IRC spam advertising ircd.chat reddit / irc ---------------------------------------------------------------------- thoughtform666 · 2023-04-22 16:15 Channels I'm in on EFNET and a few others have been getting spammed advertising [ircd.chat](https://ircd.chat) I fired up a box and was unable to connect. Does this network even exist? Anyone have any information on the spammer(s)? ---------------------------------------------------------------------- deepend_tilde · 2023-04-22 16:24 Was wondering the same thing. ---------------------------------------------------------------------- crimsaq · 2023-04-22 18:20 They've shown up on my network twice this month. Annoying. You have to connect to that network using the port they specify. Did it just to see wtf it was about. ---------------------------------------------------------------------- annacrontab · 2023-04-22 18:43 These must be some serious spammers, my server is for a private hobby and they hit me yesterday. Got so annoying I ended up just closing port 6667 since it was from a ton of different IPs. Apr 21 08:50:06 »» *** QUIT: Client exiting: KINGKONG!user@38.60.217.249 (38.60.217.249) [Connection closed] Apr 21 08:55:02 »» *** CONNECT: Client connecting on port 6667 (class main): KINGKONG!user@38.60.221.244 (38.60.221.244) [WE OUT HERE] Apr 21 08:55:16 »» *** QUIT: Client exiting: KINGKONG!user@38.60.221.244 (38.60.221.244) [Connection closed] Apr 21 08:59:19 »» *** CONNECT: Client connecting on port 6667 (class main): KINGKONG!user@38.60.221.188 (38.60.221.188) [WE OUT HERE] Apr 21 08:59:25 »» *** QUIT: Client exiting: KINGKONG!user@38.60.221.188 (38.60.221.188) [Connection closed] Apr 21 09:01:03 »» *** CONNECT: Client connecting on port 6667 (class main): KINGKONG!user@38.54.29.174 (38.54.29.174) [WE OUT HERE] Apr 21 09:02:05 »» *** QUIT: Client exiting: KINGKONG!user@38.54.29.174 (38.54.29.174) [Connection closed] Apr 21 09:05:05 »» *** CONNECT: Client connecting on port 6667 (class main): KINGKONG!user@38.54.71.74 (38.54.71.74) [WE OUT HERE] Apr 21 09:05:17 »» *** CONNECT: Client connecting on port 6667 (class main): KINGKONG_!user@38.60.217.249 (38.60.217.249) [WE OUT HERE] Apr 21 09:05:45 »» *** QUIT: Client exiting: KINGKONG_!user@38.60.217.249 (38.60.217.249) [Connection closed] Apr 21 09:06:58 »» *** QUIT: Client exiting: KINGKONG!user@38.54.71.74 (38.54.71.74) [Connection closed] Apr 21 09:08:34 »» *** CONNECT: Client connecting on port 6667 (class main): KINGKONG!user@38.54.38.227 (38.54.38.227) [WE OUT HERE] Apr 21 09:09:59 »» *** CONNECT: Client connecting on port 6667 (class main): KINGKONG_!user@38.60.217.61 (38.60.217.61) [WE OUT HERE] Apr 21 09:10:10 »» *** QUIT: Client exiting: KINGKONG_!user@38.60.217.61 (38.60.217.61) [Connection closed] Apr 21 09:10:17 »» *** QUIT: Client exiting: KINGKONG!user@38.54.38.227 (38.54.38.227) [Connection closed] Apr 21 09:10:23 »» *** CONNECT: Client connecting on port 6667 (class main): KINGKONG!user@38.60.221.188 (38.60.221.188) [WE OUT HERE] Then joined #chat and started spamming crap. Apr 21 02:23:59 ---» KINGKONG (user@38.60.215.126) has Joined #chat Apr 21 02:24:00 .:KINGKONG:. THIS CHANNEL SMELLS LIKE SHIT! GET ON 𝐈𝐑𝐂𝐃.𝐂𝐇𝐀𝐓 #𝐓𝐂𝐏𝐃𝐈𝐑𝐄𝐂𝐓 FOR HARD CHATS Apr 21 02:24:00 .:KINGKONG:. █ █▀█ █▀▀ █▀▄ . █▀▀ █.█ ▄▀█ ▀█▀ Apr 21 02:24:01 .:KINGKONG:. █ █▀▄ █▄▄ █▄▀ ▄ █▄▄ █▀█ █▀█ .█. Apr 21 02:24:01 .:KINGKONG:. PORT 6697 - #TCPDIRECT CELEBRATING 420 BIG KAHUNA BLUNTS ONLY I have my server configured so you can't list rooms, I guess #chat was easy to guess. (edit: formatting) ---------------------------------------------------------------------- [deleted] · 2023-04-22 19:10 [deleted] ---------------------------------------------------------------------- KindOne · 2023-04-22 22:02 The network exists. I connected to it and joined the channel in the message spam about a month a go or around that time. ---------------------------------------------------------------------- Gloomweaver10 · 2023-04-22 23:06 We set up an akill for `*@38.54.* ` and `*@38.60.*` because all their ips were subnets of them. Took care of all of it Edited to fix markdown ---------------------------------------------------------------------- annacrontab · 2023-04-22 23:40 Probably won't do anything, but I sent an email to abuse@kaopucloud.com and abuse@cogentco.com. Here's a template if anyone wants to as well: Subject: Abuse report for malicious traffic originating from IPs starting with 38.60 and 38.54 Dear Sir and/or Madam, I've been getting a flood of abusive traffic to my IRC server from your IP space, I'd like to report it. This is a sample, not an exhaustive list of IPs. But from what I can tell, they all start with 38.60 and 38.54. Here are the relevant log entries. When the bot manages to find a chatroom, it proceeds to post offensive and vulgar spamming to promote ircd.chat Per the whois, these IPs appear to belong to a netblock owned by Kaopucloud and/or Cogent Communications. Likely a compromised and/or malicious host on your systems. I'd like to officially report this activity to your Abuse department. Thank you for your attention to this matter. ---------------------------------------------------------------------- [deleted] · 2023-04-23 14:07 [deleted] ---------------------------------------------------------------------- trekkie1701c · 2023-04-23 16:21 There's sometimes spam bots that go around advertising networks. Sometimes because the netadmins think that's a good way to drive traffic, other times because people are mad at the network operators and know that spamming everywhere will get people upset at the people that run that network. Unfortunately it's somewhat up to the netadmins of your network to implement antispam/antibot measures to crack down on them. ---------------------------------------------------------------------- rooiratel · 2023-04-26 10:36 So wtf is it about?