This is for 4 joins in 4 seconds:
on @*:join:#:{
inc -z %joins. $+ # 4
if (%joins. [ $+ [ # ] ] > 12) {
msg # Possible clone attack
mode # +MRiN
.timer 1 300 mode # -MRiN
unset %joins. $+ #
}
}
With /inc -u4 checking the var is > 4 it would trigger for 4 joins in up to 16 seconds