Match/Replace Question

[hpguru]

How can I match a domain name such as

child1.domain.suffix, child2.child1.domain.suffix
or childN. ... .child1.domain.suffix

and always replace it with domain.suffix even when suffix
has a "dot" in it such as "co.uk"?



 

[xartica]

This match expression/replacement pair:

Match = "([^/]++.|)(DomainDotSuffix)1([./:"'#]|(^?))"
Replace = "1"

will do what you are asking.  In the hostname portion of a URL,
it matches instances of "Anything or Nothing", followed by the
"domain suffix" you are interested in targeting.

Input either "child1.domain.suffix" or "child2.child1.domain.suffix"
or even "childN.....child1.domain.suffix" and it will output
"domain.suffix"

If you are interested in matching/modifying numerous "domain suffix" strings,
you can ennumerate them in an external blocklist and use this, instead:

([^/]++.|)($LST(buggerDomains))1([./:"'#]|(^?))

In this case, your blocklist could contain items like:
zippetydoodah.com
co.uk
sparkle.co.uk
mad.ch





 

[hpguru]

Okay, fiendish as it is, here is what I am attempting to do.

It has been suspected for some time that some domains log incoming HTTP_FROM headers for spamming purposes. So I am writing a set of filters to make these spammers spam themselves by sending HTTP_FROM headers whose values are

[email protected]
[email protected]

and so on. The two filters I developed for this purpose are

In = FALSE
Out = TRUE
Key = "From: (Out)"
Replace = "$LST(From)@h"

In = FALSE
Out = TRUE
Key = "From: 2 (Out)"
Match = "$LST(From)@*.1.2"
Replace = "$LST(From)@1.2"

and the "From" list used is

$CON(1,5)$SET(0=admin)
$CON(2,5)$SET(0=administrator)
$CON(3,5)$SET(0=ipadmin)
$CON(4,5)$SET(0=sysops)
$CON(5,5)$SET(0=webmaster)

These two filters work for all tested domains of the forms

domain.suffix or child1.domain.suffix

but not for domains of the form

child2.child1.domain.suffix

except in the special case that "suffix" has a dot in it such as "co.uk" They would also fail for domains of the form childN. ... child1.domain.suffix where N is greater than 2 and for domains of the form domain.suffix when suffix contains a dot.

Any ideas?

 

[hpguru]

Given that Proxomitron is under a state of siege I decided to pull one of my weapons (I personally think a web advertizer/spyware-creator is behind the attack - who else would have a motive?). Unfortunately I've never been able to get this filter to work the way I want it to (see above). Any help would be appreciated. In the mean time *this* filter does work.

In = FALSE
Out = TRUE
Key = "From: (Out)"
Replace = "[email protected]"

For those who don't know, that email addy was setup a few years ago by the US Federal Trade Commission so that consumers can report spam by forwarding it to that address. "UCE" stands for "Unsolicited Commercial Email.