On Mon, 16 Feb 2004, Diane Bruce wrote: > Jeekay has been playing with a variant in services. I think the > numbers I use for timers etc. works very well, but still he has > found at least one spambot with it. I think his timers/counters will > produce a lot more false positives than the ones I use.
I am testing with the following parameters at the moment: A join followed by a part in under 10 seconds is counted as a `badpart'. Over 5 badparts in under a minute counts as a warning. So far it has caught a few obvious spambots and there have been no false positives. I expect the numbers would need to be tweaked for a larger network. The network it is currently linked to is ~2k users so I can afford to have the timings reasonably aggressive. At present however, it appears to be a nice dropin solution for a network that just wants to get rid of these types of bots. I am going to be adding more functionality to it in the next few days, ie idling in the larger chans on the network and watching for things getting spammed to it, cycling channels occasionally to check for onjoin scripts that sort of thing. GK
