TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
My initial thought was some Lame flood attempt also..but by looking at the
times they are no where close enough to even phase a 56Kers bandwith.. That
virus sounds like a perfect cause for this as it dumps freshly retieved data
to the creator via IRC!
-----Original Message-----
From: David [mailto:[EMAIL PROTECTED]]
Sent: Thursday, March 29, 2001 8:50 AM
To: Sloan, Scott (CIT)
Cc: '[EMAIL PROTECTED]'
Subject: Re: Has anyone seen this type of IRC activity?
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------
Otherwise known as a floodnet bot. It joins the channels it's commanded
to and massively floods with a variety of preprogrammed text, massively
joins/parts channels with rapidly changing nicks to avoid bans, etc.
Floodbots are extremely annoying, so much so that I who am a peaceful
man, am very tempted to take a baseball bat to the person who does it as
well as tie him up in front of a fireplace and slowly roast his computer
over hot embers.
I would capture logs of everything and provide it to the lame user's
ISP. In some cases people provide this information to local police,
some ignore it. Some just rm -rf the lamer's account.
-d
Sloan, Scott (CIT) wrote:
> TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message
to
> [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
>
----------------------------------------------------------------------------
>
> This traffic is from one machine and is connecting to two different IRC
> servers. I've seen this activity before, and also from other machines.
The
> question that I have is why the random, changing Nicks?
>
> Thanks,
> Scott
>
>
> Date Time Destination Port Event
> Event Info
> 2001-03-27 13:02:48 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 13:09:51 206.252.192.196 6667 IRC_Nick
> NICK=VnazlgFsx
> 2001-03-27 13:10:18 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 13:38:20 206.252.192.197 6667 IRC_Nick
> NICK=SDapvpP|
> 2001-03-27 13:38:50 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 13:59:51 206.252.192.197 6667 IRC_Nick
> NICK=wMOIrE{
> 2001-03-27 14:00:21 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 14:21:22 206.252.192.196 6667 IRC_Nick
> NICK=blMxzL]|u
> 2001-03-27 14:21:52 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 14:35:53 206.252.192.196 6667 IRC_Nick
> NICK=ZygvRNcfq
> 2001-03-27 14:36:23 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 14:57:27 206.252.192.197 6667 IRC_Nick
> NICK=HjJfnQiOz
> 2001-03-27 14:57:54 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 15:04:57 206.252.192.196 6667 IRC_Nick
> NICK=eyosMm_D
> 2001-03-27 15:05:24 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 15:19:29 206.252.192.196 6667 IRC_Nick
> NICK=YsXuvmOC
> 2001-03-27 15:19:55 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 15:20:25 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 15:41:29 206.252.192.197 6667 IRC_Nick
> NICK=VoF`KbG
> 2001-03-27 15:55:57 206.252.192.197 6667 IRC_Nick
> NICK=\QHHJsbsX
> 2001-03-27 15:56:27 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 16:03:36 206.252.192.196 6667 IRC_Nick
> NICK=RFKUI\s
> 2001-03-27 16:03:57 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 16:10:58 206.252.192.197 6667 IRC_Nick
> NICK=eH]rgrvdd
> 2001-03-27 16:11:28 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 16:25:31 206.252.192.196 6667 IRC_Nick
> NICK=LHVUmNMVR
> 2001-03-27 16:25:59 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 16:32:59 206.252.192.197 6667 IRC_Nick
> NICK=|VvoPRa
> 2001-03-27 16:33:29 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 16:40:30 206.252.192.196 6667 IRC_Nick
> NICK=BWJsDhw
> 2001-03-27 17:02:01 206.252.192.196 6667 IRC_Nick
> NICK=TKonMSmYR
> 2001-03-27 17:02:31 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 17:09:31 206.252.192.196 6667 IRC_Nick
> NICK=eBzlGWoqz
> 2001-03-27 17:10:01 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 17:24:35 206.252.192.196 6667 IRC_Nick
> NICK={tT^bYIs
