# We're interested by unknown users quitting with Excess Flood message.
if{![isfloodquitmessage$reason]||$handle!="*"}{
return
}
# Botnet nicks have 3 to 5 characters
set len [strlen$nick]
if{$len<3||$len>5}{
return
}
# And belong to specific ISPs
set host [gethost$uhost]
if[isbotnetsuspecthost$host]{
add_botnet_ban$host
}
}
proc dcc:botnet {handle idx arg}{
if{$arg==""}{
putdcc$idx"Usage: .botnet <nick>"
return
}
set nick $arg
set uhost [getchanhost$nick]
if{$uhost==""}{
putdcc$idx"User unknown: $nick"
return
}
set host [gethost$uhost]
if[isbotnetsuspecthost$host]{
add_botnet_ban$host
return1
}{
putdcc$idx"Not a botnet suspect."
return
}
}
proc add_botnet_ban {host}{
global botname
newchanban[registry get protection.botnet.channel]*!*@$host$botname[registry get protection.botnet.banreason][registry get protection.botnet.banduration] sticky
sql"INSERT INTO log_flood (host, `count`) VALUES ('[sqlescape $host]', 1) ON DUPLICATE KEY UPDATE `count` = `count` + 1;"