Page 1 of 1

new bot spammers help please

Posted: Tue Jun 29, 2021 4:28 pm
by Orobas
just had a new spammer type appear and my regex isnt too good sadly with this one... due to where it is on the user name...

we can do the username easy enough with (?-i)^[A-Z][a-z]{2,}[0-9]{3}!(~)?*@* ?? ... but i'm not sure how to put this on the realname field..

Looking for a kill on user (u) on a regex filter .. we're unreal 5.2 and we need a block on the realname field please

(https://Pam815.com/) is the current field.. but this does change.. the 3 digit variation is always there though before the .com

I know we start with a /spamfilter add -regex u kill - botspammer

but its the ending i cant work out

Re: new bot spammers help please

Posted: Tue Jun 29, 2021 5:27 pm
by alhoceima
you could try using the antirandom module

Re: new bot spammers help please

Posted: Tue Jun 29, 2021 5:37 pm
by Syzop
I would match on 3 digits followed by .com in the realname, that sounds sufficiently unique to catch this without many false positives.
That should be as easy as:

Code: Select all

:.*[0-9]{3}\.com
To explain:
  • As you know 'u' bans are placed on nick!user@host:realname, so we start the regex with : to make sure the nick!user@host part of it gets skipped/ignored (well there is the possibility of IPv6 with : in it but that's not an issue in this case)
  • The .* allows any string to follow, since there could be anything before the 123.com stuff.
  • Then the [0-9]{3} means it must match exactly 3 digits
  • And finally the \.com means it should contain .com directly after those digits.
You can make it more complex but in this case it's not really needed I think. You can also always tweak it later if needed.

Re: new bot spammers help please

Posted: Tue Jun 29, 2021 5:41 pm
by Orobas
Hiya Syzop ..

oh!!! i went all ott whilst i was waiting with ([A-Z][a-z]{2,}[0-9]{3})!.+:http.+\1\.com lmao!!!

many thanks for the followup .. you're a star

Re: new bot spammers help please

Posted: Tue Jun 29, 2021 5:41 pm
by Orobas
Hiya Syzop ..

oh!!! i went all ott with ([A-Z][a-z]{2,}[0-9]{3})!.+:http.+\1\.com lmao!!!!

many thanks for the followup .. you're a star

Re: new bot spammers help please

Posted: Tue Jun 29, 2021 5:45 pm
by alhoceima
this is a never ending game of them evading by changing patern and you having to find a regex for it

Re: new bot spammers help please

Posted: Tue Jun 29, 2021 5:46 pm
by alhoceima
instead i would target the actuall abuse instead of nicknames

Re: new bot spammers help please

Posted: Tue Jun 29, 2021 5:47 pm
by Orobas
oh we have... and its very effective ... i just wanted to go a bit more proactive