Regex required please.

These are old archives. They are kept for historic purposes only.
Post Reply
hippytyre
Posts: 8
Joined: Wed Feb 13, 2008 7:54 pm

Regex required please.

Post by hippytyre »

Hi

Could anyone provide me with a regex for my spamfilter please. As you can see AntiRandom is doing a pretty good job with them already but I think a spamfilter entry would be the best solution.

Code: Select all

[16:18:12] -fetish.datawhore.net- *** Notice -- [antirandom] denied access to user with score 12: XP|USA|000|[email protected]:XP|USA|000|647825
[16:18:12] -fetish.datawhore.net- *** Notice -- [antirandom] denied access to user with score 19: [email protected]:n-886536
[16:18:12] -fetish.datawhore.net- *** Notice -- [antirandom] denied access to user with score 18: [email protected]:n-937447
[16:18:12] -fetish.datawhore.net- *** Notice -- [antirandom] denied access to user with score 12: XP|USA|000|[email protected]:XP|USA|000|987509

xSillyNubx isn't always the ident though, that seems to be random too now and then.


Thanks
mad_dog
Posts: 6
Joined: Mon Aug 30, 2004 4:13 pm
Location: usa

Re: Regex required please.

Post by mad_dog »

Hello
Im seeing these as well.
perhaps this will help more
(there are many of these)

nick: SVK[XP|SP1]00[L]236750
[email protected]
name: SVK[XP|SP1]00[L]236750

nick: FRA[2K|SP4]00[D]050065
[email protected]
name: FRA[2K|SP4]00[D]050065

Thanks for any assist
SLipKnOt
Posts: 42
Joined: Sat Apr 10, 2004 6:43 pm
Location: Bangladesh , dhaka
Contact:

Re: Regex required please.

Post by SLipKnOt »

As u are using antirandom u can change the action to gline that will work same as spamfilter. you can try these regex see if those works.

Code: Select all

XP|USA|000|647825 = /spamfilter add u gzline 10d Drone_Bot (?-i)^(.+)!xSillyNubx@[^:]+:(?-i)\1
n-937447 = /spamfilter add u gzline 10d Drone_Bot (?-i)^(n\-\d{6}).*![a-z]{6}@[^:]+:\1
SVK[XP|SP1]00[L]236750 = /spamfilter add u gzline 10d Drone_Bot ^([A-Z]{3}\[.+\|.+\]\d{2}\[.+\]\d{6})!.+@[^:]+:\1
./SLipKnOt --help
hippytyre
Posts: 8
Joined: Wed Feb 13, 2008 7:54 pm

Re: Regex required please.

Post by hippytyre »

Thanks very much, I'll try those out now. The bots have actually stopped joining my network and never actually ever got to join any channels but I'm sure they will be back.
JRBlood
Posts: 12
Joined: Sat Apr 12, 2008 8:20 pm
Location: Syracuse, NY USA
Contact:

Re: Regex required please.

Post by JRBlood »

Your bots look very similar to ones trying to join my network.

These filters have worked out great for me:

Code: Select all

/spamfilter add u gzline 90d |Evil_Bots_S| \|XPSP[0-9]\|
/spamfilter add u gzline 90d |Evil_Bots| \|[0-9][0-9]\|[0-9][0-9][0-9]\|
The first one catches anyone with |XPSP#|
The second one catches anyone with |##|###|

Example nicks caught by the first filter:
N02|192|USA|XPSP3|Valerie|QF
N00|192|USA|XPSP2|Lost

This one would get caught by either filter:
|00|192|USA|XPSP0|ALLENLISA|PL

The bots join #babu3, but that's all I know about them. Whois info shows the bots announcing themselves as bots (+B). They've been trying to connect since April 16th, and are still trying.
Image
RaveTrax.com - "Its not a state of mind, Its a way of life."
» Audio Streams - MP3 - 160k MP3 - 64k MP3 - 24k MP3
» Audio Streams - AAC+ - 64k aacPlus v2 - 24k aacPlus v2
Post Reply