k-line

[kraij]

Hi everyone,

my problem is that my bot gets k-lined for ... let me say nothin...

well i get different info from servers why he gets banned. one time they detect an open proxy (absolutely nonsense!!!), the next server notices the host would be trojan infected. Maybe I am no geek but please tell me how a trojan or a simple virus could take use of a unixsystem (guess here I should say NONSENSE again). but thats not the story how it started.

The bot got a (connection closed) & when the eggdrop rejoined the channels he should protect, he became k-lined for spamming

Could it be that EFnet serversettings are a bit paranoid?

Sincerely kraij

[deww]

Your bot might be on an "Unix" system, but it doesn't mean the IP address associated with the box was always clean. "Unix" based systems can be compromised and misconfigured as well. Some times they are configured to run services which are commonly exploitable or on ports which are commonly exploitable, hence the k-lines for trojans or opened proxies. Most of these klines are placed based on finding positive identification that the IP address you are using is either compromised or was compromised. They are not perfect, there are always legitimate users getting hit.. The "story" you mentioned seems innocent enough, but it did exhibit spam bot like behaviors and you seem to agree. Yes some of the automated bot detection routines can be sensitive, but it's necessary evil IMO.

[lucy]

is it possible the bot sends an auto message to people joining the channel?

or is it possible it keeps cycling the channel trying to get opped?

either of those could cause klines

[kraij]

nope, nothing u mentioned is the eggdrop doin

thx anyways
kraij

[kraij]

ok I ve tried 4 different ip`s of the given range. 2 of them worked fine for a few hours. Now my eggdrop is banned again. the curiosity is that i have a second eggdrop on the same shell (workin fine), with an ip close to the ip of the banned eggdrop. Any idea folks?

I start takin it personally & since I ve read the post about abusing IRC-oper on EFnet I wouldnt wonder ....

ILLUMINATI

regards kraij