It goes in remotes. CTCP is an event. But it isn't on CTCP.

Code:
ctcp *:dcc send:*: if ($len($nopath($filename)) >= 225) { echo 4 -a $nick tried to crash you with an illegal dcc send of $nopath($filename) | halt }


CTCP level:matchtext:target: { commands }

/help CTCP events

-Andy