In the case of spam it's usually better to use the ON OPEN event, as most spam is automated from infected users or spam drones that will message you when you join a channel, speak on a channel or mention their nickname. Generally, someone wouldn't spam you on the 2nd or 3rd line of a private message.
You can halt private messages using the ^ prefix on the event, and an if statement to check what is inside the message. For example,
on ^*:open:?:*:{
if (*http://* iswm $1-) || (*www* iswm $1-) {
.msg $nick Spam detected, ignored message
.ignore -p300 $nick 3
halt
}
}
On top of halting the message, the above would message the user that their spam has been ignored, and add them to your ignore list for 300 seconds (5 minutes).
This would be placed in your remote, ALT+R > File > New.
For further help you could refer to the following help files:
/help halting default text
/help ON OPEN
/help if then else
Regards,