Regex Expression Help - ORF Forums

Regex Expression Help RSS Back to forum

1

I've got some spam that is coming through that I'm seeking some help on how to come up with a regex expression that will catch it. They are plain text emails and the only common denominator between all the emails is they have a "header" if you will at the top of the email. I've listed them below. Any suggestions on how to setup the regex expression would be greatly appreciated.

__ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __

2/21/13 - Breaking News Out Of Washington To Cut Auto Rates In Half

__ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __


= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Washington To Cut Auto Rates In Half - Effective Immediately

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =


=== === === === === === === === === === === === ===

Award Winning Woodworking Kit For All Skill Levels Is An Absolute Blast

=== === === === === === === === === === === === ===


_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_

Auto Rate Cut To Go Into Effect In 2013.

+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+


Thanks
Josh

by joshua.colombo 6 years ago
2

You can check for repetitions of character combinations using a regular expression at the beginning of an email body:

^[\r\n\s]*(\+_|_\+|===\s|=\s|__\s){12,}.*

but please consider that legitimate emails may also contain such text elements, so false positives may occur.

by Krisztián Fekete (Vamsoft) 6 years ago
3

KrisztiƔn,

Thanks for the suggestion! I appreciate it. I'm going to try turning on graylisting for a few days before trying to implement the expression above.

Thanks!
Josh

by joshua.colombo 6 years ago
4

The graylisting didn't work, but as I continued to get spammed there were some patterns in the servers/IP's and I just blacklisted them.

If it continues, I'll try giving the regex expression a shot.

Thanks again.
Josh

by joshua.colombo 6 years ago
5

Can you recommend any regex tutorials or builders that are very basic? I've got another rash of spam today and feel I could implement some keyword blacklists with regex expressions, but for whatever reason my brain just doesn't seem to grasp regex expressions very well.

Thanks
Josh

by Josh 6 years ago
6

@Josh: The tutorials at http://www.regular-expressions.info/ are pretty good and they are PCRE-compatible.

For serious regex matters, I would recommend Mastering Regular Expressions by Jeffrey E.F. Friedl (O'Reilly Media) -- this book is the definitive guide to regular expressions and gives you a solid understanding of underlying concepts.

by Péter Karsai (Vamsoft) 6 years ago
(in reply to this post)

7

Thanks for the suggestions Peter, I'll check them out.

by Josh 6 years ago

New comment

Fill in the form below to add a new comment. All fields are required. If you are a registered user on our site, please sign in first.

It will not be published.
hnp1 | hnp2