Detect bitcoin wallet chains RSS

1

There's lately a lot of scam messages that include a bitcoin wallet to make payments. Would be useful to find a way to detect mails with bitcoin wallet chains. I've tried a few regular expressions with no success. Anybody?

by Recoplon 1 week ago
2

@Recoplon: Hello Recoplon,

Bitcoin addresses typically start with 1 or 3 ("legacy" or "segwit" address) and can be 26-35 characters long. To block such addresses, add the regex below to the Keyword Blacklist of ORF with an "Email subject and body" search scope.

.*\b[13][a-zA-Z0-9]{25,34}\b

Don't forget to save the ORF configuration to apply the settings (Ctrl + S).

I hope this helps.

by Daniel Novak (Vamsoft) 1 week ago
(in reply to this post)

3

Hi. Thanks, but the problem is this generates a lot of false positives. For testing, I added this and in 3 minutes I got 4 false positives already, had to back off.

by Recoplon 1 week ago
4

@Recoplon: My guess is that the regex is probably matching the encapsulation boundaries (or the boundary parameter in the content-type declaration) in multi-part emails. Luckily, those encapsulation boundaries have a mandatory "--" prefix, so we can exclude those matches. They may also contain other special characters which could cause problems (though, 99% of MUAs do not use them) so the new regex will not match if the "address" is preceded by any of those characters. You many find the updated regex below:

.*\b(?<!['"()+\-.\/:=?])[13][a-zA-Z0-9]{25,34}\b

by Daniel Novak (Vamsoft) 1 week ago
(in reply to this post)

5

@Daniel Novak (Vamsoft): Thanks. Unfortunately as soon as I added a test block for that regular expression, again got false positives after a few minutes. I guess specifically detecting bitcoin wallet addresses is very difficult.

by Recoplon 5 days ago
(in reply to this post)

6

@Recoplon: I am sorry to hear that. Could you perhaps send us (to ) the legitimate emails (saved in a .eml or .msg format) that were blacklisted by the regex above? I might be able to find a workaround.

by Daniel Novak (Vamsoft) 5 days ago
(in reply to this post)

New comment

Fill in the form below to add a new comment. All fields are required. If you are a registered user on our site, please sign in first.

Nickname:
Email address (will not be published):
Your comment:

ORF Technical Support

Configuring, installing and troubleshooting ORF.

News & Announcements

Your dose of ORF-related news and announcements.

Everything but ORF

Discuss Exchange and system administration with fellow admins.

Feature Test Program

Feature Test Program discussion. Membership is required to visit this forum.

ORF Beta

Join the great bug hunt of the latest test release.

Customer Service

Stay Informed