mirror of
https://github.com/pissnet/pissircd.git
synced 2025-08-06 10:15:24 +01:00
Update spamfilter.conf: convert some to 'simple' matchers and make clear
that these are just old examples from the year 2005. Also, no longer include spamfilter.conf from the example*conf by default as they do not contain any useful spamfilters nowadays.
This commit is contained in:
Bram Matthys
parent
05c4cb5e8f
commit
f111b5c1ad
4 changed files with 93 additions and 170 deletions
doc/conf
|
|
@ -42,12 +42,13 @@ include "modules.default.conf";
|
|||
* - help/help.conf for our on-IRC /HELPOP system
|
||||
* - badwords.conf for channel and user mode +G
|
||||
* - spamfilter.conf as an example for spamfilter usage
|
||||
* (commented out)
|
||||
* - operclass.default.conf contains some good operclasses which
|
||||
* you can use in your oper blocks.
|
||||
*/
|
||||
include "help/help.conf";
|
||||
include "badwords.conf";
|
||||
include "spamfilter.conf";
|
||||
//include "spamfilter.conf";
|
||||
include "operclass.default.conf";
|
||||
|
||||
/* This is the me { } block which basically says who we are.
|
||||
|
|
|
|||
|
|
@ -49,7 +49,7 @@ include "modules.default.conf";
|
|||
*/
|
||||
include "help/help.conf";
|
||||
include "badwords.conf";
|
||||
include "spamfilter.conf";
|
||||
//include "spamfilter.conf";
|
||||
include "operclass.default.conf";
|
||||
|
||||
/* Le bloc me { } indique qui est le serveur.
|
||||
|
|
|
|||
|
|
@ -49,7 +49,7 @@ include "modules.default.conf";
|
|||
*/
|
||||
include "help/help.conf";
|
||||
include "badwords.conf";
|
||||
include "spamfilter.conf";
|
||||
//include "spamfilter.conf";
|
||||
include "operclass.default.conf";
|
||||
|
||||
/* me { } bloğu genelde kim olduğumuzu belirtir.
|
||||
|
|
|
|||
|
|
@ -1,18 +1,71 @@
|
|||
/*
|
||||
* This an example spamfilter file, it contains several
|
||||
* real and useful spamfilters. This should give you an
|
||||
* idea of how powerful spamfilter can be in real-life
|
||||
* situations.
|
||||
* This configuration file contains example spamfilter rules.
|
||||
* They are real rules that were useful a long time ago.
|
||||
* Since 2005 these rules are no longer maintained.
|
||||
* The main purpose nowadays is to serve as an example
|
||||
* to give you an idea of how powerful spamfilters can
|
||||
* be in real-life situations.
|
||||
*
|
||||
* $Id$
|
||||
* Documentation on spamfilter is available at:
|
||||
* https://www.unrealircd.org/docs/Spamfilter
|
||||
*/
|
||||
|
||||
/* Guidelines on the 'action' field:
|
||||
* As a general rule we use 'action block' for any newly added
|
||||
* spamfilters at first, later on (after knowing about false
|
||||
* positives) we might change some to viruschan/kill/gline/etc..
|
||||
/* General note:
|
||||
* If you want to use a \ in a spamfilter, or in fact
|
||||
* anywhere in the configuration file, then you need
|
||||
* to escape this to \\ instead.
|
||||
*/
|
||||
|
||||
|
||||
/* First some spamfilters with match-type 'simple'.
|
||||
* The only matchers available are * and ?
|
||||
* PRO's: very fast, easy matching: everyone can do this.
|
||||
* CON's: limited ability to fine-tune spamfilters
|
||||
*/
|
||||
|
||||
spamfilter {
|
||||
match-type simple;
|
||||
match "Come watch me on my webcam and chat /w me :-) http://*:*/me.mpg";
|
||||
target private;
|
||||
action gline;
|
||||
reason "Infected by fyle trojan: see http://www.sophos.com/virusinfo/analyses/trojfylexa.html";
|
||||
};
|
||||
|
||||
/* This signature uses a \ which has to escaped to \\ in the configuration file */
|
||||
spamfilter {
|
||||
match-type simple;
|
||||
match "C:\\WINNT\\system32\\*.zip";
|
||||
target dcc;
|
||||
action block;
|
||||
reason "Infected by Gaggle worm?";
|
||||
};
|
||||
|
||||
spamfilter {
|
||||
match-type simple;
|
||||
match "Speed up your mIRC DCC Transfer by up to 75%*www.freewebs.com/mircupdate/mircspeedup.exe";
|
||||
target private;
|
||||
action gline;
|
||||
reason "Infected by mirseed trojan: see http://www.sophos.com/virusinfo/analyses/trojmirseeda.html";
|
||||
};
|
||||
|
||||
spamfilter {
|
||||
match-type simple;
|
||||
match "STOP SPAM, USE THIS COMMAND: //write nospam $decode(*) | .load -rs nospam | //mode $me +R";
|
||||
target private;
|
||||
action gline;
|
||||
reason "Infected by nkie worm: see http://www.trojaninfo.com/nkie/nkie.htm";
|
||||
};
|
||||
|
||||
|
||||
/* Now spamfilters of type 'regex'.
