usually mIRC colour code spam or /pol/-wannabe shitposting; all stating to join their IRC channel on Supernets. they never mention you. I don't run a network, but I'm on 5 and they've spammed all but one. ---------------------------------------------------------------------- ZdrytchX · 2018-02-09 01:36 I'm currently connected to: -Rizon, Freenode, UniIRC, Quakenet, Espernet, and Breederhive. All of the spam I've received relating to advertising IRC servers were all related to Supernet.org, and more or less specifically, #superbowl I received PM spam from two bots on freenode. I can't remember if the other bot was also in #tremulous but one definitely was. The bot spammed with people's usernames with multi-coloured syntaxed text, some of which were hidden unless highlighted. Recently this morning 2 hours ago (aroudn the same time of the OP's post) another bot found UniIRC (a rather empty service hosted by my university that can also communicate with other local universities; other IRC servers are blocked by my university's internet service) but left on its own after highlighting everyone. It only said two messages, the first one was rather strange compared to the one that affected freenode under the alias kektrain. I've probably seen 5 other or so unique usernames mentioned on freenode. ---------------------------------------------------------------------- Cobra_Fast · 2018-02-09 06:02 It's gotten bad in the past few weeks. I never even noticed it before but I had people tell me it's been going on for months. Anyhow, what really surprised me was when the bot showed up on a small server not advertised anywhere that averages around 5 users a day. This leads me to believe he's actually scanning the internet for open 6667 ports or something. I really hope someone figures out a solution to this at some point. If he's really using TOR there's probably not much we can do other than datamine all exit node IPs and ban them :/ ---------------------------------------------------------------------- Saber_UK · 2018-02-09 10:44 If you are a network operator who uses InspIRCd and wants to block this spam then then you can load m_securelist (which ships with InspIRCd), and then load m_blockhighlight (which is installable from inspircd-extras), and then set +V on all channels to deal with this. You can also try adding `blockcolor:v` to `` in your config, load m_blockcolor, and set +c on all channels if you're not worried about banning colour codes globally for unprivileged users being considered a bit draconian. If you have any IP addresses for this kiddiot you can also submit them to [DroneBL](http://dronebl.org) to get them banned from all networks using that DNSBL. Also, I think its worth noting that 99.99% of IRC spambots only work on plaintext port 6667 and if you disable connections on that port most bots will be broken. Its not really necessary to listen on 6667 anymore imo now most clients support connecting through TLS on port 6697. ---------------------------------------------------------------------- Saber_UK · 2018-02-09 10:48 >If he's really using TOR there's probably not much we can do other than datamine all exit node IPs and ban them :/ If they were using Tor you could could use an exit node DNSBL to block them but I think they're just a typical kiddiot who has bought access to some infected hosts. ---------------------------------------------------------------------- localtoast · 2018-02-09 14:38 I'm pretty sure all exit nodes either state themselves to be an exit node, or are published in a directory? I think that the spammers might just be using a botnet instead, considering the residential RDNS I sometimes see. ---------------------------------------------------------------------- [deleted] · 2018-02-15 03:57 [removed] ---------------------------------------------------------------------- [deleted] · 2018-02-15 03:58 [deleted] ---------------------------------------------------------------------- [deleted] · 2018-02-15 03:59 [removed] ---------------------------------------------------------------------- [deleted] · 2018-02-15 04:02 [removed] ---------------------------------------------------------------------- christopherdorner79 · 2018-02-15 04:12 I just spoke with the guy responsible for the spamming in #5000 on supernets and he agreed to take my network off the list. I don't think you'll get him to stop spamming the entirety of IRC but you can at least get him to leave your network alone. ---------------------------------------------------------------------- [deleted] · 2018-02-15 04:17 [removed] ---------------------------------------------------------------------- [deleted] · 2018-02-15 04:17 [removed] ---------------------------------------------------------------------- christopherdorner79 · 2018-02-15 04:26 the giants are going to the superbowl ---------------------------------------------------------------------- [deleted] · 