Massive Clone Flood Protection
Written by Kintar0

This section covers protection on the new Papa Flood type floods. This type of flood basically loads a clone, has it join a channel, flood it with text and/or ctcp, then the clone quits, and another clone is loaded which does the same thing. This type of flood can be pretty dangerous and fast since many scripts are designed to kick/ban clones or join floods. Many things can happen, such as excess floods, mode flooding yourself, and so on...etc. Revolving door bans may be another possible solution to these types of floods but they aren't very stable. We have listed 5 possible methods of protection. The code should go into mIRC Remotes.

Method #1

on *:quit: { if ($nick ison #channel && $me isop #channel) { if (%quit-flood. [ $+ [ $wildsite ] ] == $null) { set -u10 %quit-flood. [ $+ [ $wildsite ] ] 1 return } else { inc %quit-flood. [ $+ [ $wildsite ] ] } if (%quit-flood. [ $+ [ $wildsite ] ] > 4 && %quit-flood.check == $null) { set -u8 %quit-flood.check 1 raw -q mode #channel +bbcR *!~*@* $wildsite notice @ $+ #channel Banning *!~*@* and $wildsite due to possible clone floods... } } }

The code above listens to the number of quits for each host. If that host exceeds 4 or more quits within 10 seconds, mIRC will set a ban on *!~*@* and the host ($wildsite) as well as set the channel modes +cR. c blocks all color codes from being sent to the channel and R restricts the channel so only registered nicknames may enter. Not all IRC networks support these 2 modes so be sure to check before attempting to have the script set them. Note that $chan or # are not valid in this event. You will have to specify the channels manually as shown above.

The code above would be my best recommendation, most floods join/flood/quit. It doesn't interfere with netsplit rejoins and unlike on join's, there is a small chance of other events triggering along with it. To modify settings, you should most likely change the #channel to your actual channel, and you may modify the amount of quits and duration times. The quit limit is currently set to 4 and the duration is set at 10 seconds. I'm sure you can find them in the script yourself.

Method #2

on @*:join:#channel: { var %id = *!~*@* , %fa = $fulladdress if (%id iswm %fa) { if (%id. [ $+ [ $wildsite ] ] == $null) { set -u10 %id. [ $+ [ $wildsite ] ] 1 return } else { inc %id. [ $+ [ $wildsite ] ] } if (%id. [ $+ [ $wildsite ] ] > 3 && %id-check == $null) { set -u8 %id-check 1 raw -q mode # +bbcR *!~*@* $wildsite .notice # Bans and modes auto set due to possible floods, please be patient. Thank you. .timer_id-flood 1 30 raw -q mode # -bcR *!~*@* } } }

The code above, Method #2, uses the on join event to listen to excess joins by a host that matches *!~*@* which matches about 95% of the time with clone floods. Basically, if a user joins the channel 4 or more times within 10 seconds and matches *!~*@* then mIRC will ban that user, ban *!~*@* and set modes +cR for color restraint and registered user restrictions.

When users flood, it's almost impossible to enable identd; therefore, a floodbot's address will almost always match *!~*@* so we can detect when/if that address is joining too much and too fast. This method works fairly well as well but may not always catch flooders due to wingate flooders and such but that is still rare.

Method #3

on @*:part:#channel: { var %id = *!~*@* , %fa = $fulladdress if (%id iswm %fa) { if (%id. [ $+ [ $wildsite ] ] == $null) { set -u10 %id. [ $+ [ $wildsite ] ] 1 return } else { inc %id. [ $+ [ $wildsite ] ] } if (%id. [ $+ [ $wildsite ] ] > 4 && %id-check == $null) { set -u8 %id-check 1 raw -q mode # +bbcR *!~*@* $wildsite .notice # Bans and modes auto set due to possible floods, please be patient. Thank you. .timer_id-flood 1 30 raw -q mode # -bcR *!~*@* } } }

This is exactly the same as Method #2 but it listens to parts instead of joins. Thats about the only difference. If you have one, you probably wont need the other. If a channel is moderated, some networks force a user to part the channel before being able to quit. That eliminates Method #1 and Method #3 comes handy. So you can work that out however you need.

Method #4

on @!*:join:#: { var %join.flood = $wildsite if (%join. [ $+ [ # ] $+ . $+ [ %join.flood ] ] == $null) { set -u10 %join. [ $+ [ # ] $+ . $+ [ %join.flood ] ] 1 return } else { inc %join. [ $+ [ # ] $+ . $+ [ %join.flood ] ] } if (%join. [ $+ [ # ] $+ . $+ [ %join.flood ] ] >= 4) { if (%join.check. [ $+ [ $wildsite ] ] == $null) { set -u8 %join.check. [ $+ [ $wildsite ] ] 1 raw -q mode # +bbcR *!~*@* %join.flood kick # $nick Join Flood) (Banned } } }

This is basically a join flood kicker. It listens to joins from a host and when/if that user exceeds 4 or more joins within 10 seconds, mIRC sets a ban and kicks the user for join flooding. This is almost the same as Method #2 but the difference is that it does not depend on *!~*@* in the users address but instead it just watches the host.

Method #5

on *:quit: { if (*!~*@* !iswm $fulladdress) { return } if ($nick ison #channel && $me isop #channel) { if (%quit-flood == $null) { set -u10 %quit-flood 1 return } else { inc %quit-flood } if (%quit-flood > 4 && %quit-flood.check == $null) { set -u8 %quit-flood.check 1 raw -q mode #channel +bbcR *!~*@* $wildsite notice @ $+ #channel Banning *!~*@* and $wildsite due to possible clone floods... } } }

Method #5 above is a very strict method but it works pretty well. You may tweak it to your liking. It is very much like method #1 but it only reads in addresses matching *!~*@* so it will catch about 95% of most floods if they join/quit. It is also more sensible to netsplits.

For these 5 methods shown above, I strongly recommend that you do not use all of them at once in the same mIRC session. Why do I say this? If you do, you have a high potentail of flooding yourself off trying to set bans and kick users. One or two should be good enough, it has been doin fine for me. Try them out and modify them as needed. If you find any errors or have any questions/comments, please contact us via email, memo, or our script forum. Thanks for your time.

2000-2001 ClanX Scripterz Organization