Looking for a script please that will tempshun a nick on connect for a few seconds that matches a set pattern before unshunning just to help us out with some spammers trying to get on

the connect message looks like

[11:20] <ChanServ> USERS: Monica694!~Mibbit@xx.xx.xx.xx (990693CA.9FC5C4F3.F9E92EF2.IP) (http://www.mibbit.com) connected to the network (our network is here)
11:14] <ChanServ> USERS: Stephanie800!Mibbit@xx.xx.xx.xx (555560E4.5124B86E.EB45475D.IP) (http://www.mibbit.com) connected to the network (our network is here)

want the script to act on the 3 numbers and first letter before the ! eg.. the a694 or e800 ... whatever the last letter and 3 numbers are.. no more numbers.. its always 3 numbers, then the ! on this catch

When the user connects i would like a tempshun placed and run for 20secs before it is removed

I'm mirc 7.63 and its unrealircd 5.2.0. We have a working spamfilter already that is set correctly and working.. we're just looking to go a bit more proactive with the deterrent

Something like that

I like the idea.. but .. i would have to copy this for each of the different networks we have
can we strip this down to cut off at connected to the network to make things easier ?

Yes

Had to go filter side in the end as there was a regml error on the script when it was running

I'll probably have a look and see if i can debug it ... but the script as is was not a worker.

Thanks for the idea and first thoughts though

Script works but I probably misread what your input string would be from the on snotice event, I'm not even sure that you would need that event as the only thing you have shown here is a message sent from chanserv on some channels.
You can see the regex working here, but it then depends on your input, if you even need the snotice event or some on text event instead: https://regex101.com/r/YTrccL/1

That being said, mirc scripts are of course not suited for this task and writing a custom module or using the one already existing for your IRCD would be far better.