# $Id: flag-warez.bro,v 1.3 2003/01/16 00:28:47 vern Exp $
#
# include this module to flag various forms of Warez access.

@load hot-ids
@load ftp	

redef ftp_hot_files += /.*[wW][aA][rR][eE][zZ].*/ ;

redef always_hot_ids += { "warez", "hanzwarez", "zeraw", };
redef hot_ids += { "warez", "hanzwarez", "zeraw", };
