I noticed this also Gummo, but since most of my suggestions were falling on deaf ears, I didn't bother to go into it. Using a variable for something like this will never work and was never needed because you have $address. The on dns should look more like this:

On 1:DNS: {
  if ($dns(0)) {
    tokenize 46 $address 
    zline $+(*@,$4,.,$3,.,$2,.,$1) - Unauthorized Connection, Your Ip Is Blacklisted
  }
}

IMO this script should still be using /userip instead of /whois and the output should still be suppressed by using #groups and haltdef. All stuff I already said in the other 10 comments I made on this post that were deleted ;/