From f835fcb3a67eb008090b78cdfbd30338b7342a4e Mon Sep 17 00:00:00 2001
From: William Heimbigner <william.heimbigner@gmail.com>
Date: Wed, 8 Feb 2012 04:46:03 +0000
Subject: maintenance checkin, plus better last measure detection, plus xchat
 exploit detection, and some other stuff

---
 config-default/channels.xml | 45 +++++++++++++++++++++++++++++++++++++++------
 1 file changed, 39 insertions(+), 6 deletions(-)

(limited to 'config-default')

diff --git a/config-default/channels.xml b/config-default/channels.xml
index 8b6ec5a..f13fe2a 100644
--- a/config-default/channels.xml
+++ b/config-default/channels.xml
@@ -1,4 +1,5 @@
 <channels>
+  <channel id="##English" />
   <channel id="##asb-debug" monitor="no">
     <hilights></hilights>
   </channel>
@@ -9,6 +10,10 @@
     <hilights></hilights>
     <msgs></msgs>
   </channel>
+  <channel id="##asb-testing" op="no">
+    <hilights></hilights>
+    <msgs></msgs>
+  </channel>
   <channel id="##c++" silence="yes">
     <hilights>
       <debug>tomaw</debug>
@@ -19,6 +24,7 @@
     <hilights></hilights>
     <msgs></msgs>
   </channel>
+  <channel id="##english" op="no" silence="yes" />
   <channel id="##hamradio" silence="yes">
     <hilights></hilights>
     <msgs>
@@ -65,6 +71,7 @@
   <channel id="##wikia">
     <hilights>
       <debug>charitwo</debug>
+      <debug>charitwo</debug>
     </hilights>
     <msgs></msgs>
   </channel>
@@ -191,9 +198,26 @@
     <msgs></msgs>
   </channel>
   <channel id="#reddit">
+    <hilights>
+      <debug>KyleXY</debug>
+      <debug>kylexy</debug>
+      <debug>TheMoonMaster</debug>
+      <debug>Paradox</debug>
+      <debug>Mortvert</debug>
+      <debug>isky</debug>
+      <debug>Paradox</debug>
+    </hilights>
+    <msgs>
+      <debug>#reddit-priv</debug>
+    </msgs>
+  </channel>
+  <channel id="#reddit-downtime" op="no">
     <hilights></hilights>
-    <msgs></msgs>
+    <msgs>
+      <debug>#reddit-priv</debug>
+    </msgs>
   </channel>
+  <channel id="#reddit-priv" op="no" />
   <channel id="#rubyonrails">
     <hilights></hilights>
     <msgs></msgs>
@@ -288,7 +312,10 @@
       <debug>#wikimedia-ops</debug>
     </msgs>
   </channel>
-  <channel id="#wikimedia-stewards" />
+  <channel id="#wikimedia-stewards">
+    <hilights></hilights>
+    <msgs></msgs>
+  </channel>
   <channel id="#wikimedia-tech" silence="yes">
     <hilights></hilights>
     <msgs>
@@ -428,6 +455,9 @@
       <debug>Snowolf</debug>
       <debug>Tanvir</debug>
       <debug>TBloemink</debug>
+      <debug>Barras</debug>
+      <debug>Barras</debug>
+      <debug>Ocaasi</debug>
       <low>KFP</low>
       <low>chzz</low>
       <low>Gfoley4</low>
@@ -442,6 +472,7 @@
       <low>#wikimedia-ops</low>
     </msgs>
   </channel>
+  <channel id="default" />
   <channel id="master">
     <event id="advflood" class="advsplitflood" reason="advanced distributed flooding" risk="debug" type="public,part,caction">5:3</event>
     <event id="ahbl" class="dnsbl" reason="host $evhost is in dnsbl.ahbl.org ( $xresult )" risk="info" type="join" xresult="Open proxy cat 1">dnsbl.ahbl.org</event>
@@ -457,12 +488,14 @@
     <event id="dcc-topic" class="re" reason="setting a bad topic" risk="medium" type="topic">\bDCC SEND </event>
     <event id="debugme" class="re" reason="sending a string designed to trigger a debug test alert, disregard this" risk="debug" type="public">debugantispambotdebug</event>
     <event id="dronebl" class="dnsbl" reason="host $evhost is in dnsbl.dronebl.org ( $xresult )" risk="info" type="join">dnsbl.dronebl.org</event>
