PS: Are you going to update the wiki with your Exchange
issue/findings? Or is there nothing that needs updating?
On 9/24/07, Micheal Espinola Jr <[EMAIL PROTECTED]> wrote:
> I test with emails, the analyzer, and third-party regular expression
> utilities. I've recently simplified this particular regex:
>
> (ebay|paypal)\.(?!(com))\w{2,6}\b
>
> The original works fine, but it just wasn't necessary to match against
> all that data. This is more efficient.
>
>
> On 9/24/07, bytehd <[EMAIL PROTECTED]> wrote:
> >
> > Do you test your rules with valid emails or
> > Is the preferred way to use the Analyzer after you add a regex?
> >
> >
> > Micheal Espinola Jr (mobile) wrote:
> > >
> > > (ebay|paypal)\.\w+\b(?<!(ebay|paypal)\.com)
> > >
> > > Put this in your bombRe and you will catch anything that ends with
> > > ebay.*" or "paypal.*" that doesn't actually end in .com.
> > >
> > > Right now I see a lot of paypal.us garbage, and I don't fee like dealing
> > > with this again after they decide to use or spoof another TLD that
> > > doesn't support SPF, etc.
> > >
> > > Slapping this together was a learning experience while working with
> > > regex Negative Lookbehinds for something else. This ebay/paypal thing
> > > just seemed too easy to not put in as well.
> > >
> > > HTH
> > >
> > > -------------------------------------------------------------------------
> > > This SF.net email is sponsored by: Microsoft
> > > Defy all challenges. Microsoft(R) Visual Studio 2005.
> > > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> > > _______________________________________________
> > > Assp-user mailing list
> > > [email protected]
> > > https://lists.sourceforge.net/lists/listinfo/assp-user
> > >
> > >
> >
> > --
> > View this message in context:
> > http://www.nabble.com/A-simple-regex-to-catch-ebay-paypal-variant-spoofs-tf4469775.html#a12871885
> > Sent from the assp-user mailing list archive at Nabble.com.
> >
> >
> > -------------------------------------------------------------------------
> > This SF.net email is sponsored by: Microsoft
> > Defy all challenges. Microsoft(R) Visual Studio 2005.
> > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> > _______________________________________________
> > Assp-user mailing list
> > [email protected]
> > https://lists.sourceforge.net/lists/listinfo/assp-user
> >
>
>
> --
> ME2
>
--
ME2
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Assp-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-user
