flooders

[awyeah]

I think this should be:

Code: Select all

set vowels [regexp {[aeiouy]} $nick] 

this:

Code: Select all

set vowels [regexp -all {[aeiouy]} $nick] 

[awyeah]

To detect, these types of nicks:

Code: Select all

i556565y (~zlebots@24.3.46.214) 
u133194x (~ljfhooqv@213.163.29.5 
f639374j (~chvueri@212.103.191.71) 

Just use:

Code: Select all

if {[regexp -nocase {^[a-z]{1}[0-9]{6}[a-z]{1}$} $nick] && [string equal "~" [string index [lindex [split $uhost @] 0] 0]] && ([string length [string trimleft [lindex [spit $uhost @] 0] ~]] >= 7)} {

By the way demond, I wanted to ask you, what is the MAXIMUM THRESHOLD for your spam detector proc?

Which is the best and optimal performance threshold? I've seen it set to default on 17 or 18 normally. Any lower or higher than these numbers?

[awyeah]

Code: Select all

scan $host {%[^@]} ident
set nick_digits [llength [regexp -all -inline -- {[0-9]} $nick]]
set ident_digits [llength [regexp -all -inline -- {[0-9]} $ident]]
set no_vowels [regexp {[aeiouy]} $nick]
if {$no_vowels && $nick_digits >= 3 && $ident_digits >= 3} {
  # ban it
}

Why do we specifically need to use llength in here with -inline? isn't -all already enough with regexp? Don't you think its a bit extra?

Code: Select all

if {([regexp -all {[0-9]} $nick] >= 3) && ([regexp -all {[0-9]} [lindex [split $uhost @] 0]] >= 3) && ([regexp -all {[aeiouy]} $nick] == 0) && [string equal "~" [string index [lindex [split $uhost @] 0] 0]]} {
  # ban it
}

All we check here if, nick has 3 numbers, if ident has 3 numbers, if nick has no vowels.

Or we could do it like this, for these types of nicks:
i8148 (~e9993@201.22.23.44)

Code: Select all

if {[regexp {^[a-z]{1}[0-9]{4}$} $nick] && [regexp {^[a-z]{1}[0-9]{4}$} [lindex [split $uhost @] 0]] && [string equal "~" [string index [lindex [split $uhost @] 0] 0]] && [string equal "5" [string length $nick]] && [string equal "5" [string length [string trimleft [lindex [split $uhost @] 0] ~]]} {

[demond]

[regexp -inline] returns a list consisting of matched subexpressions, and we need to know how many of those are there (how many digits in this case), hence the [llength]

as of the maximum sb score, I don't know experiment and find it...

[Sir_Fz]

but if you use

Code: Select all

regexp -all -- {[0-9]} $nick

it'll return the same result as

Code: Select all

llength [regexp -all -inline -- {[0-9]} $nick]

That's what awyeah meant, and he's right.

[demond]

hmm that appears to be the case

in such case however, the TCL docs are incorrect:

NAME
regexp - Match a regular expression against a string
SYNOPSIS
regexp ?switches? exp string ?matchVar? ?subMatchVar subMatchVar ...?
DESCRIPTION
Determines whether the regular expression exp matches part or all of string and returns 1 if it does, 0 if it doesn't, unless -inline is specified (see below).

[Sir_Fz]

Indeed they have the -all switch explained correctly though.

-all
Causes the regular expression to be matched as many times as possible in the string, returning the total number of matches found. If this is specified with match variables, they will contain information for the last match only.

[mm]

Thanks everyone.

Demond, your procedure is working great, thank you.

I was wondering if it's possible in that procedure to ignore these special chracters or make them less sensitive _(underscore), brackets like [], {} , `[] ,\ because flooders don't use them, all they use random nick and idents.

thanks again

[demond]

this will lessen the weight of those punctuation chars:

Code: Select all

proc sb:score {str} {
   set score 0
   set vowel "aeiouy"
   set cnant "bcdfghjklmnpqrstvwxz"
   set other "{}\\\[\\\]-_^`|\\\\"
   set digit "0123456789"
   set str [string tolower $str]
   incr score [regexp -all \[$vowel\]{3,} $str] ;# 3 and more adjacent vowels
   incr score [regexp -all \[$cnant\]{3,} $str] ;# 3 and more adjacent consonants
   incr score [regexp -all \[$other\]{3,} $str] ;# 3 and more adjacent punctuation chars
   incr score [regexp -all \[$digit\]{2,} $str] ;# 2 and more adjacent digits
   incr score [regexp -all \[$vowel$other\]{4,} $str] ;# 4 or more adjacent vowel/punctuation chars
   incr score [regexp -all \[$cnant$other\]{4,} $str] ;# 4 or more adjacent consonant/punctuation chars
   incr score [regexp -all \[$vowel$digit\]{4,} $str] ;# 4 or more adjacent vowel/digits
   incr score [regexp -all \[$cnant$digit\]{4,} $str] ;# 4 or more adjacent consonant/digits
   incr score [regexp -all \[$other$digit\]{3,} $str] ;# 3 or more adjacent puncuation/digits
   incr score $score ;# double the score
}

[demond]

if you wish to eliminate those chars completely, use this:

Code: Select all

proc sb:score {str} {
   set score 0
   set vowel "aeiouy"
   set cnant "bcdfghjklmnpqrstvwxz"
   set digit "0123456789"
   set str [string tolower $str]
   incr score [regexp -all \[$vowel\]{3,} $str] ;# 3 and more adjacent vowels
   incr score [regexp -all \[$cnant\]{3,} $str] ;# 3 and more adjacent consonants
   incr score [regexp -all \[$digit\]{2,} $str] ;# 2 and more adjacent digits
   incr score [regexp -all \[$vowel$digit\]{4,} $str] ;# 4 or more adjacent vowel/digits
   incr score [regexp -all \[$cnant$digit\]{4,} $str] ;# 4 or more adjacent consonant/digits
   incr score $score ;# double the score
} 

[demond]

oops... correction, see above

[mm]

thank you so much for your help and time

[silverboy]

wcntgony is ~cpnhm@host217.200-45-47.telecom.net.ar
cxkyxkzt is ~asrbkjiu@host179.201-252-186.telecom.net.ar


can that script ban clones/drones who hav thse kind of nick and ident?

[demond]

xchannel can

[silverboy]

whats the use of that x:whois ???