-    <event id="efnetbl" class="dnsbl" reason="host $evhost is in rbl.efnetrbl.org ( $xresult )" risk="info" type="join" xresult="TOR exit server">rbl.efnetrbl.org</event>
+    <event id="efnetbl" class="dnsbl" reason="host $evhost is in rbl.efnetrbl.org ( $xresult )" risk="info" type="join" xresult="Open proxy">rbl.efnetrbl.org</event>
     <event id="genspam1" class="re" reason="generic spamming" risk="debug" type="public">([^ ]{4,} +)\1{5,}</event>
+    <event id="genspam2" class="re" reason="generic spamming v2" risk="debug" type="public,caction">^(?:([A-Za-z0-9,.])(?!\1\1)){30,}$</event>
+    <event id="gnaaquit" class="re" reason="quitting with a GNAA message" risk="medium" type="quit">(?i)\bgnaa\b</event>
     <event id="joinflood" class="floodqueue" reason="join flood (5 joins in 20 seconds)" risk="medium" type="join">5:20</event>
     <event id="keylogger" class="re" override="keylogger-medium" reason="using the norton start-key-logger exploit" risk="high" type="public">^startkeylogger$|^stopkeylogger$</event>
     <event id="keylogger-medium" class="re" reason="using the norton start-key-logger exploit" risk="medium" type="public">\bstartkeylogger\b|\bstopkeylogger\b</event>
-    <event id="last_measure_regex" class="re" reason="posting what appears to be a last measure link" risk="high" type="public">(?i)(http://\S+\.on\.nimp\.org|http://feenode.net)</event>
+    <event id="last_measure_regex" class="re" reason="posting what appears to be a last measure link" risk="high" type="public">(?i)(http://(\S+\.)?on\.nimp\.org|http://(\S+\.)?feenode.net|http://wikipaste\.eu|http://(\S+\.)?bioghost\.com|http://(\S+\.)?on\.zoy\.org|http://(lastmeasure|dirtysanchez|doom3|freeipods|halflife2|halo2|lastmeasure4|lastmeasureunified|softmeasure|traceroute)\.zoy\.org)</event>
     <event id="levenflood" class="levenflood" override="flood-5to3" reason="levenshtein flood match" risk="debug" type="public">contentisuseless</event>
     <event id="massflood" class="splitflood" reason="distributed flooding" risk="high" type="public,part,caction">4:4</event>
     <event id="nickspam" class="nickspam" reason="nickspamming" risk="high" type="public">60:10</event>
@@ -473,10 +506,10 @@
     <event id="proxybl" class="dnsbl" reason="host $evhost is in dnsbl.proxybl.org" risk="info" type="join">dnsbl.proxybl.org</event>
     <event id="redarmyoflol" class="re" reason="parting with 'red army of lol'" risk="low" type="part">RED ARMY OF LOL</event>
     <event id="sms_spam" class="re" reason="spam link / virus" risk="low" type="public">\.com/sms.exe</event>
-    <event id="sorbsbl" class="dnsbl" reason="host $evhost is in dnsbl.sorbs.net ( $xresult )" risk="info" type="join">dnsbl.sorbs.net</event>
+    <event id="sorbsbl" class="dnsbl" reason="host $evhost is in dnsbl.sorbs.net ( $xresult )" risk="info" type="join" xresult="HTTP Proxy">dnsbl.sorbs.net</event>
     <event id="suckmynick" class="re" reason="using a potentially offensive nick" risk="low" type="join">(suck.*dick)</event>
     <event id="wikifags2" class="re" reason="saying 'sure are a lot of wikifag'..." risk="low" type="public">(?i)^sure are a ?lot of .*fags? in here</event>
-    <event id="gnaaquit" class="re" reason="quitting with a GNAA message" risk="medium" type="quit">(?i)\bgnaa\b</event>
+    <event id="xchatexploit" class="re" reason="using an x-chat for windows unicode exploit" risk="high" type="public,part,quit,caction" xresult="1">&#243;&#160;&#129;&#159;</event>
     <hilights>
       <debug>ST47</debug>
       <debug>pctony</debug>
-- 
cgit v1.2.3