beaconisgoodman

options {
#       negcache = 3600;
        scanlog = " /home/zwill/bopm/etc/scan.log";
};
 
IRC {
#       vhost = "0.0.0.0";
        nick = "DNSbl";
        realname = "Proxy Scanner Service";
        username = "DNSbl";
        server = "217.172.56.220";
#       password = "secret";
        port = 6667;
 
        nickserv = "privmsg nickserv :identify ***";
        oper = "DNSbl *****";
 
        mode = "+iowghrasxWt +cnNs";
 
#       mode = "+Fc-h";
 

      away = "I'm a bot.  Your messages will be ignored.";

        channel {
       
           name = "#Services";
#          key = "somekey";
 
#          invite = "privmsg chanserv :invite #bopm";
        };
       connregex = "\\*\\*\\* Notice -- Client connecting.*: ([^ ]+) \\(([^@]+)@([^\\)]+)\\) \\[([0-9\\.]+)\\].*";
#     connregex = "\\*\\*\\* ^BConnect/Exit^B -- from [^:]+: Client connecting on port [0-9]+: ([^ ]+) \\(([^@]+)@([^\\)]+)\\) \\[([0-9\\.]+)\\].*";
       connregex = "\\*\\*\\* Notice -- Client connecting on port [0-9]+: ([^ ]+) \\(([^@]+)@([^\\)]+)\\) \\[([0-9\\.]+)\\].*";
#     kline = "KLINE *@%h :Open Proxy found on your host. Please visit www.blitzed.org/proxy?ip=%i for more information.";
       kline = "GLINE +*@%i 1800 :Open proxy found on your host. Please visit www.blitzed.org/proxy?ip=%i for more information.";
#       kline = "PRIVMSG OpenServ :AKILL +3h *@%h Open proxy found on your host. Please visit www.blitzed.org/proxy?ip=%i for more information.";
 
        perform = "PROTOCTL HCN";
 
};
 
 
OPM {
Code: 
 
blacklist { 
        name = "xbl.spamhaus.org"; 
        type = "A record reply"; 
        reply { 
                4 = "CBL"; 
                5 = "NJABL"; 
                6 = "BOPM"; 
        }; 
        ban_unknown = no; 
        kline = "KLINE 60 *@%h :You are in the XBL.spamhaus.org DNSBL. http://www.spamhaus.org/query/bl?ip=%i"; 
}; 
 
blacklist { 
        name = "dnsbl.sorbs.net"; 
        type = "A record reply"; 
        reply { 
                2 = "open proxy - HTTP"; 
                3 = "open proxy - SOCKS"; 
                4 = "open proxy - MISC"; 
                5 = "open proxy - SMTP"; 
                7 = "insecure server"; 
                9 = "zombie netblock"; 
        }; 
        ban_unknown = no; 
        kline = "KLINE 60 *@%h : You are in the SORBS.net DNSBL. Please visit http://www.sorbs.net/lookup.shtml?%i"; 
}; 
 
blacklist { 
        name = "dnsbl.ahbl.org"; 
        type = "A record reply"; 
        reply { 
                2 = "open relay - mail"; 
                3 = "open proxy"; 
                6 = "insecure website"; 
                14 = "Compromised System - ddos drone/bot infected"; 
                15 = "Compromised System - relay"; 
                16 = "Compromised System - autorooter/scanner"; 
                17 = "Compromised System - worm or mass mailing virus"; 
                18 = "Compromised System - misc virus"; 
                19 = "open proxy"; 
        }; 
        ban_unknown = no; 
        kline = "KLINE 60 *@%h : You are in the AHBL.org DNSBL. Please visit http://www.ahbl.org/tools/lookup.php?ip=%i"; 
}; 
 
 
blacklist { 
        name = "ircbl.ahbl.org"; 
        type = "A record reply"; 
        reply { 
                2 = "abusive host"; 
        }; 
        ban_unknown = no; 
        kline = "KLINE 60 *@%h : Your IP is in the ircbl.ahbl.org DNSBL"; 
}; 
 
