Skip to main content
A
Anonymous_User
Contributor
June 16, 2008
Question

Regular Expressions Examples

  • June 16, 2008
  • 15 replies
  • 32186 views
I thought it might be a good idea to start a thread where we can all post examples of Regular Expressions that we use to block spam. Or maybe some good web sites that we use to look up expressions. This is to help users who aren' t familiar with Regex (like I was when I first got my FG) to get them started and perhaps for all of us to find better expressions to use to keep spam to a minimum. Perhaps if this thread is useful it could be stickied to make it easier to find...

    15 replies

    Show previous replies
    A
    Anonymous_UserAuthor
    Contributor
    July 10, 2009
    Another one I put in a few days ago is: /http:\/\/groups\.yahoo\.com/i These have been coming in spams now for the past few weeks... and I can' t imagine where in a business email one might reference this particular site... I don' t give any one regex a high enough of a score to block an email on it' s own. I have to see two matches in order for a message to get blocked. There are many common words or phrases that accompany this example that you can use to filter out the good from the bad.
    A
    Anonymous_UserAuthor
    Contributor
    July 10, 2009
    Two more: /Acc?ai Berr?y/i /[a|@]cc?[a|@][i|1|!] /i
    johnt
    johnt
    New Member
    February 19, 2010
    sorry for hijacking a somewhat old thread but i cant to seem to add a % to a dictionary filter as in up\sto\s[\$|£|\%]\d* either with or without the " \" before the percentage sign. is there any way of explicity trying to find the " %" or is there a way around this.
    abelio
    SuperUser
    abelio
    SuperUser
    February 19, 2010
    Hello John, i' ve tried it just copy and paste your expression in a box running 4MR1p3 and it works: 
      config spamfilter bword      edit 1              config entries                  edit 1                      set pattern " /\\b0FF\\b/"                       set pattern-type regexp                      set score 20                      set where subject                  next                  edit 2                      set pattern " up\\sto\\s[\\$|£|\\%]\\d*"                       set pattern-type regexp                      set score 20                      set where subject                  next              end          set name " filtros"       next  end
    laf
    laf
    New Member
    November 25, 2009
    Hi, I received a SPAM like this: From: Official VIAGRA Store [mailto:redactia@sfin.ro] Sent: Tuesday, November 24, 2009 3:00 PM To: redactia sfin Subject: Dear redactia 75% 0FF on Pfizer. Any idea, how can I block this type of SPAM?
    abelio
    SuperUser
    abelio
    SuperUser
    November 25, 2009
    well, under FTGate AS you' ve few tools to block spams with forged sender (exactly sender=recipient), so, you shoul rely on banned word filtering, i .e: 
         config spamfilter bword            edit 1                      set action spam                      set language western                      set pattern " /\\b0FF\\b/"                       set pattern-type regexp                      set score 20                      set status enable                      set where subjectset pattern                   next          end
    Or trying to match Pzifer in subject (if you can do such things). Another no-firewall related comment could be, should your mailserver accept email sent from the internet with sfin.ro domain? Do youhave roaming users sending email from outside corporate lan to users within corp lan with the same domain? If you can reject that at your mailserver smtp level, it' s done. FortiMail can do that for example. regards,
    laf
    laf
    New Member
    May 3, 2010
    well, under FTGate AS you' ve few tools to block spams with forged sender (exactly sender=recipient), so, you shoul rely on banned word filtering, i .e: config spamfilter bword edit 1 set action spam set language western set pattern " /\\b0FF\\b/" set pattern-type regexp set score 20 set status enable set where subjectset pattern next end Or trying to match Pzifer in subject (if you can do such things). Another no-firewall related comment could be, should your mailserver accept email sent from the internet with sfin.ro domain? Do youhave roaming users sending email from outside corporate lan to users within corp lan with the same domain? If you can reject that at your mailserver smtp level, it' s done. FortiMail can do that for example. regards,
    Hi mate, For my shame I did not your answer until now. I read your answer couple of times now, still I don' t get this line: set pattern " /\\b0FF\\b/" About the email config server, I am not in charge of it, so unfortunately there' s little I can do about it.
    A
    Anonymous_UserAuthor
    Contributor
    April 22, 2010
    I see someone here mentioned using sender=recipient as a filter. How would one apply that so that it blocks some of the spoofed email. Nearly 80% of our spam comes in spoofed in this condition. Thanks in advance.
    A
    Anonymous_UserAuthor
    Contributor
    May 19, 2010
    I would like to blacklist any email address NOT from .com, .net, .org, .edu, .gov or .mil. So, what is the OPPOSITE of this regular expression?... /^[^ ]+@[^ ]\.(com|net|org|edu|gov|mil)$/i Thank you for your help!
    rwpatterson
    rwpatterson
    New Member
    May 19, 2010
    Welcome to the forums. Would be easier to whitelist those extension, then next line block everything.
    Terms & ConditionsAccessibility statement