|
||||
* These use powerful regular expressions (Perl/PCRE style)
|
||||
* You may have to learn more about "regex" first before you
|
||||
* can use them. For example the dot ('.') has special meaning.
|
||||
*/
|
||||
|
||||
/* This regex shows a pattern which requires 20 paramaters,
|
||||
* such as "x x x x x x x x x x x x x x x x x x x x"
|
||||
*/
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "\x01DCC (SEND|RESUME)[ ]+\"(.+ ){20}";
|
||||
|
|
@ -21,6 +74,9 @@ spamfilter {
|
|||
reason "mIRC 6.0-6.11 exploit attempt";
|
||||
};
|
||||
|
||||
/* Similarly, this regex shows a pattern that matches
|
||||
* against at least 225 characters in length.
|
||||
*/
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "\x01DCC (SEND|RESUME).{225}";
|
||||
|
|
@ -29,20 +85,21 @@ spamfilter {
|
|||
reason "Possible mIRC 6.12 exploit attempt";
|
||||
};
|
||||
|
||||
/* Earlier you saw an example of a $decode exploit which used
|
||||
* match-type 'simple' and - indeed - the filter was quite simple.
|
||||
* The following uses a regex with a similar example.
|
||||
* Regular expressions are very powerful but here you can see
|
||||
* that it actually complicates writing a filter quite a bit.
|
||||
* With regex in this filter we need to escape the ( and all
|
||||
* the dots, question marks, etc. if we want to match these
|
||||
* characters in literal text.
|
||||
*/
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "Come watch me on my webcam and chat /w me :-\) http://.+:\d+/me\.mpg";
|
||||
match "^Want To Be An IRCOp\? Try This New Bug Type: //write \$decode\(.+=.?,m\) \| \.load -rs \$decode\(.+=.?,m\)$";
|
||||
target private;
|
||||
action gline;
|
||||
reason "Infected by fyle trojan: see http://www.sophos.com/virusinfo/analyses/trojfylexa.html";
|
||||
};
|
||||
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "Speed up your mIRC DCC Transfer by up to 75%.*www\.freewebs\.com/mircupdate/mircspeedup\.exe";
|
||||
target private;
|
||||
action gline;
|
||||
reason "Infected by mirseed trojan: see http://www.sophos.com/virusinfo/analyses/trojmirseeda.html";
|
||||
action block;
|
||||
reason "Spamming users with an mIRC trojan. Type '/unload -rs newb' to remove the trojan.";
|
||||
};
|
||||
|
||||
spamfilter {
|
||||
|
|
@ -53,14 +110,9 @@ spamfilter {
|
|||
reason "Infected by fagot worm: see http://www.f-secure.com/v-descs/fagot.shtml";
|
||||
};
|
||||
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "^FREE PORN: http://free:porn@([0-9]{1,3}\.){3}[0-9]{1,3}:8180$";
|
||||
target private;
|
||||
action gline;
|
||||
reason "Infected by aplore worm: see http://www.f-secure.com/v-descs/aplore.shtml";
|
||||
};
|
||||
|
||||
/* This shows a regex which specifically matches an entire line by
|
||||
* the use of ^ and $
|
||||
*/
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "^!login Wasszup!$";
|
||||
|
|
@ -69,14 +121,7 @@ spamfilter {
|
|||
reason "Attempting to login to a GTBot";
|
||||
};
|
||||
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "^!login grrrr yeah baby!$";
|
||||
target channel;
|
||||
action gline;
|
||||
reason "Attempting to login to a GTBot";
|
||||
};
|
||||
|
||||
/* An example of how to match against an IP address in text (IPv4 only) */
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "^!packet ([0-9]{1,3}\.){3}[0-9]{1,3} [0-9]{1,15}";
|
||||
|
|
@ -85,54 +130,7 @@ spamfilter {
|
|||
reason "Attempting to use a GTBot";
|
||||
};
|
||||
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "^!icqpagebomb ([0-9]{1,15} ){2}.+";
|
||||
target channel;
|
||||
action gline;
|
||||
reason "Attempting to use a GTBot";
|
||||
};
|
||||
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "^!pfast [0-9]{1,15} ([0-9]{1,3}\.){3}[0-9]{1,3} [0-9]{1,5}$";
|
||||
target channel;
|
||||
action gline;
|
||||
reason "Attempting to use a GTBot";
|
||||
};
|
||||
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "^!portscan ([0-9]{1,3}\.){3}[0-9]{1,3} [0-9]{1,5} [0-9]{1,5}$";
|
||||
target channel;
|
||||
action gline;
|
||||
reason "Attempting to use a GTBot";
|
||||
};
|
||||
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "^.u(dp)? ([0-9]{1,3}\.){3}[0-9]{1,3} [0-9]{1,15} [0-9]{1,15} [0-9]{1,15}( [0-9])*$";
|
||||
target channel;
|
||||
action gline;
|
||||
reason "Attempting to use an SDBot";
|
||||
};
|
||||
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "^.syn ((([0-9]{1,3}\.){3}[0-9]{1,3})|([a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_.-]+)) [0-9]{1,5} [0-9]{1,15} [0-9]{1,15}";
|
||||
target { channel; private; };
|
||||
action gline;
|
||||
reason "Attempting to use a SpyBot";
|
||||
};
|
||||
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "^porn! porno! http://.+\/sexo\.exe";
|
||||
target private;
|
||||
action gline;
|
||||
reason "Infected by soex trojan: see http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ%5FSOEX.A";
|
||||
};
|
||||
|
||||
/* A slightly more complex example with a partial OR matcher (|) */
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "(^wait a minute plz\. i am updating my site|.*my erotic video).*http://.+/erotic(a)?/myvideo\.exe$";
|
||||
|
|
@ -141,92 +139,16 @@ spamfilter {
|
|||
reason "Infected by some trojan (erotica?)";
|
||||
};
|
||||
|
||||
/* In regex a \ is special and needs to be escaped to \\
|
||||
* However in this configuration file, \ is also special and
|
||||
* needs to be escaped to \\ as well.
