;========================
on *:START:{
  if (!$hget(security)) { hmake security 500 }
  echo -a [SECURITY] Oper Security Sistemi Aktif.
}

;========================
; JOIN Eventleri
;========================
on *:JOIN:#:{
  var %ip = $gettok($address($nick,2),2,64)
  if (%ip == $null) return

  ; --- Şüpheli Nick Kontrol ---
  if ($regex($nick,/^(bot|guest|test|hack|root|spam)/i)) {
    if ($me isoper) {
      raw GLINE +*@ $+ %ip 900 Şüpheli Nick
      echo -a [SECURITY] Nick G-line: $nick (%ip)
      return
    }
  }

  ; --- Şüpheli Ident Kontrol ---
  if ($regex($address($nick,1),/^(~?(root|admin|staff|hack|bot))/i)) {
    if ($me isoper) {
      raw GLINE +*@ $+ %ip 1200 Şüpheli Ident
      echo -a [SECURITY] Ident G-line: $nick (%ip)
      return
    }
  }

  ; --- Flood Kontrolu (10 saniye içinde 3 join) ---
  if ($hget(security,%ip)) {
    var %data = $v1
    var %count = $gettok(%data,1,32)
    var %time = $gettok(%data,2,32)

    if ($calc($ctime - %time) < 10) {
      inc %count
      if (%count >= 3) {
        if ($me isoper) {
          raw GLINE +*@ $+ %ip 1800 Botnet Flood
          echo -a [SECURITY] Flood G-line: %ip
          hdel security %ip
          return
        }
      }
      hadd security %ip %count $ctime
    }
    else {
      hadd security %ip 1 $ctime
    }
  }
  else {
    hadd security %ip 1 $ctime
  }
}

;========================
; Manuel GLINE Komutu
;========================
alias sgline {
  if ($me !isoper) { echo -a Oper değilsin. | return }
  if ($1 == $null) { echo -a Kullanım: /sgline nick süre sebep | return }
  var %nick = $1
  var %sure = $2
  var %sebep = $3-
  raw GLINE +*@ $+ $ip(%nick) %sure %sebep
  echo -a [SECURITY] Manuel G-line atıldı: %nick
}

;========================
; Ops ve Logging
;========================
alias seclog {
  echo -a [SECURITY LOG] $1-
}