Add plugin for banning botnets

swee · January 9, 2025, 11:35pm

This issue is very important, fixing it could save networks in the future!

If you haven’t seen, there are various spam botnets around networks running non-IRCat servers.

Perhaps implementing ban plugins for these botnets could make a big difference!

Evidence of botnet existence (will add more, including IRCat logs:

Outside IRCat (AnthroChat)

08:43:33 <stiang>                                  .''.
08:43:35 <stiang>        .''.             *''*    :_\/_:     . 
08:43:37 <stiang>       :_\/_:   .    .:.*_\/_*   : /\ :  .'.:.'.
08:43:39 <stiang>   .''.: /\ : _\(/_  ':'* /\ *  : '..'.  -=:o:=-
08:43:41 <stiang>  :_\/_:'.:::. /)\*''*  .|.* '.\'/.'_\(/_'.':'.'
08:43:43 <stiang>  : /\ : :::::  '*_\/_* | |  -= o =- /)\    '  *
08:43:45 <stiang>   '..'  ':::'   * /\ * |'|  .'/.\'.  '._____
08:43:47 <stiang>       *        __*..* |  |     :      |.   |' .---"|
08:43:49 <stiang>        _*   .-'   '-. |  |     .--'|  ||   | _|    |
08:43:51 <stiang>     .-'|  _.|  |    ||   '-__  |   |  |    ||      |
08:43:53 <stiang>     |' | |.    |    ||       | |   |  |    ||      |
08:43:55 <stiang>  ___|  '-'     '    ""       '-'   '-.'    '`      |____
08:43:57 <stiang>               ɪʀᴄ.ꜱᴜᴘᴇʀɴᴇᴛꜱ.ᴏʀɢ #ꜱᴜᴘᴇʀʙᴏᴡʟ 
08:44:01 <stiang>                  "is⁠n⁠'t it beautiful⁠?"

Links to the botnet source codes will be confidental, I will only send them via SweeNet.

Depresst0 · January 10, 2025, 2:38am

On ##TheCommunityOfPeople on OFTC.net

02:12 PM *** kliepl ([email protected]) has joined the channel
02:12 PM <kliepl>                                  .''.
02:12 PM <kliepl>        .''.             *''*    :_\/_:     . 
02:12 PM <kliepl>       :_\/_:   .    .:.*_\/_*   : /\ :  .'.:.'.
02:12 PM <kliepl>   .''.: /\ : _\(/_  ':'* /\ *  : '..'.  -=:o⁠:=-
02:12 PM <kliepl>  :_\/_:'.:::. /)\*''*  .|.* '.\'/.'_\(/_'.':'.'
02:12 PM <kliepl>  : /\ : :::::  '*_\/_* | |  -= o =- /)\    '  *
02:12 PM <kliepl>   '..'  ':::'   * /\ * |'|  .'/.\'.  '._____
02:12 PM <kliepl>       *        __*..* |  |     :      |.   |' .---"|
02:12 PM <kliepl>        _*   .-'   '-. |  |     .--'|  ||   | _|    |
02:12 PM <kliepl>     .-'|  _.|  |    ||   '-__  |   |  |    ||      |
02:12 PM <kliepl>     |' | |.    |    ||       | |   |  |    ||      |
02:12 PM <kliepl>  ___|  '-'     '    ""       '-'   '-.'    '`      |____
02:12 PM <kliepl>               ɪʀᴄ.ꜱᴜᴘᴇʀɴᴇᴛꜱ.ᴏʀɢ #ꜱᴜᴘᴇʀʙᴏᴡʟ 
02:13 PM <kliepl>                  "i⁠sn⁠'t it b⁠eautiful⁠?"
02:13 PM <kliepl> kliepl Depresst0
02:13 PM *** kliepl ([email protected]) has left the channel (GONNA GO CHAT ON SUPERNETS)

