alias tor_ { 
  if ($1) { 
    inc %xx
    sockopen $+(tor*,%xx) rbls.org 80
    sockmark $+(tor*,%xx) $1 
  }
}
on *:sockopen:tor*:{
  var %s sockwrite -n $sockname
  %s GET / $+ $sock($sockname).mark HTTP/1.1
  %s Host: rbls.org
  %s $crlf
}
on *:sockread:tor*:{
  var %x [ $+ [ $sockname ] ]
  sockread %x [ $+ [ $sockname ] ]
  if (*<tr class="rblred">*rbl.efnetrbl* iswm %x [ $+ [ $sockname ] ]) {
    gzline $+(*@,$sock($sockname).mark) 1h 1IP adresinizde 4PROXY 1girişi tespit edilmiştir.
    if !$window(@proxy-tor) { window -neg1 @proxy-tor } | echo  @proxy-tor ( $+ $time $+ ) $+(4  $chr(32),$sock($sockname).mark),$chr(32)) 1IP adresinden 4PROXY  1girişi tespit edilmiştir. 
    halt
  }
}
raw 352:*:{
  tor_ $4
}
on *:snotice:*Client connecting*: {
  .who +I $9
}