AntiSpam/Flood *urgent hub under attack*

[morphie]

Hello,

My hub is being attacked, main chat flooded by this:
[21:10:04] http://mexinator.1go.dk/ <- lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol
[21:10:04] http://mexinator.1go.dk/ <- lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol
[21:10:04] http://mexinator.1go.dk/ <- lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol
[21:10:04] http://mexinator.1go.dk/ <- lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol
[21:10:06] http://mexinator.1go.dk/ <- lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol
[21:10:06] http://mexinator.1go.dk/ <- lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol
[21:10:06] http://mexinator.1go.dk/ <- lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol
[21:10:06] http://mexinator.1go.dk/ <- lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol
[21:10:06] http://mexinator.1go.dk/ <- lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol
[21:10:06] http://mexinator.1go.dk/ <- lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol
[21:10:06] http://mexinator.1go.dk/ <- lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol lol
[21:10:06] http://mexinator.1go.dk/ <- hahaha, noobs
[21:10:06] http://mexinator.1go.dk/ <- hahaha, noobs
[21:10:06] http://mexinator.1go.dk/ <- hahaha, noobs
[21:10:06] http://mexinator.1go.dk/ <- omfg, die
[21:10:06] http://mexinator.1go.dk/ <- omfg, die


Each user has a different IP that arent from the same range at all, and they all flood/connect really quickly. Also, the share is 155,00GB everytime.  If anyone could help I would appreciate it.

Thx again

[nErBoS]

Hi,

Just search for a anti-spam in the "Finished Scripts" section.

Best regards, nErBoS

[morphie]

The one i got and am now using started working 5 minutes or so after the floods started...

[imby]

add the address to a/your anti advertise bot. run a dcdm, as they seem to time out to it. in other words it should flush them out eventually.

[morphie]

I will try that lucifer antispam script it seems quite good.

[plop]

read the deflood topic, i just released a update 2 filter this flooder yesterday.

plop

[Cobalt]

Hello,

I've got same problem on my hub too. I'm trying set my anti advertise bot, but somebody who is trying attack my hub always changed www address. So I start using the latest version of  by plop today. I let you know if it's working.

Cobalt
:-)

[BJ]

I have the same problem.
Please tell me which script i must to use to prevent this.
I try with deflood 4.4.3,but get nowhere. :(
Please help me.
Thanks in advance friends.

[imby]

deflood does the job perfectly. combined with dcdm and adding 'www.' for example to an anti advertsiing script. if you can't get deflood to work, tell us why, as specific as possible and someone may be able to help you.

[Cobalt]

Hello,

there was a calm weekend, but today they start connecting to my hub again. They are quiet, but they are still connecting. They using names like: Njkpli ... Bwlvrk ... Coemtk ... Dofihx ... Gntvnk ... each user has a different IP and the share is 155 GB. I don't know what somebody is preparing.

Cobalt

[Herodes]

Originally posted by Cobalt
Hello,

there was a calm weekend, but today they start connecting to my hub again. They are quiet, but they are still connecting. They using names like: Njkpli ... Bwlvrk ... Coemtk ... Dofihx ... Gntvnk ... each user has a different IP and the share is 155 GB. I don't know what somebody is preparing.

Cobalt

They may be quiet ... but check what goes on "behind" the window ... look in the SearchSpy window maybe ?

[Typhoon]

also paste all info you can get out of those clients, like the full sharesize in bytes. tags , description and so on ..


Typhoon?

[Cobalt]

10/05/2004  3:23 pm

I've got at my hub about 40 this suspicious users now. They have everybody :
share:           155,00 GB
description:   Anime & Music
tag:               <++V:0.401,M:A,H:1/0/0,S:3>
connection:   DSL
e-mail:           dude986@hotmail.com

I don't see anything suspicious in searchspy window, they are just here at my hub.

Cobalt

[Cobalt]

One more thing, there is a really bad lag at my hub in this moment and a really big upload. So there is what's happening.

Cobalt

[Herodes]

this subject is discussed here also

[BJ]

That's the info:

[16:17] *** Info on Gueteh ***

Client:      
Lock:      
Pk:      
Tag:      <++ V:0.401,M:A,H:1/0/0,S:3>
Supports:      
Downspeed:   N/A
IP:      
Host:      
Description   Anime & Music
Email      dude986@hotmail.com
Connection   DSL
Stated Share   155.00 GB  (166430355311 B)
Real Share   155.00 GB  (166430355311 B)
Cheat status   



I get it with DCDM 0.251

[Herodes]

Originally posted by BJ
I get it with DCDM 0.251

Uhm DCDM hasnt got a 0.251 version ....

probably its DC+k or DC++k CDM ... either of those two isnt  DCDM ...

thx for the info ..