#gamesurge on GameSurge got it REALLY badly

12:54 PM <plairion>        .''.             *''*    :_\/_:     . 
12:54 PM <plairion>       :_\/_:   .    .:.*_\/_*   : /\ :  .'.:.'.
12:54 PM <plairion>   .''.: /\ : _\(/_  ':'* /\ *  : '..'.  -=:o:=-
12:54 PM <plairion>  :_\/_:'.:::. /)\*''*  .|.* '.\'/.'_\(/_'.':'.'
12:54 PM <plairion>  : /\ : :::::  '*_\/_* | |  -= o =- /)\    '  *
12:54 PM <plairion>   '..'  ':::'   * /\ * |'|  .'/.\'.  '._____
12:54 PM <plairion>       *        __*..* |  |     :      |.   |' .---"|
12:54 PM <plairion>        _*   .-'   '-. |  |     .--'|  ||   | _|    |
12:55 PM <plairion>     .-'|  _.|  |    ||   '-__  |   |  |    ||      |
12:55 PM <plairion>     |' | |.    |    ||       | |   |  |    ||      |
12:55 PM <plairion>  ___|  '-'     '    ""       '-'   '-.'    '`      |____
12:55 PM <plairion>               ɪʀᴄ.ꜱᴜᴘᴇʀɴᴇᴛꜱ.ᴏʀɢ #ꜱᴜᴘᴇʀʙᴏᴡʟ 
02:53 PM <ploacl>                                  .''.
02:53 PM <ploacl>        .''.             *''*    :_\/_:     . 
02:54 PM <ploacl>       :_\/_:   .    .:.*_\/_*   : /\ :  .'.:.'.
02:54 PM <ploacl>   .''.: /\ : _\(/_  ':'* /\ *  : '..'.  -=:o:=-
02:54 PM <ploacl>  :_\/_:'.:::. /)\*''*  .|.* '.\'/.'_\(/_'.':'.'
02:54 PM <ploacl>  : /\ : :::::  '*_\/_* | |  -= o =- /)\    '  *
02:54 PM <ploacl>   '..'  ':::'   * /\ * |'|  .'/.\'.  '._____
02:54 PM <ploacl>       *        __*..* |  |     :      |.   |' .---"|
02:54 PM <ploacl>        _*   .-'   '-. |  |     .--'|  ||   | _|    |
02:54 PM <ploacl>     .-'|  _.|  |    ||   '-__  |   |  |    ||      |
02:54 PM <ploacl>     |' | |.    |    ||       | |   |  |    ||      |
02:54 PM <ploacl>  ___|  '-'     '    ""       '-'   '-.'    '`      |____
02:54 PM <ploacl>               ɪʀᴄ.ꜱᴜᴘᴇʀɴᴇᴛꜱ.ᴏʀɢ #ꜱᴜᴘᴇʀʙᴏᴡʟ 
04:53 PM <siidd>                                  .''.
04:53 PM <siidd>        .''.             *''*    :_\/_:     . 
04:53 PM <siidd>       :_\/_:   .    .:.*_\/_*   : /\ :  .'.:.'.
04:53 PM <siidd>   .''.: /\ : _\(/_  ':'* /\ *  : '..'.  -=:o:=-
04:53 PM <siidd>  :_\/_:'.:::. /)\*''*  .|.* '.\'/.'_\(/_'.':'.'
04:53 PM <siidd>  : /\ : :::::  '*_\/_* | |  -= o =- /)\    '  *
04:53 PM <siidd>   '..'  ':::'   * /\ * |'|  .'/.\'.  '._____
04:53 PM <siidd>       *        __*..* |  |     :      |.   |' .---"|
04:53 PM <siidd>        _*   .-'   '-. |  |     .--'|  ||   | _|    |
04:55 PM <pluecion>                                  .''.
04:55 PM <pluecion>        .''.             *''*    :_\/_:     . 
04:55 PM <pluecion>       :_\/_:   .    .:.*_\/_*   : /\ :  .'.:.'.
04:55 PM <pluecion>   .''.: /\ : _\(/_  ':'* /\ *  : '..'.  -=:o:=-
04:55 PM <pluecion>  :_\/_:'.:::. /)\*''*  .|.* '.\'/.'_\(/_'.':'.'
04:55 PM <pluecion>  : /\ : :::::  '*_\/_* | |  -= o =- /)\    '  *
04:55 PM <pluecion>   '..'  ':::'   * /\ * |'|  .'/.\'.  '._____
04:55 PM <pluecion>       *        __*..* |  |     :      |.   |' .---"|
05:53 PM <floafl>                                  .''.
05:53 PM <floafl>        .''.             *''*    :_\/_:     . 
05:53 PM <floafl>       :_\/_:   .    .:.*_\/_*   : /\ :  .'.:.'.
05:53 PM <floafl>   .''.: /\ : _\(/_  ':'* /\ *  : '..'.  -=:o:=-
05:53 PM <floafl>  :_\/_:'.:::. /)\*''*  .|.* '.\'/.'_\(/_'.':'.'
05:53 PM <floafl>  : /\ : :::::  '*_\/_* | |  -= o⁠ =- /)\    '  *
05:53 PM <floafl>   '..'  ':::'   * /\ * |'|  .'/.\'.  '._____
05:53 PM <floafl>       *        __*..* |  |     :      |.   |' .---"|
05:53 PM *** mwraki85 ([email protected]) has quit (Ping timeout)
05:53 PM <floafl>        _*   .-'   '-. |  |     .--'|  ||   | _|    |
05:53 PM <floafl>     .-'|  _.|  |    ||   '-__  |   |  |    ||      |
05:53 PM <floafl>     |' | |.    |    ||       | |   |  |    ||      |
05:53 PM <floafl>  ___|  '-'     '    ""       '-'   '-.'    '`      |____
05:53 PM <floafl>               ɪʀᴄ.ꜱᴜᴘᴇʀɴᴇᴛꜱ.ᴏʀɢ #ꜱᴜᴘᴇʀʙᴏᴡʟ 
05:54 PM <floafl>                  "i⁠sn't i⁠t⁠ beautiful?"
05:54 PM <floafl> floafl jdwilsh Stuiterbal guest7944 Sicily NEYi_ mwraki85 eroc1990 Galien Enigma KindOne Hackerpcs Depresst0 Fischmiep benf tydel tYPe-R- Crono|mobile Hobbyboy shrew zas okidoki APic reborn ThiefMaster H Crono Nuvelle Marentis Arrowmaster ganiman AlicornTwilight jewbird LinuxSP zeroflame ScRaMbLe Diabolico Enapiuz BlindSight Kusau Nick cybrdth cyberdeath Zix SNuker Crimson13 Hitsugaya Supernuker 
05:54 PM *** floafl ([email protected]) has left the channel (GONNA GO CHAT ON SUPERNETS)
05:54 PM <NEYi_> Lmao, I got banned on this channel for far less. :)
06:16 PM <fluewd>                                  .''.
06:16 PM <fluewd>        .''.             *''*    :_\/_:     . 
06:16 PM *** fluewd ([email protected]) has quit (Excess Flood)
06:18 PM <shrew> lol
06:35 PM <preikb>                                  .''.
06:35 PM <preikb>        .''.             *''*    :_\/_:     . 
06:35 PM <preikb>       :_\/_:   .    .:.*_\/_*   : /\ :  .'.:.'.
06:35 PM <preikb>   .''.: /\ : _\(/_  ':'* /\ *  : '..'.  -=:o:=-
06:35 PM <preikb>  :_\/_:'.:::. /)\*''*  .|.* '.\'/.'_\(/_'.':'.'
06:35 PM <preikb>  : /\ : :::::  '*_\/_* | |  -= o =- /)\    '  *
06:35 PM <preikb>   '..'  ':::'   * /\ * |'|  .'/.\'.  '._____
06:35 PM <preikb>       *        __*..* |  |     :      |.   |' .---"|
06:36 PM <preikb>        _*   .-'   '-. |  |     .--'|  ||   | _|    |
06:36 PM <preikb>     .-'|  _.|  |    ||   '-__  |   |  |    ||      |
06:36 PM <preikb>     |' | |.    |    ||       | |   |  |    ||      |
06:36 PM <preikb>  ___|  '-'     '    ""       '-'   '-.'    '`      |____
06:36 PM <preikb>               ɪʀᴄ.ꜱᴜᴘᴇʀɴᴇᴛꜱ.ᴏʀɢ #ꜱᴜᴘᴇʀʙᴏᴡʟ