2018-02-15 08:04 [removed] ---------------------------------------------------------------------- [deleted] · 2018-02-15 10:48 [deleted] ---------------------------------------------------------------------- prawnsalad · 2018-02-15 11:17 Comment removed as it's supernets enticing you to a channel that auto floods you, causing some clients to lock up and crash. ---------------------------------------------------------------------- [deleted] · 2018-02-16 22:12 [removed] ---------------------------------------------------------------------- [deleted] · 2018-02-16 22:22 [removed] ---------------------------------------------------------------------- iamfoxy420 · 2023-07-06 16:41 Here it is 5 years later and they are still spamming networks. I guess some people never grow up. ---------------------------------------------------------------------- TiagoPaolini · 2023-07-06 21:45 I am just going to quote someone from the network where I am on: > Seeing IRC spambots in 2023 is a trip. It's feels like they're ancient robots programmed by their creators, performing their old function for eternity, long after their creators are gone. ---------------------------------------------------------------------- DarkCisum · 2023-07-06 22:19 Yeah, seeing them over here as well... 🙄 ---------------------------------------------------------------------- Kastein1986 · 2023-07-07 06:01 Same. On a very small network I help run for like a total of two dozen users. I'm so fucking tired of this. Since we have a fairly stable user base I literally just set all channels +s, created a new public channel no one goes in, set the topic to tell people where to *actually* join, and wrote a script to kline anyone who highlights me in that channel. I can't really recommend this method since it's a bit brute force and breaks /list, but it'll work till I can find something better. ---------------------------------------------------------------------- samination · 2023-07-07 08:05 Did he follow through, or did the start spamming your network again? :P ---------------------------------------------------------------------- toba · 2023-07-07 23:46 I have literally a thousand PRIVMSG windows where they went completely buck-wild on a pretty much idle network I've been idling for over a decade. I haven't seen them bulk PRIVMSG spam before just driveby highlights in channels. This is a new low. Whoever does this needs to get a life. It's still the same old tired spam shit saying your network sucks etc, join our super bowl chat on not-so-super nets. This is more griefing than spam at this point ---------------------------------------------------------------------- iamfoxy420 · 2023-07-08 16:42 Have you tried setting up spam filters for it? also, what ircd do you use? UnrealIRCD has some good suggestions on how to combat spam bots. https://forums.unrealircd.org/viewtopic.php?t=9318 ---------------------------------------------------------------------- Kastein1986 · 2023-07-08 17:33 Unfortunately we're still running an ancient version of ultimateircd but yes we're looking at changing that ASAP. ---------------------------------------------------------------------- More-Event2537 · 2023-07-12 13:54 Ditto. Tiny quasi-private server, only known to a couple friends who've been there 20+ years. Utterly without reward is what I'm saying. Timed to US 4th of July weekend, so matches the event pattern. Similarly I wrote a quick bot to do much the same with a honeypot public channel. Slamming IRC servers in 2023 isn't impressive (or "black hat" as [this repository I suspect is responsible](https://github.com/acidvegas/efknockr/) claims). It's just fucking tacky. You hassled two old devs and a retiree. Congrats. I'm [this periodically too](https://github.com/internet-relay- chat/IRCP) to see if it's some lame "exposure" attempt. ---------------------------------------------------------------------- Electronic_Video5012 · 2023-07-27 10:45 Well it's still going on 5 years later on a small network that isn't even posted somewhere. ---------------------------------------------------------------------- Electronic_Video5012 · 2023-07-27 10:45 They do connect on both these ports now though. ---------------------------------------------------------------------- Cobra_Fast · 2023-07-27 11:25 DroneBL works. ---------------------------------------------------------------------- Berserkir-Wolf · 2023-10-03 03:46 We started getting them within the last few months, on a private IRC server. Just annoying. A fair few of the people in the server aren't even in the US, so it's even more annoying getting spammed with malarkey about the old orange president. ---------------------------------------------------------------------- sysfu · 2023-10-03 20:53 [cryptostorm.is](https://cryptostorm.is) IRC server just got hit today. Blasting song lyrics in DMs.