regex for nick, ident and gecos

[greg27]

i have some spambots connecting to my network - each have eight random letters as their nick, ident and realname
eg. (11:02:58pm) —› JVQOMUTF is "DINKYHQB" (PCFDJKRD@F3C420BA.A17C8079.7B2132C8.IP)

is there any way to set a regex which matches this only if all the characters are in caps?

[wolverine]

I am having same issue. have set channels to +R for time being.
way too many spam urls to set a filter for urls
any assist would be appreciated, these things are in a large quantity using notices
and pms to spam urls.
SXBYENUX (YEPMCCSV@67-93-124-91.pool.ukrtel.net)
FWUOYUPW (CSSMGTEK@190.50.183.18)
EHFLTTFG (KVMBJZDM@tlapnet.cust.sloane.cz)

EHFLTTFG was KVMBJZDM@tlapnet.cust.sloane.cz * QLBYYXBS
EHFLTTFG using ************** Tue Jan 8 08:25:01 2008
End of WHOWAS

FWUOYUPW was CSSMGTEK@190.50.183.18 * RIRKMYTS
FWUOYUPW using ************ Tue Jan 8 08:29:46 2008
End of WHOWAS

[Stealth]

Try this:

Code: Select all

^(?-i)[A-Z]{8}!~?[A-Z]{8}@[^:]+:[A-Z]{8}$

[wolverine]

Thanks! So Far so Good

[Spamfilter] IUONKTRD!OBECHJQB@122.53.86.254 matches filter '^(?-i)[A-Z]{8}!~?[A-Z]{8}@[^:]+:[A-Z]{8}$': [NICK: 'IUONKTRD!OBECHJQB@122.53.86.254:CGLJXFOY'] [SpamDrone0108]

[greg27]

thanks a lot, problem solved (for now)!

[outz]

thanks guys... ive been having this problem recently as well. my bot has probably glined well over 500 ip's... whoever it is has a lot of resources.

[WilliamWIkked]

Thanks a lot! My net is under attack by these bots too and this spamfilter is a lot better than mine (which only bans when they notice) because it's annoying seeing the ones who don't notice keep joining and parting. Now they're all gone =)

ps thank's greg for showing me this topic =)

[X-Trancer]

A New Problem whit the Bots see whois ^^

((10:30:05)) <ReVoLt> RSDRTBGQ is ds2007@D5163DB7.C3A90884.FB0D764B.IP * VOQEQWTC
((10:30:06)) <ReVoLt> RSDRTBGQ is using modes +ix
((10:30:06)) <ReVoLt> RSDRTBGQ is connecting from *@82.79.160.112 82.79.160.112
((10:30:06)) <ReVoLt> RSDRTBGQ using Ptown.German-IRC.net .::Ptown.German-IRC.net::. }{Düsseldorf}{
((10:30:06)) <ReVoLt> RSDRTBGQ End of /WHOIS list.

the ident is not Caps and not 8 letters

[Jobe]

Try:

Code: Select all

^(?-i)[A-Z]{8}!~?[^@]+@[^:]+:[A-Z]{8}$