On Miércoles 07 septiembre 2011 10:33:07 Peter Saint-Andre escribió: > On 9/7/11 7:36 AM, naw wrote: > > Hello > > > > I have seen an automated attack on several rooms. > > > > A bot connects and sends this private message: > > "Hi! I would like to present you a phone flooder - FlooSIP. For details in > > ICQ: XXXXXX" > > > > It has connected from random accounts on different servers but it seems to > > share the resource name > > "jabbrel" (maybe related to the emacs library JabberEL?) > > > > It seems that on our server it also has been created, from a russian IP, > > one of those accounts that has > > been used to attack another server. > > Do we have the actual JIDs or just the roomnicks? > > We had similar flooder bots a year or two ago and were able to track > down the IP addresses so that the relevant ISP would block them. >
I have some JIDs and one IP
