Spamfilter for clones

These are old archives. They are kept for historic purposes only.
Jason
Posts: 570
Joined: Mon Jun 14, 2004 5:09 pm

Re: Spamfilter for clones

Post by Jason » Sat Feb 02, 2008 6:39 pm

Ah. /me mangles the mangling. Stupid /who...
Why the hell can't my signature be empty?
"Your message contains too few characters."

DeviL69
Posts: 21
Joined: Mon Nov 05, 2007 10:02 pm
Location: Macedonia
Contact:

Spamfilter for clones

Post by DeviL69 » Sun Feb 03, 2008 1:01 am

blablablablaZv (Cr@87.250.108.22 - s)
blablablablaUz (Ai@210.2.46.31 - i)
asasasasasasasaDc (Dj@200.127.65.245 - r)

so i used this : ^(?-i)(nickhere)[A-Z][a-z]![A-Z][a-z]@[^:]+:[a-z]$
but i should put spamfilter for how many times they will change their nicks
can u better tell me how should i do if the ident is 2 letter like: Bs and real name just one small leter

(?)![A-Z][a-z]@[^:]+:[a-z]$

is that right ?

Jason
Posts: 570
Joined: Mon Jun 14, 2004 5:09 pm

Re: Spamfilter for clones

Post by Jason » Wed Feb 06, 2008 1:57 pm

It will work, but won't be case sensitive, and the (?) wont do anything. (If you wanted that to be the prefix to make it case sensitive, you want (?-i) )
Why the hell can't my signature be empty?
"Your message contains too few characters."

HitMan69
Posts: 14
Joined: Sat Sep 06, 2008 3:46 am
Location: Australia
Contact:

Re: Spamfilter for clones

Post by HitMan69 » Sat Sep 06, 2008 3:55 am

* TMIxInrcfCBn H? ~gclzlmvlb@997C46D.1754B818.83168410.IP :1 XRefJtbDAiprTKXhIMqxCkbTyQgJKoWPuMBhmGhKhVCAKiZDH

* Sourcelx H? ~jbclfkmqy@Disponohu.at-D9B18889.dhcp.oxfr.ma.charter.com :1 xxSWRQMIfKsEqoPyZTbIg

* dXmcl H? ~azuwkdaio@Disponohu.at-20E3E932.telebecinternet.net :1 cEfIttZNmXCRUCMrjrJSgxBlpasYRhrjvhQRLdMPZYkrgFLgXk

* NACUoxVU H? ~yvzudmgad@FF400007.1CAACB4A.43DBB67E.IP :1 RAgXyoVggbHAvTAIvtQYZrLQQEFKDBupEgJsmPIEZHLdyyHWt

* SourceKE H? ~xdddaa@Disponohu.at-AA32B1.static.rvsd.ca.charter.com :1 olKikVfuWqPGqiowJXFGTfYJXSlQQkLGHnWaFU


can anyone give me spmafilter for those kinds os bots please?
thank you

HitMan69
Posts: 14
Joined: Sat Sep 06, 2008 3:46 am
Location: Australia
Contact:

Re: Spamfilter for clones

Post by HitMan69 » Thu Sep 11, 2008 4:57 am

qOiyXuDfHjG was ~zAqlXgZiZ@60.Red-88-4-49.staticIP.rima-tde.net * g
iAdiInZnUqB was ~dVynRpCuC@193.152.160.50 * g
dPwwLmUsJxO was ~pLrvPqAaJ@89.7.58.254 * j
pQdkOcClIoC was ~mZgkQpQjS@77.226.148.60 * k
gBfuSvIfTdO was ~aCjhQwCnE@c-71-196-122-44.hsd1.fl.comcast.net * b

Stealth
Head of Support
Posts: 2086
Joined: Tue Jun 15, 2004 8:50 pm
Location: Chino Hills, CA, US
Contact:

Re: Spamfilter for clones

Post by Stealth » Thu Sep 11, 2008 5:06 am

Those last 2 results are randomly generated, and there's be no spamfilter that can block them without grabbing innocent users. You should try Syzop's antirandom module, and use different conf settings until you get what you need.

Jobe1986
Official supporter
Posts: 1177
Joined: Wed May 03, 2006 7:09 pm
Location: United Kingdom

Re: Spamfilter for clones

Post by Jobe1986 » Thu Sep 11, 2008 6:27 pm

Stealth wrote:Those last 2 results are randomly generated, and there's be no spamfilter that can block them without grabbing innocent users. You should try Syzop's antirandom module, and use different conf settings until you get what you need.
A case sensitive spamfilter should be able to catch the last example set.