and then the SpEcIaL sPaM (their bot just spouts song lyrics)

03:19 PM <Unknown> like a human with it's skull scraped out playing animation soumd effects from dish network 
03:19 PM <Unknown> yellow aleet for intel cmnty drone attacks 
03:19 PM <Unknown> yellow alert
03:19 PM <Unknown> caution until you get them 50ft away 
03:19 PM <Unknown> you may unclick the safty 
03:20 PM <Unknown> maybe that is orange alert 
03:20 PM <Unknown> the orange paint on the safty lock 
03:22 PM <Unknown> orange alert
03:22 PM <Unknown> could be kevins chickenhead orcs 
03:22 PM <Unknown> orange alert
03:23 PM <Unknown> thwy keep saying bro tryingbto steal your sim chip 
03:24 PM *** chyi ([email protected]) has quit (EOF from client)
03:24 PM <Unknown> brain rot gutter dogs 
03:24 PM *** chyi ([email protected]) has joined the channel
03:25 PM <Unknown> they think Jesus showed up to worship a crack dealer 
03:26 PM <Unknown> like a human with it's skull scraped out playing animation sound effects from dish network

they seem to think their No Rules shit applies on every website on the internet.

Depresst0 · January 10, 2025, 2:41am

i have a plan tho, im going to break their Botnet using /list on a server that doesnt support it. something that swee found with Codename IRCat

swee · January 10, 2025, 2:42am

I can also make a channel “trap” with a plugin, so it calls the ban engine when the bot tries to join that channel

swee · January 10, 2025, 2:48am

I am currently module-ifying the ban engine so I can work on making botnet control plugins when I’m done.

swee · January 11, 2025, 3:16am

I finished making the ban_engine plugin, will now work on ban techniques for the botnets.

swee · January 11, 2025, 3:20am

Context:

After mentioning Depresst0, I added my laptop’s IP to my bans.txt
The client tries to send a message “test” after, but doesn’t get sent. This is a good way to protect from supernets botnets.

swee · January 11, 2025, 9:07am

We’ve done it, bois

There’s also a fake channel, that will work too.
Remember that the topic of the channels aren’t lying when using /LIST

swee · January 11, 2025, 9:19am

I will check my bans.txt in probs a week or month or two to see if the plugin is effective :3