Regex Expression Help - ORF Forums

Regex Expression Help RSS Back to forum

1

I've got some spam that is coming through that I'm seeking some help on how to come up with a regex expression that will catch it. They are plain text emails and the only common denominator between all the emails is they have a "header" if you will at the top of the email. I've listed them below. Any suggestions on how to setup the regex expression would be greatly appreciated.

__ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __

2/21/13 - Breaking News Out Of Washington To Cut Auto Rates In Half

__ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __


= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Washington To Cut Auto Rates In Half - Effective Immediately

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =


=== === === === === === === === === === === === ===

Award Winning Woodworking Kit For All Skill Levels Is An Absolute Blast

=== === === === === === === === === === === === ===


_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_

Auto Rate Cut To Go Into Effect In 2013.

+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+_+


Thanks
Josh

by joshua.colombo more than 10 years ago
2

You can check for repetitions of character combinations using a regular expression at the beginning of an email body:

^[\r\n\s]*(\+_|_\+|===\s|=\s|__\s){12,}.*

but please consider that legitimate emails may also contain such text elements, so false positives may occur.

by Krisztián Fekete (Vamsoft) more than 10 years ago
3

Krisztián,

Thanks for the suggestion! I appreciate it. I'm going to try turning on graylisting for a few days before trying to implement the expression above.

Thanks!
Josh

by joshua.colombo more than 10 years ago
4

The graylisting didn't work, but as I continued to get spammed there were some patterns in the servers/IP's and I just blacklisted them.

If it continues, I'll try giving the regex expression a shot.

Thanks again.
Josh

by joshua.colombo more than 10 years ago
5

Can you recommend any regex tutorials or builders that are very basic? I've got another rash of spam today and feel I could implement some keyword blacklists with regex expressions, but for whatever reason my brain just doesn't seem to grasp regex expressions very well.

Thanks
Josh

by Josh more than 10 years ago
6

@Josh: The tutorials at http://www.regular-expressions.info/ are pretty good and they are PCRE-compatible.

For serious regex matters, I would recommend Mastering Regular Expressions by Jeffrey E.F. Friedl (O'Reilly Media) -- this book is the definitive guide to regular expressions and gives you a solid understanding of underlying concepts.

by Péter Karsai (Vamsoft) more than 10 years ago
(in reply to this post)

7

Thanks for the suggestions Peter, I'll check them out.

by Josh more than 10 years ago

New comment

Fill in the form below to add a new comment. All fields are required. If you are a registered user on our site, please sign in first.

It will not be published.
hnp1 | hnp2