Help with regex please

These are old archives. They are kept for historic purposes only.
Post Reply
TSoft
Posts: 14
Joined: Mon Dec 22, 2008 8:27 pm

Help with regex please

Post by TSoft »

[18:51:44] <@ConnectServ> SIGNED ON user: u[^\a] ([email protected] - ewbeom) at: Katrina.Uragano.Org
[18:51:44] <@ConnectServ> SIGNED ON user: i[\]^] ([email protected] - gstwnx) at: Katrina.Uragano.Org
[18:51:44] <@ConnectServ> SIGNED ON user: c[\[Z] ([email protected] - oukrsr) at: Katrina.Uragano.Org
[18:51:45] <@ConnectServ> SIGNED ON user: o[Z[`] ([email protected] - agjxtn) at: Katrina.Uragano.Org
[18:51:45] <@ConnectServ> SIGNED ON user: m[_^]] ([email protected] - wlxwgr) at: Katrina.Uragano.Org
[18:51:50] <@ConnectServ> SIGNED ON user: d[a[[] ([email protected] - nkbzxl) at: Katrina.Uragano.Org
[18:51:50] <@ConnectServ> SIGNED ON user: p[]\^] ([email protected] - jwgewp) at: Katrina.Uragano.Org
[18:51:50] <@ConnectServ> SIGNED ON user: i[_`Z] ([email protected] - sndkwd) at: Katrina.Uragano.Org
[18:51:50] <@ConnectServ> SIGNED ON user: p[a^a] ([email protected] - acfxsl) at: Katrina.Uragano.Org
[18:51:51] <@ConnectServ> SIGNED ON user: y[`[a] ([email protected] - aswiry) at: Katrina.Uragano.Org
[18:58:12] <@ConnectServ> SIGNED ON user: z[\^_] ([email protected] - rpwyac) at: Katrina.Uragano.Org
[18:58:13] <@ConnectServ> SIGNED ON user: s[[a[] ([email protected] - rnpozf) at: Katrina.Uragano.Org
[18:58:14] <@ConnectServ> SIGNED ON user: g[_[^] ([email protected] - ysdozi) at: Katrina.Uragano.Org
[18:58:15] <@ConnectServ> SIGNED ON user: a[^Z\] ([email protected] - ushykz) at: Katrina.Uragano.Org
[18:58:15] <@ConnectServ> SIGNED ON user: v[_Z`] ([email protected] - fvzmpi) at: Katrina.Uragano.Org
[18:58:16] <@ConnectServ> SIGNED ON user: l[\`^] ([email protected] - yyhfdw) at: Katrina.Uragano.Org
[18:58:16] <@ConnectServ> SIGNED ON user: u[`^Z] ([email protected] - wrcbwl) at: Katrina.Uragano.Org
[18:58:17] <@ConnectServ> SIGNED ON user: j[_`^] ([email protected] - qkufxj) at: Katrina.Uragano.Org
[18:58:18] <@ConnectServ> SIGNED ON user: q[^[a] ([email protected] - ascind) at: Katrina.Uragano.Org
[19:36:47] <@ConnectServ> SIGNED ON user: c[\`a] ([email protected] - jwaufr) at: Katrina.Uragano.Org
[19:36:47] <@ConnectServ> SIGNED ON user: r[aaZ] ([email protected] - qhpxzd) at: Katrina.Uragano.Org
[19:36:47] <@ConnectServ> SIGNED ON user: z[`Z_] ([email protected] - rojbuk) at: Katrina.Uragano.Org
[19:36:47] <@ConnectServ> SIGNED ON user: s[a_a] ([email protected] - kqldvy) at: Katrina.Uragano.Org
[19:36:48] <@ConnectServ> SIGNED ON user: c[\aa] ([email protected] - jlkqwv) at: Katrina.Uragano.Org
[19:36:48] <@ConnectServ> SIGNED ON user: g[_^_] ([email protected] - vgvkjy) at: Katrina.Uragano.Org
[19:36:48] <@ConnectServ> SIGNED ON user: k[a]Z] ([email protected] - jgbenz) at: Katrina.Uragano.Org
[19:36:48] <@ConnectServ> SIGNED OFF user: g[_^_] ([email protected] - vgvkjy) at: Katrina.Uragano.Org - Quit: g[_^_]
[19:36:48] <@ConnectServ> SIGNED OFF user: o[\_^] ([email protected] - fypdsf) at: Katrina.Uragano.Org - Quit: sokate
[19:36:48] <@ConnectServ> SIGNED OFF user: k[a]Z] ([email protected] - jgbenz) at: Katrina.Uragano.Org - Quit: k[a]Z]
[19:36:48] <@ConnectServ> SIGNED OFF user: c[\aa] ([email protected] - jlkqwv) at: Katrina.Uragano.Org - Quit: c[\aa]
[19:36:48] <@ConnectServ> SIGNED ON user: s[`^\] ([email protected] - ybnobr) at: Katrina.Uragano.Org
[19:36:48] <@ConnectServ> SIGNED OFF user: u[_\]] ([email protected] - fqiwsq) at: Katrina.Uragano.Org - Quit: sokate
[19:36:48] <@ConnectServ> SIGNED OFF user: r[aaZ] ([email protected] - qhpxzd) at: Katrina.Uragano.Org - Quit: r[aaZ]
[19:36:48] <@ConnectServ> SIGNED OFF user: u[[]]] ([email protected] - palint) at: Katrina.Uragano.Org - Quit: u[[]]]
[19:36:48] <@ConnectServ> SIGNED OFF user: t[_\]] ([email protected] - qxejvi) at: Katrina.Uragano.Org - Quit: sokate
[19:36:49] <@ConnectServ> SIGNED OFF user: j[[_a] ([email protected] - jtrvww) at: Katrina.Uragano.Org - Quit: sokate
[19:36:49] <@ConnectServ> SIGNED OFF user: c[\\^] ([email protected] - twovyn) at: Katrina.Uragano.Org - Quit: sokate
[19:36:49] <@ConnectServ> SIGNED OFF user: k[Z``] ([email protected] - ryawre) at: Katrina.Uragano.Org - Quit: sokate
[19:36:49] <@ConnectServ> SIGNED OFF user: k[^\\] ([email protected] - roofgr) at: Katrina.Uragano.Org - Quit: sokate
[19:36:49] <@ConnectServ> SIGNED OFF user: r[`\Z] ([email protected] - qdlltn) at: Katrina.Uragano.Org - Quit: sokate
[19:36:49] <@ConnectServ> SIGNED OFF user: h[]\[] ([email protected] - fcswmg) at: Katrina.Uragano.Org - Quit: sokate
[19:36:49] <@ConnectServ> SIGNED OFF user: g[^\[] ([email protected] - fiqkki) at: Katrina.Uragano.Org - Quit: sokate
[19:36:49] <@ConnectServ> SIGNED OFF user: b[`]^] ([email protected] - lfcmcb) at: Katrina.Uragano.Org - Quit: b[`]^]
[19:36:49] <@ConnectServ> SIGNED OFF user: s[a_a] ([email protected] - kqldvy) at: Katrina.Uragano.Org - Quit: s[a_a]
[19:36:49] <@ConnectServ> SIGNED ON user: j[aaa] ([email protected] - itvacs) at: Katrina.Uragano.Org
[19:36:49] <@ConnectServ> SIGNED OFF user: j[aaa] ([email protected] - itvacs) at: Katrina.Uragano.Org - Quit: j[aaa]
[19:36:49] <@ConnectServ> SIGNED OFF user: c[\`a] ([email protected] - jwaufr) at: Katrina.Uragano.Org - Quit: c[\`a]
[19:36:49] <@ConnectServ> SIGNED ON user: w[^]^] ([email protected] - mjdnox) at: Katrina.Uragano.Org
[19:36:49] <@ConnectServ> SIGNED OFF user: w[^]^] ([email protected] - mjdnox) at: Katrina.Uragano.Org - Quit: w[^]^]
[19:36:49] <@ConnectServ> SIGNED ON user: f[Z]\] ([email protected] - fbbdgq) at: Katrina.Uragano.Org
[19:36:49] <@ConnectServ> SIGNED ON user: r[aZ^] ([email protected] - iwqgsm) at: Katrina.Uragano.Org
TSoft
Posts: 14
Joined: Mon Dec 22, 2008 8:27 pm

