On 9/7/11 7:36 AM, naw wrote: > Hello > > I have seen an automated attack on several rooms. > > A bot connects and sends this private message: > "Hi! I would like to present you a phone flooder - FlooSIP. For details in > ICQ: XXXXXX" > > It has connected from random accounts on different servers but it seems to > share the resource name > "jabbrel" (maybe related to the emacs library JabberEL?) > > It seems that on our server it also has been created, from a russian IP, one > of those accounts that has > been used to attack another server.
Do we have the actual JIDs or just the roomnicks? We had similar flooder bots a year or two ago and were able to track down the IP addresses so that the relevant ISP would block them. Peter -- Peter Saint-Andre https://stpeter.im/
