Help with regex please

These are old archives. They are kept for historic purposes only.
Post Reply
TSoft
Posts: 14
Joined: Mon Dec 22, 2008 8:27 pm

Help with regex please

Post by TSoft » Tue Sep 04, 2012 5:58 pm

[18:51:44] <@ConnectServ> SIGNED ON user: u[^\a] (~x_@118.96.25.28 - ewbeom) at: Katrina.Uragano.Org
[18:51:44] <@ConnectServ> SIGNED ON user: i[\]^] (~a_za@118.96.206.54 - gstwnx) at: Katrina.Uragano.Org
[18:51:44] <@ConnectServ> SIGNED ON user: c[\[Z] (~j@118.96.29.192 - oukrsr) at: Katrina.Uragano.Org
[18:51:45] <@ConnectServ> SIGNED ON user: o[Z[`] (~qzz@118.96.136.238 - agjxtn) at: Katrina.Uragano.Org
[18:51:45] <@ConnectServ> SIGNED ON user: m[_^]] (~a_@113.21.228.147 - wlxwgr) at: Katrina.Uragano.Org
[18:51:50] <@ConnectServ> SIGNED ON user: d[a[[] (~zza@118.96.151.221 - nkbzxl) at: Katrina.Uragano.Org
[18:51:50] <@ConnectServ> SIGNED ON user: p[]\^] (~m_@118.96.121.17 - jwgewp) at: Katrina.Uragano.Org
[18:51:50] <@ConnectServ> SIGNED ON user: i[_`Z] (~ga_@118.96.127.10 - sndkwd) at: Katrina.Uragano.Org
[18:51:50] <@ConnectServ> SIGNED ON user: p[a^a] (~q__@118.96.135.214 - acfxsl) at: Katrina.Uragano.Org
[18:51:51] <@ConnectServ> SIGNED ON user: y[`[a] (~p_@116.193.190.67 - aswiry) at: Katrina.Uragano.Org
[18:58:12] <@ConnectServ> SIGNED ON user: z[\^_] (~vz@111.223.88.137 - rpwyac) at: Katrina.Uragano.Org
[18:58:13] <@ConnectServ> SIGNED ON user: s[[a[] (~va@112.94.190.239 - rnpozf) at: Katrina.Uragano.Org
[18:58:14] <@ConnectServ> SIGNED ON user: g[_[^] (~qaa@114.110.42.206 - ysdozi) at: Katrina.Uragano.Org
[18:58:15] <@ConnectServ> SIGNED ON user: a[^Z\] (~w@113.53.248.146 - ushykz) at: Katrina.Uragano.Org
[18:58:15] <@ConnectServ> SIGNED ON user: v[_Z`] (~va@114.110.44.85 - fvzmpi) at: Katrina.Uragano.Org
[18:58:16] <@ConnectServ> SIGNED ON user: l[\`^] (~gz_z@115.178.127.125 - yyhfdw) at: Katrina.Uragano.Org
[18:58:16] <@ConnectServ> SIGNED ON user: u[`^Z] (~uz@112.78.146.234 - wrcbwl) at: Katrina.Uragano.Org
[18:58:17] <@ConnectServ> SIGNED ON user: j[_`^] (~r@115.85.65.148 - qkufxj) at: Katrina.Uragano.Org
[18:58:18] <@ConnectServ> SIGNED ON user: q[^[a] (~v@110.139.56.143 - ascind) at: Katrina.Uragano.Org
[19:36:47] <@ConnectServ> SIGNED ON user: c[\`a] (~tz_@118.97.22.205 - jwaufr) at: Katrina.Uragano.Org
[19:36:47] <@ConnectServ> SIGNED ON user: r[aaZ] (~x_z@118.97.211.18 - qhpxzd) at: Katrina.Uragano.Org
[19:36:47] <@ConnectServ> SIGNED ON user: z[`Z_] (~wz@118.97.232.110 - rojbuk) at: Katrina.Uragano.Org
[19:36:47] <@ConnectServ> SIGNED ON user: s[a_a] (~q__z@118.96.135.214 - kqldvy) at: Katrina.Uragano.Org
[19:36:48] <@ConnectServ> SIGNED ON user: c[\aa] (~e@118.96.203.160 - jlkqwv) at: Katrina.Uragano.Org
[19:36:48] <@ConnectServ> SIGNED ON user: g[_^_] (~o_@118.97.194.49 - vgvkjy) at: Katrina.Uragano.Org
[19:36:48] <@ConnectServ> SIGNED ON user: k[a]Z] (~mz_@118.97.185.131 - jgbenz) at: Katrina.Uragano.Org
[19:36:48] <@ConnectServ> SIGNED OFF user: g[_^_] (~o_@118.97.194.49 - vgvkjy) at: Katrina.Uragano.Org - Quit: g[_^_]
[19:36:48] <@ConnectServ> SIGNED OFF user: o[\_^] (~uz@110.139.56.143 - fypdsf) at: Katrina.Uragano.Org - Quit: sokate
[19:36:48] <@ConnectServ> SIGNED OFF user: k[a]Z] (~mz_@118.97.185.131 - jgbenz) at: Katrina.Uragano.Org - Quit: k[a]Z]
[19:36:48] <@ConnectServ> SIGNED OFF user: c[\aa] (~e@118.96.203.160 - jlkqwv) at: Katrina.Uragano.Org - Quit: c[\aa]
[19:36:48] <@ConnectServ> SIGNED ON user: s[`^\] (~ca@118.97.15.228 - ybnobr) at: Katrina.Uragano.Org
[19:36:48] <@ConnectServ> SIGNED OFF user: u[_\]] (~h_aa@111.223.88.131 - fqiwsq) at: Katrina.Uragano.Org - Quit: sokate
[19:36:48] <@ConnectServ> SIGNED OFF user: r[aaZ] (~x_z@118.97.211.18 - qhpxzd) at: Katrina.Uragano.Org - Quit: r[aaZ]
[19:36:48] <@ConnectServ> SIGNED OFF user: u[[]]] (~g_@118.96.132.162 - palint) at: Katrina.Uragano.Org - Quit: u[[]]]
[19:36:48] <@ConnectServ> SIGNED OFF user: t[_\]] (~ha_@115.124.74.14 - qxejvi) at: Katrina.Uragano.Org - Quit: sokate
[19:36:49] <@ConnectServ> SIGNED OFF user: j[[_a] (~f_z@116.193.190.67 - jtrvww) at: Katrina.Uragano.Org - Quit: sokate
[19:36:49] <@ConnectServ> SIGNED OFF user: c[\\^] (~ya@111.223.88.134 - twovyn) at: Katrina.Uragano.Org - Quit: sokate
[19:36:49] <@ConnectServ> SIGNED OFF user: k[Z``] (~szz@111.68.125.150 - ryawre) at: Katrina.Uragano.Org - Quit: sokate
[19:36:49] <@ConnectServ> SIGNED OFF user: k[^\\] (~xzaz@113.98.193.140 - roofgr) at: Katrina.Uragano.Org - Quit: sokate
[19:36:49] <@ConnectServ> SIGNED OFF user: r[`\Z] (~z@115.85.65.148 - qdlltn) at: Katrina.Uragano.Org - Quit: sokate
[19:36:49] <@ConnectServ> SIGNED OFF user: h[]\[] (~o@112.94.190.239 - fcswmg) at: Katrina.Uragano.Org - Quit: sokate
[19:36:49] <@ConnectServ> SIGNED OFF user: g[^\[] (~sa@103.10.121.195 - fiqkki) at: Katrina.Uragano.Org - Quit: sokate
[19:36:49] <@ConnectServ> SIGNED OFF user: b[`]^] (~ba@111.223.88.142 - lfcmcb) at: Katrina.Uragano.Org - Quit: b[`]^]
[19:36:49] <@ConnectServ> SIGNED OFF user: s[a_a] (~q__z@118.96.135.214 - kqldvy) at: Katrina.Uragano.Org - Quit: s[a_a]
[19:36:49] <@ConnectServ> SIGNED ON user: j[aaa] (~pza@118.97.16.106 - itvacs) at: Katrina.Uragano.Org
[19:36:49] <@ConnectServ> SIGNED OFF user: j[aaa] (~pza@118.97.16.106 - itvacs) at: Katrina.Uragano.Org - Quit: j[aaa]
[19:36:49] <@ConnectServ> SIGNED OFF user: c[\`a] (~tz_@118.97.22.205 - jwaufr) at: Katrina.Uragano.Org - Quit: c[\`a]
[19:36:49] <@ConnectServ> SIGNED ON user: w[^]^] (~pa_@118.96.62.147 - mjdnox) at: Katrina.Uragano.Org
[19:36:49] <@ConnectServ> SIGNED OFF user: w[^]^] (~pa_@118.96.62.147 - mjdnox) at: Katrina.Uragano.Org - Quit: w[^]^]
[19:36:49] <@ConnectServ> SIGNED ON user: f[Z]\] (~jz_@118.96.153.181 - fbbdgq) at: Katrina.Uragano.Org
[19:36:49] <@ConnectServ> SIGNED ON user: r[aZ^] (~r_@118.97.107.82 - iwqgsm) at: Katrina.Uragano.Org

