RE: [Declude.JunkMail] Regex to block this?

[Dave Beckstrom]

Thanks.   David's regex worked well.  I'll give the fine tuning a try.

Also, all of this spammer's domains are in DNS servers ns1.domainsite.com -
ns4.domainsite.com.  



> I might fine tune it a bit.
> I've only seen length 37 and 38 characters after the tld
> It is only lower case hex codes so you can exclude (g-z)
> I've seen lots of .info and a few .nets as additional tld.
> Very active spammer here
> 
> (?i:href=.+\.(com|info|net)/[a-f0-9]{37,38}">)
> 
> -----Original Message-----
> From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave
> Beckstrom
> Sent: Tuesday, July 20, 2010 8:00 AM
> To: declude.junkmail@declude.com
> Subject: [Declude.JunkMail] Regex to block this?
> 
> 
> I'm getting hit by one spammer who manages to get through most of my
> filters.  His spam consistently uses the format of:
> 
> <a
>
href="http://gcc128.blinksroads.com/5768cbbeb6bba86c3157116a6de8e54b31dab5";
> >
> <img src="http://gcc128.blinksroads.com/images/157286c08.jpg";....
> 
> How would I write a regex that would look for .com/  followed by a string
of
> garbage with no .htm or other web extension on the end?
> 
> 
> 
> 
> 
> 
> 
> 
> ---
> [This E-mail scanned for viruses by Declude]
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to imail...@declude.com, and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.
> 
> 
> 
> ---
> [This E-mail scanned for viruses by Declude]
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To
> unsubscribe, just send an E-mail to imail...@declude.com, and
> type "unsubscribe Declude.JunkMail".  The archives can be found
> at http://www.mail-archive.com.




---
[This E-mail scanned for viruses by Declude]



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.