Create RegEX/Filter in PureMessage for Exchange that will block certain TLDs in E-Mail Link

Question

I've tried making them but it only seems to work if it's in the actual text and not the URL itself. Is there someway to make it match within the HREF tag of the message? i'm trying to block anything that has a URL/link that references the .DATE TLD.

This thread was automatically locked due to age.

Red_Warrior · Accepted Answer

Hi Jdobiash,

I believe you will want to set up a content filtering rule, in regards to the catch rate there may be some issues with the regular expression you are using.

You can test it out at www.regexpal.com (that's the site I use)

So in the top bar, paste in your regular expression, then in the bottom bar paste in the test data below.

top window:

-- cut --this should be all 1 line in the upper box(no blank space)
((http(s|):)\S+\.(review|faith|work|win|date|country|kim|xyz)(\/\S+)?\b)(\/|)\s
-- cut --

bottom window:

---cut ---
http://www.myfile.faith this is a test of text after the address
not ure https://www.myfile.work will it work?
if there is text in front www.myfile.work of the address
text with no spaceftp://www.myfile.country
https://www.myfile.kim ejkrker
http://www.xyz.com
https://wwww.googles.xyz.com
https://myfile.faith
www://myfile.review
https://www.date.com
https://www.myfile.com.kim
ftp://myfile.win
ftp://www.myfile.win
if the is text in front of the url<a href="www.w3schools.faith">Visit W3Schools.faith!</a> or even after it will find it
<a href="www.w3schools.country">Visit W3Schools.com!</a> It will still match a linked ref even if the display name is incorrect
<a href="www.w3schools.win">Visit W3Schools.win!</a>
<a href="www.w3schools.work">Visit W3Schools.work!</a>
--- cut ---

As you will see the current regular expression seems to only match a few (4) of the test entries.

I fiddled with it a little bit and came up with this one:

all on 1 line:

other then the false positive for https://wwww.googles.xyz.com where the fqdn ends in .com. this rule is very tight.

You may need to further adjust it for your needs.

Just make sure its in the filtering rules and it should be good.

Hope that helps.

*** Note ***

With all regular expressions there is always a chance of error, so ensure your rule is set up to quarantine (or copy the message / cc an admin) that way if there is a false positive you can release it.