unrealircd/spamfilter.conf

/*
 * This an example spamfilter file, it contains several
 * real and useful spamfilters. This should give you an
 * idea of how powerful spamfilter can be in real-life
 * situations.
 *
 * $Id$
 */

spamfilter {
	regex ".* .* .* .* .* .* .* .* .* .* .* .* .* .*";
	target dcc;
	reason "mIRC exploit attempt";
	action kill;
};

spamfilter {
	regex "Come watch me on my webcam and chat w/me";
	target private;
	reason "Infected by FYLE trojan: see http://www.sophos.com/virusinfo/analyses/trojfylexa.html";
	action block;
};

spamfilter {
	regex "Speed up your mIRC DCC Transfer by up to 75%.*www\.freewebs\.com/mircupdate/mircspeedup.exe";
	target private;
	reason "Infected by MIRSEED trojan: see http://www.sophos.com/virusinfo/analyses/trojmirseeda.html";
	action block;
};

spamfilter {
	regex "^http://www\.angelfire\.com/[a-z0-9]+/[a-z0-9]+/[a-z_]+\.jpg <- .*!";
	target private;
	reason "Infected by fagot worm: see http://www.f-secure.com/v-descs/fagot.shtml";
	action block;
};

spamfilter {
	regex "^FREE PORN: http://free:porn@([0-9]{1,3}\.){3}[0-9]{1,3}:8180$";
	target private;
	reason "Infected by aplore worm: see http://www.f-secure.com/v-descs/aplore.shtml";
	action block;
};

spamfilter {
	regex "^!login Wasszup!$";
	target channel;
	reason "Attempting to login to a GTBot";
	action block;
};

spamfilter {
	regex "^!login grrrr yeah baby!$";
	target channel;
	reason "Attempting to login to a GTBot";
	action block;
};

spamfilter {
	regex "^!packet ([0-9]{1,3}\.){3}[0-9]{1,3} [0-9]+";
	target channel;
	reason "Attempting to use a GTBot";
	action block;
};

spamfilter {
	regex "^!icqpagebomb ([0-9]+ ){2}.+";
	target channel;
	reason "Attempting to use a GTBot";
	action block;
};

spamfilter {
	regex "^!pfast [0-9]+ ([0-9]{1,3}\.){3}[0-9]{1,3} [0-9]{1,5}$";
	target channel;
	reason "Attempting to use a GTBot";
	action block;
};

spamfilter {
	regex "^!portscan ([0-9]{1,3}\.){3}[0-9]{1,3} [0-9]{1,5} [0-9]{1,5}$";
	target channel;
	reason "Attempting to use a GTBot";
	action block;
};

spamfilter {
	regex "^.syn ((([0-9]{1,3}\.){3}[0-9]{1,3})|([a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_.-]+)) [0-9]{1,5} [0-9]{1,15} [0-9]{1,15}";
	target { channel; private; };
	reason "Attempting to use a SpyBot (syn flood command)";
	action block;
};