on *:snotice:*: {
  if $regex($1-,/connecting/i) {
    var %ip $remove($token($10,2,64),$chr(41))
    hinc -m ip %ip 1
    if $hget(ip,%ip) == 3 { gzline $9 +0 Ban! }
  }
  if $regex($1-,/client.exiting/i) {
    var %ip $remove($token($8,2,64),$chr(41))
    if $hget(ip,%ip) { hdel -m ip %ip }
  }
}