TSoft
Posts: 14
Joined: Mon Dec 22, 2008 8:27 pm

Re: Help with regex please

Post by TSoft » Tue Sep 04, 2012 9:49 pm

Is this correct ?

/spamfilter add u gline 0 DroneBot ^(.+){1}\[(.+){3}\]!(.+)@(.+)$


I have protected a single chan with this banmask ?[???]!*@*
and it works, but I need also a regex for the whole network please.

Stealth
Head of Support
Posts: 2086
Joined: Tue Jun 15, 2004 8:50 pm
Location: Chino Hills, CA, US
Contact:

Re: Help with regex please

Post by Stealth » Tue Sep 04, 2012 11:30 pm

Here are my thoughts, in no particular order:
  • Instead of doing (.+){3}, just do .{3}
  • You shouldn't need any () unless you need to create groups of possibilities like (one|two|three) or to use backreferences.
  • I see you have identd enabled, we can use that to determine the difference between a human and a bot when it comes to situations like this.
  • You should run a BOPM - see How do I set up a BOPM?, use my example configuration with my recommended blacklists and you should be OK.
  • These look like "ClonesXs" (or a derivative of such), which is why all the real-names are 6 characters.
  • Most of the username fields contain a _ character, even though it won't catch them all I would suggest only spamfiltering the ones that do.
  • There are a lot from the IP range from the 118 network, do you have a lot of users from Indonesia? Looks like a ban of 118.97.* would take care of more than half of these.
  • Lots of those IP addresses appear static. It could be that someone has access to a datacenter with lots of IP addresses.
Ok, fine, I'll give you a regex:

Code: Select all

^.\[.+\]!~.{2,4}@[^ ]+:.{6}$

TSoft
Posts: 14
Joined: Mon Dec 22, 2008 8:27 pm

Re: Help with regex please

Post by TSoft » Wed Sep 05, 2012 5:07 am

Stealth you are great, thanks a lot. I will it try out this evening. Sorry for my english. I will altough try out your BOPM configuration example. No we haven't users from Indonesia.
I set now a couple of ban :)
I let you know who it works ;)

One questione only (I would like to learn):

Can you explain me this part > [^ ]+ < just after the @

Post Reply