Page 1 of 1

Spamfilter Regex Help Needed

Posted: Mon Sep 09, 2013 6:42 pm
by j0nas
Hi Guys,

I've been struggling to keep up with spam from a certain network recently and currently have the following filter set;

Code: Select all

*f[ ]{0,3}i[ ]{0,3}n[ ]{0,3}a[ ]{0,3}l[ ]{0,3}f[ ]{0,3}o[ ]{0,3}n[ ]{0,3}t[ ]{0,3}a[ ]{0,3}s[ ]{0,3}y*
but now they have changed tactic to the following;

Code: Select all

(F)inal(F)ontasy
F*inalF*ontasy
F*(i)nalF(0)ntasy
(F)*(i)*(n)*(a)*(l)*(F)*(o)*(n)*(t)*(a)*(s)*(y)
is there any way I can have a regex to catch F I N A L F O N T A S Y with any combination of punctuation chars in between the letters?

I thought of putting the following in;

Code: Select all

*f[*]{0,4}[(]{0,4}[)]{0,4}[ ]{0,4}i[*]{0,4}[(]{0,4}[)]{0,4}[ ]{0,4}n[*]{0,4}[(]{0,4}[)]{0,4}[ ]{0,4}a[*]{0,4}[(]{0,4}[)]{0,4}[ ]{0,4}l[*]{0,4}[(]{0,4}[)]{0,4}[ ]{0,4}f[*]{0,4}[(]{0,4}[)]{0,4}[ ]{0,4}o[*]{0,4}[(]{0,4}[)]{0,4}[ ]{0,4}n[*]{0,4}[(]{0,4}[)]{0,4}[ ]{0,4}t[*]{0,4}[(]{0,4}[)]{0,4}[ ]{0,4}a[*]{0,4}[(]{0,4}[)]{0,4}[ ]{0,4}s[*]{0,4}[(]{0,4}[)]{0,4}[ ]{0,4}y*
or

Code: Select all

*f[!"#$%&'()*+,./:;<=>?@\^_`{|}~-]{0,6}i[!"#$%&'()*+,./:;<=>?@\^_`{|}~-]{0,6}n[!"#$%&'()*+,./:;<=>?@\^_`{|}~-]{0,6}a[!"#$%&'()*+,./:;<=>?@\^_`{|}~-]{0,6}l[!"#$%&'()*+,./:;<=>?@\^_`{|}~-]{0,6}f[!"#$%&'()*+,./:;<=>?@\^_`{|}~-]{0,6}o[!"#$%&'()*+,./:;<=>?@\^_`{|}~-]{0,6}n[!"#$%&'()*+,./:;<=>?@\^_`{|}~-]{0,6}t[!"#$%&'()*+,./:;<=>?@\^_`{|}~-]{0,6}a[!"#$%&'()*+,./:;<=>?@\^_`{|}~-]{0,6}s[!"#$%&'()*+,./:;<=>?@\^_`{|}~-]{0,6}y
but want to be 100% sure before I add it.

Thanks

Re: Spamfilter Regex Help Needed

Posted: Tue Sep 10, 2013 2:26 am
by Stealth
This will get anything that contains the letters F I N A L F O N T A S Y with anything but spaces between the characters (best option to prevent false positives)

Code: Select all

F[^ ]+I[^ ]+N[^ ]+A[^ ]+L[^ ]+F[^ ]+O[^ ]+N[^ ]+T[^ ]+A[^ ]+S[^ ]+Y

This will get any string containing the letters F I N A L F O N T A S Y in that order with anything between:

Code: Select all

F.*I.*N.*A.*L.*F.*O.*N.*T.*A.*S.*Y

If it is someone spamming the address of another network/service of their own free will without the permission of the network, inform the network admins so they may track down the perp and put an end to his existence. If the network/service won't do anything about it, or if the network/service approves of this kind of spam, report the continued spam to their hosting provider(s) and let them get what they have coming.

Re: Spamfilter Regex Help Needed

Posted: Thu Sep 12, 2013 12:54 am
by j0nas
Thanks Stealth,

It's hard when it's the network owners spamming and the hosts won't do anything because they don't see it as coming from their IP's