> 2001-03-27 17:25:02 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 17:39:33 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 17:46:33 206.252.192.197 6667 IRC_Nick
> NICK=UdSr`DHBV
> 2001-03-27 17:47:03 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 18:36:36 206.252.192.197 6667 IRC_Nick
> NICK={DPMuidx
> 2001-03-27 18:44:36 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 18:58:40 206.252.192.197 6667 IRC_Nick
> NICK=WDbRwGI
> 2001-03-27 18:59:07 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 19:06:07 206.252.192.197 6667 IRC_Nick
> NICK=j{hgeai
> 2001-03-27 19:06:37 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 19:20:41 206.252.192.197 6667 IRC_Nick
> NICK=TExBfL{N
> 2001-03-27 19:21:08 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 19:28:15 206.252.192.197 6667 IRC_Nick
> NICK=Wc^zzTdJe
> 2001-03-27 19:28:38 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 19:35:42 206.252.192.196 6667 IRC_Nick
> NICK=r^TYDZorI
> 2001-03-27 19:36:09 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 19:43:39 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 20:05:13 206.252.192.197 6667 IRC_Nick
> NICK=]^HLAajvl
> 2001-03-27 20:26:42 206.252.192.197 6667 IRC_Nick
> NICK=nwRU^QuoT
> 2001-03-27 20:27:12 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 20:41:18 206.252.192.197 6667 IRC_Nick
> NICK=_EabdFb
> 2001-03-27 20:41:42 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 20:48:43 206.252.192.197 6667 IRC_Nick
> NICK=w\afvEgk{
> 2001-03-27 20:49:13 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 20:56:19 206.252.192.196 6667 IRC_Nick
> NICK=[GhvgUt[
> 2001-03-27 20:56:43 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 21:03:43 206.252.192.197 6667 IRC_Nick
> NICK=knm\mK{W
> 2001-03-27 21:04:13 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 21:11:23 206.252.192.197 6667 IRC_Nick
> NICK=WJinHIW\c
> 2001-03-27 21:11:44 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 21:18:44 206.252.192.197 6667 IRC_Nick
> NICK=UhwlvFk
> 2001-03-27 21:19:14 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 21:26:22 206.252.192.196 6667 IRC_Nick
> NICK=TMhzLI{
> 2001-03-27 21:54:46 206.252.192.197 6667 IRC_Nick
> NICK=ci_SPbX
> 2001-03-27 21:55:16 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 22:23:18 206.252.192.197 6667 IRC_Nick
> NICK=dM[GKLdy
> 2001-03-27 22:23:48 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 22:30:51 206.252.192.196 6667 IRC_Nick
> NICK={ZcP`wLi
> 2001-03-27 22:31:18 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 22:38:22 206.252.192.197 6667 IRC_Nick
> NICK=YyDvvOfZo
> 2001-03-27 22:38:49 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 22:52:49 206.252.192.196 6667 IRC_Nick
> NICK=HTO}JSyW
> 2001-03-27 22:53:19 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 23:00:20 206.252.192.196 6667 IRC_Nick
> NICK=DaHc|h]Yr
> 2001-03-27 23:00:50 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 23:21:51 206.252.192.196 6667 IRC_Nick
> NICK=EYcufu`
> 2001-03-27 23:22:21 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 23:36:22 206.252.192.197 6667 IRC_Nick
> NICK=AuFJbHhuX
> 2001-03-27 23:43:52 206.252.192.197 6667 IRC_Nick
> NICK=J_HJim{Y
> 2001-03-27 23:44:22 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-27 23:58:23 206.252.192.196 6667 IRC_Nick
> NICK=WCxSCznB
> 2001-03-27 23:58:53 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 00:12:54 206.252.192.196 6667 IRC_Nick
> NICK=QddsxNCJi
> 2001-03-28 00:13:24 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 00:48:25 206.252.192.197 6667 IRC_Nick
> NICK=lwze^ng
> 2001-03-28 00:48:55 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 00:55:56 206.252.192.196 6667 IRC_Nick
> NICK=Pi^HaoicT
> 2001-03-28 00:56:26 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 01:24:30 206.252.192.196 6667 IRC_Nick
> NICK=khnkTwk]J
> 2001-03-28 01:24:57 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 01:46:59 206.252.192.196 6667 IRC_Nick
> NICK=WZA]xJBl[
> 2001-03-28 01:47:29 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 02:08:33 206.252.192.197 6667 IRC_Nick