|
||||
* The result is that we need double escaping:
|
||||
* To match a \ you need to write \\\\ in the configuration file.
|
||||
*/
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "^STOP SPAM, USE THIS COMMAND: //write nospam \$decode\(.+\) \| \.load -rs nospam \| //mode \$me \+R$";
|
||||
target private;
|
||||
action gline;
|
||||
reason "Infected by nkie worm: see http://www.trojaninfo.com/nkie/nkie.htm";
|
||||
};
|
||||
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "^FOR MATRIX 2 DOWNLOAD, USE THIS COMMAND: //write Matrix2 \$decode\(.+=,m\) \| \.load -rs Matrix2 \| //mode \$me \+R$";
|
||||
target private;
|
||||
action gline;
|
||||
reason "Infected by nkie worm: see http://www.trojaninfo.com/nkie/nkie.htm";
|
||||
};
|
||||
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "^hey .* to get OPs use this hack in the chan but SHH! //\$decode\(.*,m\) \| \$decode\(.*,m\)$";
|
||||
target private;
|
||||
action gline;
|
||||
reason "Infected by nkie worm: see http://www.trojaninfo.com/nkie/nkie.htm";
|
||||
};
|
||||
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match ".*(http://jokes\.clubdepeche\.com|http://horny\.69sexy\.net|http://private\.a123sdsdssddddgfg\.com).*";
|
||||
target private;
|
||||
action gline;
|
||||
reason "Infected by LOI trojan";
|
||||
};
|
||||
|
||||
/* This is a 'general sig' which might have a tad more false positives, hence just 'block' is used */
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "C:\\WINNT\\system32\\[][0-9a-z_-{|}`]+\.zip";
|
||||
target dcc;
|
||||
action block;
|
||||
reason "Infected by Gaggle worm?";
|
||||
};
|
||||
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "C:\\WINNT\\system32\\(notes|videos|xxx|ManualSeduccion|postal|hechizos|images|sex|avril)\.zip";
|
||||
match "C:\\\\WINNT\\\\system32\\\\(notes|videos|xxx|ManualSeduccion|postal|hechizos|images|sex|avril)\.zip";
|
||||
target dcc;
|
||||
action dccblock;
|
||||
reason "Infected by Gaggle worm";
|
||||
};
|
||||
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "http://.+\.lycos\..+/[iy]server[0-9]/[a-z]{4,11}\.(gif|jpg|avi|txt)";
|
||||
target { private; quit; };
|
||||
action block;
|
||||
reason "Infected by Gaggle worm";
|
||||
};
|
||||
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "^Free porn pic.? and movies (www\.sexymovies\.da\.ru|www\.girlporn\.org)";
|
||||
target private;
|
||||
action block;
|
||||
reason "Unknown virus. Site causes Backdoor.Delf.lq infection";
|
||||
};
|
||||
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "^LOL! //echo -a \$\(\$decode\(.+,m\),[0-9]\)$";
|
||||
target channel;
|
||||
action block;
|
||||
reason "$decode exploit";
|
||||
};
|
||||
|
||||
/*
|
||||
spamfilter {
|
||||
regex "//write \$decode\(.+\|.+load -rs";
|
||||
target { private; channel; };
|
||||
reason "Generic $decode exploit";
|
||||
action block;
|
||||
};
|
||||
*/
|
||||
|
||||
spamfilter {
|
||||
match-type regex;
|
||||
match "^Want To Be An IRCOp\? Try This New Bug Type: //write \$decode\(.+=.?,m\) \| \.load -rs \$decode\(.+=.?,m\)$";
|
||||
target private;
|
||||
action block;
|
||||
reason "Spamming users with an mIRC trojan. Type '/unload -rs newb' to remove the trojan.";
|
||||
};
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue