Spam bots, regex idiot

These are old archives. They are kept for historic purposes only.
Post Reply
Nettworkz
Posts: 10
Joined: Wed Dec 01, 2004 6:29 pm

Spam bots, regex idiot

Post by Nettworkz » Thu Jan 19, 2006 8:27 pm

I've been setting up several spam filters for a ton of bots that have invaded our lil IRC network. Been fairly successful really.

Unfortunately today they've changed their message, and I'm too stupid to figure out the proper REGEX for it (yes, I have the regex docs, and will be studying it diligently). But is there anyone with more experience that can tell me how to block..


Jason
Posts: 570
Joined: Mon Jun 14, 2004 5:09 pm

Re: Spam bots, regex idiot

Post by Jason » Thu Jan 19, 2006 10:10 pm

[quote="Nettworkz"]
Why the hell can't my signature be empty?
"Your message contains too few characters."

Syzop
UnrealIRCd head coder
Posts: 1889
Joined: Sat Mar 06, 2004 8:57 pm
Location: .nl
Contact:

Post by Syzop » Thu Jan 19, 2006 10:18 pm

hint: spamfilter strips color and control codes :P. So you need to match against the "plaintext".

Nettworkz
Posts: 10
Joined: Wed Dec 01, 2004 6:29 pm

Re: Spam bots, regex idiot

Post by Nettworkz » Thu Jan 19, 2006 11:26 pm

Jason wrote:
Nettworkz wrote:

Code: Select all

/spamfilter + cpnN gzline 14d Spam Y( *\x03[0-9]{1,2}(,[0-9]{1,2})? *x03[0-9]{1,2}(,[0-9]{1,2})?.*)S\1Y\1A\1N\1i\1M\1(.\1)?\1C\1O\1M
Hmm, tried this one, doesn't seem to have worked. Note the first character isn't a Y it's actually a Ã

Syzop
UnrealIRCd head coder
Posts: 1889
Joined: Sat Mar 06, 2004 8:57 pm
Location: .nl
Contact:

Post by Syzop » Fri Jan 20, 2006 12:16 am

Just matching on the plaintext would be sufficient.
Below is a regex that matches on "Ã

Guest

Post by Guest » Fri Jan 20, 2006 3:27 am

[quote="Syzop"]Just matching on the plaintext would be sufficient.
Below is a regex that matches on "Ã

Jason
Posts: 570
Joined: Mon Jun 14, 2004 5:09 pm

Post by Jason » Fri Jan 20, 2006 5:35 am

Damn. Wish I would have known that when I concocted that mess of a spamfilter.

Anyhow, just because im a obsessive little freak: the [] around the space is not strictly nessecary.
Why the hell can't my signature be empty?
"Your message contains too few characters."

Syzop
UnrealIRCd head coder
Posts: 1889
Joined: Sat Mar 06, 2004 8:57 pm
Location: .nl
Contact:

Post by Syzop » Fri Jan 20, 2006 1:34 pm

True.

Cavendish
Posts: 5
Joined: Thu Dec 22, 2005 6:16 pm

Post by Cavendish » Sat Jan 21, 2006 4:18 pm

hi

on my network running this rulez fine

.*Ã

McTerry
Posts: 64
Joined: Tue Oct 19, 2004 12:42 am
Location: *.se
Contact:

Post by McTerry » Sun Jan 22, 2006 9:39 am

To bad I'm so stupid that I find REGEX soooooooooo hard to learn. :(
BOOM!

aquanight
Official supporter
Posts: 862
Joined: Tue Mar 09, 2004 10:47 pm
Location: Boise, ID

Post by aquanight » Sun Jan 22, 2006 6:27 pm


chasingsol

Post by chasingsol » Thu Feb 02, 2006 3:29 am

I got a different message from apparently the same type of bot.

Code: Select all

[MuMy] *w*V*w*.i*s*y*a*n*i*m*.Ç0m *C**A*N*L*Ã

Post Reply