Stuff

blacklist { 
        name = "dnsbl.dronebl.org"; 
        type = "A record reply"; 
        reply { 
                2 = "Sample"; 
                3 = "IRC Drone"; 
                4 = "Tor"; 
                5 = "Bottler"; 
		    6 = "Unknown spambot or drone";
                7 = "DDOS Drone"; 
                8 = "SOCKS Proxy"; 
                9 = "HTTP Proxy"; 
                10 = "ProxyChain"; 
                255 = "Unknown"; 
        }; 
        ban_unknown = no; 
        kline = "GZLINE *@%i 1440m :You have a host listed in the DroneBL. For more information, visit http://dronebl.org/lookup_branded.do?ip=%i&network=Sythe"; 
};

blacklist {
     name = "tor.dnsbl.sectoor.de";
     type = "A record reply";
     reply {
     1 = "Tor exit server";
     };
     ban_unknown = no;
     kline = "GZLINE *@%i 1440m :Tor exit server detected.";
};
blacklist { 
        name = "ircbl.ahbl.org"; 
        type = "A record reply"; 
        reply { 
                2 = "abusive host"; 
        }; 
        ban_unknown = no; 
        kline = "GZLINE *@%i 1440m :Your IP is in the ircbl.ahbl.org DNSBL"; 
}; 

blacklist { 
        name = "tor.ahbl.org"; 
        type = "A record reply"; 
        reply { 
                2 = "tor node"; 
        }; 
        ban_unknown = no; 
        kline = "GZLINE *@%i 1440m :Your IP is in the tor.ahbl.org DNSBL"; 
};
/*
blacklist { 
name = "list.dsbl.org"; 
type = "A record reply"; 
reply { 
2 = "Open Proxy"; 
}; 
ban_unknown = no; 
kline = "GZLINE *@%i 1440m :Open proxy found on your host, please visit dsbl.org/listing?%i"; 
};
*/
};
scanner {
	name="default";
	protocol = HTTP:80;
	protocol = HTTP:8080;
	protocol = HTTP:3128;
	protocol = HTTP:6588;
	protocol = SOCKS4:1080;
	protocol = SOCKS5:1080;
	protocol = ROUTER:23;
	protocol = WINGATE:23;
	protocol = HTTPPOST:80;
	vhost = "72.20.17.134";
	fd = 512;
	max_read = 4096;
	timeout = 30;
	target_ip     = "72.20.17.134";
	target_port   = 6667;
	target_string = "*** Looking up your hostname...";
#	target_string = ":server.yournetwork.org NOTICE AUTH :*** Looking up your hostname...";
	target_string = "ERROR :Trying to reconnect too fast.";
	target_string = "ERROR :Your host is trying to (re)connect too fast -- throttled.";
};

scanner {
	name = "extended";

	protocol = HTTP:80;
	protocol = HTTP:81;
	protocol = HTTP:3128;
	protocol = HTTP:6588;
	protocol = HTTP:8000;
	protocol = HTTP:8001;
	protocol = HTTP:8081;
	protocol = HTTP:9030;
	protocol = HTTP:9001;

	protocol = HTTPPOST:80;
	protocol = HTTPPOST:81;
	protocol = HTTPPOST:6588;
	protocol = HTTPPOST:4480;
	protocol = HTTPPOST:8000;
	protocol = HTTPPOST:8001;
	protocol = HTTPPOST:8080;
	protocol = HTTPPOST:8081;
	protocol = HTTPPOST:9030;
	protocol = HTTPPOST:9001;

	/*
	 * IRCnet have seen many socks5 on these ports, more than on the
	 * standard ports even.
	 */
	protocol = SOCKS4:1080;
	protocol = SOCKS4:4914;
	protocol = SOCKS4:6826;
	protocol = SOCKS4:7198;
	protocol = SOCKS4:7366;
	protocol = SOCKS4:9036;
	protocol = SOCKS4:9030;
	protocol = SOCKS4:9001;

	protocol = SOCKS5:1080;
	protocol = SOCKS5:4438;
	protocol = SOCKS5:5104;
	protocol = SOCKS5:5113;
	protocol = SOCKS5:5262;
	protocol = SOCKS5:5634;
	protocol = SOCKS5:6552;
	protocol = SOCKS5:6561;
	protocol = SOCKS5:7464;
	protocol = SOCKS5:7810;
	protocol = SOCKS5:8130;
	protocol = SOCKS5:8148;
	protocol = SOCKS5:8520;
	protocol = SOCKS5:8814;
	protocol = SOCKS5:9100;
	protocol = SOCKS5:9186;
	protocol = SOCKS5:9447;
	protocol = SOCKS5:9578;
	protocol = SOCKS5:9030;
	protocol = SOCKS5:9100;
	protocol = ROUTER:23;
	protocol = WINGATE:23;
	protocol = SOCKS4:29992;
	protocol = SOCKS4:38884;
	protocol = SOCKS4:18844;
	protocol = SOCKS4:17771;
	protocol = SOCKS4:31121;
	fd = 512;
      vhost = "72.20.17.134";
	max_read = 4096;
	timeout = 30;
	target_ip     = "72.20.17.134";
	target_port   = 6667;
	target_string = "*** Looking up your hostname...";
	target_string = "ERROR :Trying to reconnect too fast.";

};