Create RegEX/Filter in PureMessage for Exchange that will block certain TLDs in E-Mail Link

Question

I've tried making them but it only seems to work if it's in the actual text and not the URL itself. Is there someway to make it match within the HREF tag of the message? i'm trying to block anything that has a URL/link that references the .DATE TLD.

This thread was automatically locked due to age.

Red_Warrior · Accepted Answer

Hi Jdobiash, I believe you will want to set up a content filtering rule, in regards to the catch rate there may be some issues with the regular expression you are using. You can test it out at www.regexpal.com (that's the site I use) So in the top bar, paste in your regular expression, then in the bottom bar paste in the test data below. top window: -- cut --this should be all 1 line in the upper box(no blank space) ((http(s|):)\S+\.(review|faith|work|win|date|country|kim|xyz)(\/\S+)?\b)(\/|)\s -- cut -- bottom window: ---cut --- http://www.myfile.faith this is a test of text after the address not ure https://www.myfile.work will it work? if there is text in front www.myfile.work of the address text with no space ftp://www.myfile.country https://www.myfile.kim ejkrker http://www.xyz.com https://wwww.googles.xyz.com https://myfile.faith www://myfile.review https://www.date.com https://www.myfile.com.kim ftp://myfile.win ftp://www.myfile.win if the is text in front of the urlVisit W3Schools.faith! or even after it will find it Visit W3Schools.com! It will still match a linked ref even if the display name is incorrect Visit W3Schools.win! Visit W3Schools.work! --- cut --- As you will see the current regular expression seems to only match a few (4) of the test entries. I fiddled with it a little bit and came up with this one: all on 1 line: --- cut -- \b((https?|ftp|file|www)://|(www|ftp)\.)*.\S+(review|faith|work|win|date|country|kim|xyz) --- cut --- other then the false positive for https://wwww.googles.xyz.com where the fqdn ends in .com. this rule is very tight. You may need to further adjust it for your needs. Just make sure its in the filtering rules and it should be good. Hope that helps. *** Note *** With all regular expressions there is always a chance of error, so ensure your rule is set up to quarantine (or copy the message / cc an admin) that way if there is a false positive you can release it.