Regular Expressions Examples

[#1]

I thought it might be a good idea to start a thread where we can all post examples of Regular Expressions that we use to block spam. Or maybe some good web sites that we use to look up expressions. This is to help users who aren' t familiar with Regex (like I was when I first got my FG) to get them started and perhaps for all of us to find better expressions to use to keep spam to a minimum. Perhaps if this thread is useful it could be stickied to make it easier to find...

[rwpatterson]

That regex will trigger with any word starting with cn, ru, or hk. Try this small change: /\w+\.\w+\.[cn|ru|hk]\b/i This will make sure there is a boundary between the domain and what follows... be it white space or punctuation.

[#3]

That regex will trigger with any word starting with cn, ru, or hk. Try this small change: /\w+\.\w+\.[cn|ru|hk]\b/i This will make sure there is a boundary between the domain and what follows... be it white space or punctuation.

Thanks, I just want to make sure I have this right... what I am looking to filter is something.something.cn or ru or hk (ex. www.blah.hk or www.stupid.ru). My understanding was that \w+ is similar to * as a wildcard, and \. looks for a period. Just not clear on why my regex would look for a word starting with cn, ru or hk. I guess I have to find out what \b does so I can understand it better.

[rwpatterson]

A word boundary (\b ) is a spot between two characters that has a \w on one side of it and a \W on the other side of it (in either order), counting the imaginary characters off the beginning and end of the string as matching a \W. \w Match a " word" character (alphanumeric plus " _" ) \W Match a non-" word" character PERL (and REGular EXpression) are extremely case sensitive.... Your expression breaks down to: one or more word chars + " ." + one or more word chars + " ." + ' cn' or ' ru' or ' hk' followed by any character not equaling a letter, number or underscore.

[#5]

I admit it took me a couple of reads but I get it. Would putting a blank space at the end just before /i not accomplish nearly the same thing?

[rwpatterson]

Most domains in the URL end with a slash as in " www.blahblah.ru/someOtherFolder/index.html" . The URL may even end at the domain. " www.blahblah.ru" . The space won' t do what you intend...

[ede_pfau]

sorry for being a bit late... In my understanding of REs, " []" denotes a character class, not a group of strings. You group alternatives with paranthesis " ()" . So, " [cn|ru|hk]" would match a single " c" , " n" , " |" (!), " r" , " u" , " h" or " k" . The pipe symbol will only count as a literal character, even if repeated in the pattern. Said that, this RE would match " subdom.dom.c" but not " subdom.dom.cn" . Alternative strings can be specified with " (cn|ru|hk)" .

[#8]

And now it makes complete sense. Thank you!

[laf]

Hi, I received a SPAM like this: From: Official VIAGRA Store [mailto:redactia@sfin.ro] Sent: Tuesday, November 24, 2009 3:00 PM To: redactia sfin Subject: Dear redactia 75% 0FF on Pfizer. Any idea, how can I block this type of SPAM?

[abelio]

well, under FTGate AS you' ve few tools to block spams with forged sender (exactly sender=recipient), so, you shoul rely on banned word filtering, i .e:

    config spamfilter bword
           edit 1
                     set action spam
                     set language western
                     set pattern " /\\b0FF\\b/" 
                     set pattern-type regexp
                     set score 20
                     set status enable
                     set where subjectset pattern 
                 next
         end
 

Or trying to match Pzifer in subject (if you can do such things). Another no-firewall related comment could be, should your mailserver accept email sent from the internet with sfin.ro domain? Do youhave roaming users sending email from outside corporate lan to users within corp lan with the same domain? If you can reject that at your mailserver smtp level, it' s done. FortiMail can do that for example. regards,

[laf]

well, under FTGate AS you' ve few tools to block spams with forged sender (exactly sender=recipient), so, you shoul rely on banned word filtering, i .e: config spamfilter bword edit 1 set action spam set language western set pattern " /\\b0FF\\b/" set pattern-type regexp set score 20 set status enable set where subjectset pattern next end Or trying to match Pzifer in subject (if you can do such things). Another no-firewall related comment could be, should your mailserver accept email sent from the internet with sfin.ro domain? Do youhave roaming users sending email from outside corporate lan to users within corp lan with the same domain? If you can reject that at your mailserver smtp level, it' s done. FortiMail can do that for example. regards,

Hi mate, For my shame I did not your answer until now. I read your answer couple of times now, still I don' t get this line: set pattern " /\\b0FF\\b/" About the email config server, I am not in charge of it, so unfortunately there' s little I can do about it.