Page 1 of 1
Regex for botnet
Posted: Tue Dec 30, 2008 6:34 pm
by Mikktex
Hello,
Kinda of a beginner with regex so i would like some help on this.
Got around 1000 bots bouncing in and out on my network.
Ex:
[USA|00|XP|P|25874]
BGR|00|XP|SP3|2745
GBR|00|UN|SP1|2320
[FRA|00|XP|MP|1879]
[ITA|02|XP|P|25113]
[USA|01|VIS|P|54031]
[SAU|00|XP|P|56781]
[ITA|00|XP|P|97075]
[USA|00|XP||822760]
USA|00|XP|SP3|8635
And so on.
Needs something that kills and keeps them out.
Thankfull for anykind of help.
Re: Regex for botnet
Posted: Tue Dec 30, 2008 11:27 pm
by [dx]
^\[[A-Z]{3}\|\d{2}\|[A-Z]{2,3}\|[A-Z]{1,2}\d\|\d{4,5}!
^[A-Z]{3}\|\d{2}\|[A-Z]{2,3}\|[A-Z]{2,3}\|\d{5,6}!
Give a try these two
Re: Regex for botnet
Posted: Thu Jan 01, 2009 5:12 pm
by Mikktex
Well that did nothing.. Maby i missed something.
/spamfilter add u gline 3d BOTS ^\[[A-Z]{3}\|\d{2}\|[A-Z]{2,3}\|[A-Z]{1,2}\d\|\d{4,5}!
Re: Regex for botnet
Posted: Thu Jan 01, 2009 7:01 pm
by Skizzerz
Try switching the ! at the end with $ (dollar sign). $ denotes the end of a line, ! is just a normal character in terms of regular expressions.
Re: Regex for botnet
Posted: Thu Jan 01, 2009 7:34 pm
by Mikktex
Same thing with the $ nothing happens.
Re: Regex for botnet
Posted: Thu Jan 01, 2009 11:15 pm
by Mikktex
I've done some progress.
Got: [A-Z]{3}\|\d{2}\|[A-Z]{2,3}\|[A-Z]{1,2}\d\|\d{4,5}! To work. So half of the bots are gone. but the otherone i cant really tell why it isnt working.
Its exact the samething but with \[[A-Z]{3}\|\d{2}\|[A-Z]{2,3}\|[A-Z]{1,2}\d\|\d{4,5}\]! so that should kill the bots.
Am i doing something horribly wrong here ?
Re: Regex for botnet
Posted: Thu Jan 01, 2009 11:23 pm
by Mikktex
Well got it to work now
Rebooted the server and somehow it worked.
Well thnx for all the help
Re: Regex for botnet
Posted: Fri Jan 02, 2009 2:34 pm
by [dx]
Yeah.. Chears