Proxy/Drone/Sock5/BotNET Guard

By Cehennem on Oct 09, 2011

Proxy/Drone/Sock5/BotNET gLine!.

;# by Cehennem- 29/07/07
;#
on *:snotice:*Client*connecting*: {
  var %dx = $gettok($right($left($10,-1),-1),2,64)
  if $regex(%dx,isnet|getinternet|rdlbnc|anet|xnet|becken|neoplus|bag148|mta|inetia*|as42224|virginmedia|adsl|edu|tema|chello|as42926|proxa|pppool|btc-net|adsl-dhcp|dynamic|ynet|azdata|nixcon|cci|superonline|t-com|home|interbild|chello|ltdomains|fastwebnet|ba|kopuz|selfnet|access|enka|bluewin|azerin|surfer|tt net|t-dialin|bredband2|skylogicnet|business|azeronline|asianet|m net) { goto End }
  var %re = $iif($regex(%dx,-) != 1,$gettok(%dx,1,46),DONE)
  if %re == DONE {
    gline $9 +0 0 Regex-Proxy Out!. 00,1• 0,1« 01X 0» 00,1•
    goto end
  }
  if $istok(81 58 62 120 176 21 2 158 69 1 178 85 88 94 82 80 188 178 64 46 212 92 95 194 91 77 195 120 67 192 82 208 82 84 86 87 89 217 212 217 212 70 71 72 72 74 75 76 77 78 79,%re,22) == $false {
    gline $9 +0 0 Ip-Proxy Out!.. 00,1• 0,1« 01X 0» 00,1•
  }
  :end
} 
;# End code
;###############################################

Comments

Sign in to comment.
Frenetic   -  Oct 10, 2011

And if they use an American, ISP which a lot of people do, it would ban them as "pool" isin the reverse dns..

 Respond  
Frenetic   -  Oct 10, 2011

A proxy bot flood is not a botnet, this would not do anything against a real botnet...

 Respond  
Fuzionx   -  Oct 10, 2011

Wouldn't this crash you if like 300 clones connect at once?

 Respond  
Are you sure you want to unfollow this person?
Are you sure you want to delete this?
Click "Unsubscribe" to stop receiving notices pertaining to this post.
Click "Subscribe" to resume notices pertaining to this post.