I Smell Packets


Regular Expression for Swine Domains
April 28, 2009, 4:06 am
Filed under: Regular Expression, Swine Flu

After seeing the latest diary entry on the Internet Storm Center (isc.sans.org) here, we wrote the following simple regular expression to block URLs with the word swine in them:

[a-z0-9-]*?swine[a-z0-9-]*?.com

That’s the basic expression. Now all you have to do is create additional expressions and change the .com at the end to .org, .net, and so on for the rest of the TLDs.