Regex Expression Help RSS

1

I've got some spam that is coming through that I'm seeking some help on how to come up with a regex expression that will catch it. They are plain text emails and the only common denominator between all the emails is they have a "header" if you will at the top of the email. I've listed them below. Any suggestions on how to setup the regex expression would be greatly appreciated.

__ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __

2/21/13 - Breaking News Out Of Washington To Cut Auto Rates In Half

__ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __


= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Washington To Cut Auto Rates In Half - Effective Immediately

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =


=== === === === === === === === === === === === ===

Award Winning Woodworking Kit For All Skill Levels Is An Absolute Blast

=== === === === === === === === === === === === ===


_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_

Auto Rate Cut To Go Into Effect In 2013.

+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+


Thanks
Josh

by joshua.colombo 6 years ago
2

You can check for repetitions of character combinations using a regular expression at the beginning of an email body:

^[\r\n\s]*(\+_|_\+|===\s|=\s|__\s){12,}.*

but please consider that legitimate emails may also contain such text elements, so false positives may occur.

by Krisztián Fekete (Vamsoft) 6 years ago
3

KrisztiƔn,

Thanks for the suggestion! I appreciate it. I'm going to try turning on graylisting for a few days before trying to implement the expression above.

Thanks!
Josh

by joshua.colombo 6 years ago
4

The graylisting didn't work, but as I continued to get spammed there were some patterns in the servers/IP's and I just blacklisted them.

If it continues, I'll try giving the regex expression a shot.

Thanks again.
Josh

by joshua.colombo 6 years ago
5

Can you recommend any regex tutorials or builders that are very basic? I've got another rash of spam today and feel I could implement some keyword blacklists with regex expressions, but for whatever reason my brain just doesn't seem to grasp regex expressions very well.

Thanks
Josh

by Josh 6 years ago
6

@Josh: The tutorials at http://www.regular-expressions.info/ are pretty good and they are PCRE-compatible.

For serious regex matters, I would recommend Mastering Regular Expressions by Jeffrey E.F. Friedl (O'Reilly Media) -- this book is the definitive guide to regular expressions and gives you a solid understanding of underlying concepts.

by Péter Karsai (Vamsoft) 6 years ago
(in reply to this post)

7

Thanks for the suggestions Peter, I'll check them out.

by Josh 6 years ago

New comment

Fill in the form below to add a new comment. All fields are required. If you are a registered user on our site, please sign in first.

Nickname:
Email address (will not be published):
Your comment:

ORF Technical Support

Configuring, installing and troubleshooting ORF.

News & Announcements

Your dose of ORF-related news and announcements.

Everything but ORF

Discuss Exchange and system administration with fellow admins.

Feature Test Program

Feature Test Program discussion. Membership is required to visit this forum.

ORF Beta

Join the great bug hunt of the latest test release.

Customer Service

Stay Informed