Need help with spamfilter

[kucha12]

Hello everyone.

Yesterday some bots/clones attacked my network. This is an example of the joinflood:

Code: Select all

[20:10:08] * r633 ([email protected]) has joined #friends
[20:10:08] * c2268 ([email protected]) has joined #friends
[20:10:08] * l8505 ([email protected]) has joined #friends
[20:10:08] * r8771 ([email protected]) has joined #friends
[20:10:08] * w3787 ([email protected]) has joined #friends
[20:10:09] * y6243 ([email protected]) has joined #friends
[20:10:09] * l4784 ([email protected]) has joined #friends
[20:10:09] * r3452 ([email protected]) has joined #friends
[20:10:09] * x5911 ([email protected]) has joined #friends
[20:10:09] * q8474 ([email protected]) has joined #friends
[20:10:09] * t2627 ([email protected]) has joined #friends
[20:10:09] * k4387 ([email protected]) has joined #friends
[20:10:09] * v4916 ([email protected]) has joined #friends
[20:10:09] * j6191 ([email protected]) has joined #friends
[20:10:09] * h2740 ([email protected]) has joined #friends
[20:10:09] * a2386 ([email protected]) has joined #friends
[20:10:09] * w7985 ([email protected]) has joined #friends
[20:10:09] * u2930 ([email protected]) has joined #friends
[20:10:10] * y8951 ([email protected]) has joined #friends
[20:10:10] * g9771 ([email protected]) has joined #friends
[20:10:10] * s5196 ([email protected]) has joined #friends

Question: what is the exact syntax for spamfilter to gline them? (matching this random IP and random ident mask.)

Thanks.

[Stealth]

These appear to be ClonesX clones...

Code: Select all

^[a-z][0-9]{1,4}!~?[a-z][0-9]{1,4}@.+:[a-z]{6}$

Code: Select all

/spamfilter add u gline 1d Clones ^[a-z][0-9]{1,4}!~?[a-z][0-9]{1,4}@.+:[a-z]{6}$

The regexs may be a little inacurate, although it is extremely difficult to make one with just a user@host. If the regex doesn't work, post more info. Search the forums for ClonesX for more info on ClonesX

[kucha12]

Thanks, it worked out just perfectly..