blacklist { 
        name = "tor.ahbl.org"; 
        type = "A record reply"; 
        reply { 
                2 = "tor node"; 
        }; 
        ban_unknown = no; 
        kline = "KLINE 60 *@%h : Your IP is in the tor.ahbl.org DNSBL"; 
}; 
 
blacklist { 
        name = "tor.sectoor.de"; 
        type = "A record reply"; 
        reply { 
                1 = "tor exit server"; 
        }; 
        ban_unknown = no; 
        kline = "KLINE 60 *@%h : You are in the tor.sectoor.de DNSBL. Please visit http://www.sectoor.de/tor.php?ip=%i"; 
};  
 
 
       dnsbl_from = "DNSbl@Tutelaa.net";
#       dnsbl_to = "bopm-report@dronebl.org";
       sendmail = "/usr/sbin/sendmail";
};
 
scanner {
        name="default";
        protocol = HTTP:80;
        protocol = HTTP:8080;
        protocol = HTTP:3128;
        protocol = HTTP:6588;
        protocol = SOCKS4:1080;
        protocol = SOCKS5:1080;
        protocol = ROUTER:23;
        protocol = WINGATE:23;
        protocol = HTTPPOST:80;
#       vhost = "127.0.0.1";
        fd = 512;
        max_read = 4096;
        timeout = 30;217.172.56.220
        target_ip     = "";
        target_port   = 6667;
        target_string = "*** Looking up your hostname...";
        target_string = ":-irc.TerroristIRC.net- *** Looking up your hostname...";
        target_string = "ERROR :Trying to reconnect too fast.";
};
 
scanner {
        name = "extended";
 
        protocol = HTTP:81;
        protocol = HTTP:8000;
        protocol = HTTP:8001;
        protocol = HTTP:8081;
 
        protocol = HTTPPOST:81;
        protocol = HTTPPOST:6588;
#       protocol = HTTPPOST:4480;
        protocol = HTTPPOST:8000;
        protocol = HTTPPOST:8001;
        protocol = HTTPPOST:8080;
        protocol = HTTPPOST:8081;
 
        protocol = SOCKS4:4914;
        protocol = SOCKS4:6826;
        protocol = SOCKS4:7198;
        protocol = SOCKS4:7366;
        protocol = SOCKS4:9036;
 
        protocol = SOCKS5:4438;
        protocol = SOCKS5:5104;
        protocol = SOCKS5:5113;
        protocol = SOCKS5:5262;
        protocol = SOCKS5:5634;
        protocol = SOCKS5:6552;
        protocol = SOCKS5:6561;
        protocol = SOCKS5:7464;
        protocol = SOCKS5:7810;
        protocol = SOCKS5:8130;
        protocol = SOCKS5:8148;
        protocol = SOCKS5:8520;
        protocol = SOCKS5:8814;
        protocol = SOCKS5:9100;
        protocol = SOCKS5:9186;
        protocol = SOCKS5:9447;
        protocol = SOCKS5:9578;
        protocol = SOCKS4:29992;
        protocol = SOCKS4:38884;
        protocol = SOCKS4:18844;
        protocol = SOCKS4:17771;
        protocol = SOCKS4:31121;
 
/*      fd = 400; */
};
 
user {
        mask = "*!*@*";
        scanner = "default";
};
 
user {
#       mask = "*!~*@*";
        mask = "*!squid@*";
        mask = "*!nobody@*";
        mask = "*!www-data@*";
        mask = "*!cache@*";
        mask = "*!CacheFlowS@*";
        mask = "*!*@*www*";
        mask = "*!*@*proxy*";
        mask = "*!*@*cache*";
        mask = "*!*@*tor*";
        scanner = "extended";
};
 
 
exempt {
        mask = "*!*@127.0.0.1";
};