Eg:
/spamfilter add u gline - Botnet! ^(?-i)[a-z][A-Z][a-z][a-z][A-Z][a-z][A-Z][a-z][A-Z][a-z][A-Z]!~?[a-z][A-Z][a-z][a-z][A-Z][a-z][A-Z][a-z][A-Z][a-z][A-Z]@[^:]+:[a-z](?i)$

HitMan69
Posts: 14
Joined: Sat Sep 06, 2008 3:46 am
Location: Australia
Contact:

Re: Spamfilter for clones

Post by HitMan69 » Wed Sep 17, 2008 3:13 am


Jobe1986
Official supporter
Posts: 1177
Joined: Wed May 03, 2006 7:09 pm
Location: United Kingdom

Re: Spamfilter for clones

Post by Jobe1986 » Thu Sep 18, 2008 11:44 am

HitMan69 try:

/spamfilter add u gline - Botnet! ^(?-i)[a-z][A-Z][a-z][a-z][A-Z][a-z][A-Z][a-z][A-Z][a-z][A-Z]!~?[a-z][A-Z][a-z][a-z][A-Z][a-z][A-Z][a-z][A-Z]([a-z][A-Z])?@[^:]+:[a-z](?i)$

HitMan69
Posts: 14
Joined: Sat Sep 06, 2008 3:46 am
Location: Australia
Contact:

Re: Spamfilter for clones

Post by HitMan69 » Sat Oct 11, 2008 2:55 am

maranello72089 was ~hall@80.80.170.161 * 6
serbia15055 was ~totti@81.172.117.33 * 2
gmc72090 was team@83.142.245.240 * 6

i checked all other spamfilters but i didnt find spamfilter to block only one number on gecos

HitMan69
Posts: 14
Joined: Sat Sep 06, 2008 3:46 am
Location: Australia
Contact:

Re: Spamfilter for clones

Post by HitMan69 » Thu Feb 05, 2009 4:53 am

FiLm75958 was ~michael@195.8.11.99 * 2
unix94082 was ~Mo@84.255.134.51 * 6

Jobe1986
Official supporter
Posts: 1177
Joined: Wed May 03, 2006 7:09 pm
Location: United Kingdom

Re: Spamfilter for clones

Post by Jobe1986 » Thu Feb 05, 2009 9:03 am

Try something like ^[a-z]+\d{5}![a-z]+@[^:]+:\d$

Where \d means [0-9] to the regex, matching only a single numeric digit as it has no modifier to make it match more or less.

HitMan69
Posts: 14
Joined: Sat Sep 06, 2008 3:46 am
Location: Australia
Contact:

Re: Spamfilter for clones

Post by HitMan69 » Wed Nov 17, 2010 3:18 am

Hello, i need spamfilter for bots that register their nicks with the email: aha@live.com
I tried this one but it doesnt works:
spamfilter {
regex "*aha@live.com*";
target private;
action gzline;
reason "Drones/Bots are banned";
};

Syzop
UnrealIRCd head coder
Posts: 1839
Joined: Sat Mar 06, 2004 8:57 pm
Location: .nl
Contact:

Re: Spamfilter for clones

Post by Syzop » Wed Nov 17, 2010 11:38 am

It could be that the bots trying to register those nicks are using '/NS REGISTER' or '/NICKSERV REGISTER' instead of MSG'ing NickServ normally, that way spamfilter won't catch them.

Perhaps your services package has some kind of blacklist which you can use instead?

Syzop
UnrealIRCd head coder
Posts: 1839
Joined: Sat Mar 06, 2004 8:57 pm
Location: .nl
Contact:

Re: Spamfilter for clones

Post by Syzop » Wed Nov 17, 2010 12:03 pm

I sometimes forget features which I've added myself. You can use alias::spamfilter to indicate whether an alias should go through spamfilter or not.
So, if you use for example anope: then instead of including aliases/anope.conf, you copy the contents of aliases/anope.conf to your config file and modify them, then you can have them spamfiltered.
As you can see, by default only memoserv is spamfiltered :)
PS: I don't suggest modifying aliases/anope.conf directly, as an upgrade will probably overwrite the changes.

Post Reply