on *:SNOTICE:*Client*connecting*:{ 
  var %ident+ip $left($right($10,-1),-1)
  if ($gettok(%ident+ip,1,64) == Y) && $regex($gettok(%ident+ip,2,64),/^133.11/i) { .zline  $9 }
}