> NICK=_ENhqUjYV
> 2001-03-28 02:09:00 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 02:23:00 206.252.192.196 6667 IRC_Nick
> NICK=REwZ^noY
> 2001-03-28 02:23:30 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 02:30:31 206.252.192.196 6667 IRC_Nick
> NICK=f[qvN{hiW
> 2001-03-28 02:52:32 206.252.192.196 6667 IRC_Nick
> NICK=|EIx\Xe
> 2001-03-28 02:53:02 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 03:00:02 206.252.192.197 6667 IRC_Nick
> NICK=[iDq}UoJn
> 2001-03-28 03:00:32 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 03:07:33 206.252.192.196 6667 IRC_Nick
> NICK=`NYulpv}
> 2001-03-28 03:08:03 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 03:15:03 206.252.192.197 6667 IRC_Nick
> NICK=U]CRLsMN
> 2001-03-28 03:15:33 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 03:22:34 206.252.192.196 6667 IRC_Nick
> NICK=EzwoVkem
> 2001-03-28 03:30:11 206.252.192.197 6667 IRC_Nick
> NICK=ZG^WhzWAY
> 2001-03-28 03:37:37 206.252.192.196 6667 IRC_Nick
> NICK=}p}JLcqa
> 2001-03-28 03:38:04 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 03:45:35 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 03:52:35 206.252.192.196 6667 IRC_Nick
> NICK=e`Hp[SY
> 2001-03-28 03:53:05 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 04:07:09 206.252.192.197 6667 IRC_Nick
> NICK={ik}CS{rm
> 2001-03-28 04:07:36 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 04:14:42 206.252.192.197 6667 IRC_Nick
> NICK=gyUQmj]Na
> 2001-03-28 04:15:06 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 04:22:07 206.252.192.196 6667 IRC_Nick
> NICK=jPLfsCm
> 2001-03-28 04:22:37 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 04:29:37 206.252.192.197 6667 IRC_Nick
> NICK=jY|OMJV
> 2001-03-28 04:30:07 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 04:37:08 206.252.192.196 6667 IRC_Nick
> NICK=}JD]Ahq
> 2001-03-28 04:37:38 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 04:51:38 206.252.192.196 6667 IRC_Nick
> NICK=GFiJtTpqW
> 2001-03-28 04:52:08 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 05:06:09 206.252.192.196 6667 IRC_Nick
> NICK=WZ\Ep_wU
> 2001-03-28 05:06:39 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 05:13:40 206.252.192.196 6667 IRC_Nick
> NICK=tUblPQC}\
> 2001-03-28 05:14:10 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 05:21:10 206.252.192.196 6667 IRC_Nick
> NICK=lODgj]i[
> 2001-03-28 05:21:40 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 05:35:41 206.252.192.196 6667 IRC_Nick
> NICK=ra|NBt|wG
> 2001-03-28 05:36:11 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 05:50:12 206.252.192.197 6667 IRC_Nick
> NICK=^vundrpaU
> 2001-03-28 05:50:41 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 05:57:42 206.252.192.196 6667 IRC_Nick
> NICK=EHKcrbIof
> 2001-03-28 05:58:12 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 06:12:13 206.252.192.197 6667 IRC_Nick
> NICK=eSmME[f
> 2001-03-28 06:12:43 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 06:27:13 206.252.192.197 6667 IRC_Nick
> NICK=VbwkZDIDd
> 2001-03-28 06:27:43 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 06:49:15 206.252.192.197 6667 IRC_Nick
> NICK=cjH{WZo\y
> 2001-03-28 06:49:45 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 06:56:45 206.252.192.197 6667 IRC_Nick
> NICK=U]EBpfY
> 2001-03-28 06:57:15 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 07:11:19 206.252.192.196 6667 IRC_Nick
> NICK=qrXKFRsk
> 2001-03-28 07:11:46 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 07:18:49 206.252.192.197 6667 IRC_Nick
> NICK=xeq}TWC
> 2001-03-28 07:19:16 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 07:33:17 206.252.192.197 6667 IRC_Nick
> NICK=FpYtnWfs
> 2001-03-28 07:33:47 206.252.192.197 6667 IRC_Join
> CHANNEL=# ¶4ch 0
> 2001-03-28 07:40:48 206.252.192.196 6667 IRC_Nick
> NICK=BcgUhYo
> 2001-03-28 07:41:17 206.252.192.196 6667 IRC_Join
> CHANNEL=# ¶4ch 0
>
> Target Hosts:
> 206.252.192.197 irc-2.stealth.net
> 206.252.192.196 irc-3.stealth.net
