Regex TLD Optimisation Help

[zolthar]

Hi All,

After discovering how to apply Custom Rules, its got me down this RegEx rabbit hole.

Is anyone able to help with the following that I have 'hacked' together - it is working, but not optimal IMO for both header and URI searches.

(\.(fit|link)+?)(?:$|\/|\:)

https://regex101.com/r/dezYX0/3

What I would like to ask is:

1. How can I ignore everything after the end of TLD (refer to link)
2. Is the code the shortest/simplest it can be

Thanks for the read

 

[hata_ph]

I use below who object regex to filter emails address from some suspicious tld.

(\W|^)[\w.+\-\=]{0,50}@[\w.+\-\=]{0,50}\.top(\W|$) or (\W|^)[\w.+\-]{0,50}@[\w.+\-]{0,50}\.top(\W|$)

 

[zolthar]

Thanks @hata_ph, I beleive it is very similar, and I had cut out the parts before the @. It works for an email address, however in the event that it was placed in the extended url portion, that RegEx could be a problem:



I know the probability of a .TLD occuring in a link is low, however I just want to make sure the probability is zero as I am sure somewhere down the line someone will complain to me why a particular email was 'quarantined' becuase my rule just pushed it over the threshold. "sigh"...

 

[hata_ph]

Are you using PMG mail filter object rules or custom spamassassin rules?

 

[zolthar]

SpamAssassin Custom Rules so that I can add points with other scores.

 

[hata_ph]

Check out spamassassin meta rules.

https://cwiki.apache.org/confluence/display/SPAMASSASSIN/WritingRules

header         __FROM_TLD  From =~ /\.(link|see|me)/i
uri           __URI_TLD /\.(link|see|me)/i # or /\.(link|see|me)\/*/i
meta         SPAM_TLD  (__FROM_TLD && __URI_TLD)
describe     SPAM_TLD Meta rules for spammy TLD
score          SPAM_TLD 5.0

 

[zolthar]

THe problem with that is that it searches for a '.' then 'tld'. This is a problem as the following would be hit also (along with subdomains):



Thats why I had searchs for the proceeding colon, forward slash or end of line.

Yes I am over-thinking it - however I am sure there is a way to give it better protection.