Re: Help with regex please

Post by TSoft »

Is this correct ?

/spamfilter add u gline 0 DroneBot ^(.+){1}\[(.+){3}\]!(.+)@(.+)$


I have protected a single chan with this banmask ?[???]!*@*
and it works, but I need also a regex for the whole network please.
Stealth
Head of Support
Posts: 2086
Joined: Tue Jun 15, 2004 8:50 pm
Location: Chino Hills, CA, US
Contact:

Re: Help with regex please

Post by Stealth »

Here are my thoughts, in no particular order:
  • Instead of doing (.+){3}, just do .{3}
  • You shouldn't need any () unless you need to create groups of possibilities like (one|two|three) or to use backreferences.
  • I see you have identd enabled, we can use that to determine the difference between a human and a bot when it comes to situations like this.
  • You should run a BOPM - see How do I set up a BOPM?, use my example configuration with my recommended blacklists and you should be OK.
  • These look like "ClonesXs" (or a derivative of such), which is why all the real-names are 6 characters.
  • Most of the username fields contain a _ character, even though it won't catch them all I would suggest only spamfiltering the ones that do.
  • There are a lot from the IP range from the 118 network, do you have a lot of users from Indonesia? Looks like a ban of 118.97.* would take care of more than half of these.
  • Lots of those IP addresses appear static. It could be that someone has access to a datacenter with lots of IP addresses.
Ok, fine, I'll give you a regex:

Code: Select all

^.\[.+\]!~.{2,4}@[^ ]+:.{6}$
TSoft
Posts: 14
Joined: Mon Dec 22, 2008 8:27 pm

Re: Help with regex please

Post by TSoft »

Stealth you are great, thanks a lot. I will it try out this evening. Sorry for my english. I will altough try out your BOPM configuration example. No we haven't users from Indonesia.
I set now a couple of ban :)
I let you know who it works ;)

One questione only (I would like to learn):

Can you explain me this part > [^ ]+ < just after the @
Post Reply