Regex Query to find mis-branded hyperlinks

Question

I am trying to run a regex command to parse through incoming emails to identify any hyperlinks that have been sent by phony/phishing sites attempting to use a variation of our company name. Our company is abcdomain. The criteria is:

1. Find all hyperlinks (hostname portion) that contain our company name 'abcdomain'
2. Exclude all domains that we have registered ourselves, i.e. myabcdomain.com,site.abcdomain.com,abcdomain.net, etc.)

My regex are not formed well and do not work under some variations. The trouble is probably related to the way I exclude. At first, I was really trying to exclude 'abcdomain.com' but regex did not seem to work that way.

• Query: (http[s]?|ftp)\S*?(abcdomain|myabcdomain)(?!\.com)
• String: http://www.abcdomain.com/logo/email/abcdomain-email-logo.png

• Result: this should be excluded but the query hits on the second abcdomain

  ---

• Query: (http[s]?|ftp):\/\/([\dA-Za-z\.]*)(abcdomain|myabcdomain)(?!.com|..net)

• String: http://www.fakeabcdomain.com
• Result: this should be included but my exclusion only looks after the hit result)

Answer 1

This one works for your test cases:

(?:ht|f)tps?://(?=[^/]*(?:myabcdomain|abcabcdomain|abcdomain(?:\.zendesk)?))(?!(?:\w+\.)?(?:myabcdomain|abcabcdomain|abcdomain(?:\.zendesk)?)\.com)\S+

Explanation:

(?:ht|f)tps?://         : protocol
(?=                     : positive lookahead, make sure we have after
  [^/]*                 : 0 or more non slash
  (?:                   : start non capture group
    myabcdomain         : literally
  |                     : OR
    abcabcdomain        : literally
  |                     : OR
    abcdomain           : literally
    (?:\.zendesk)?      : followed with optional
  )                     : end group
)                       : end lookahead
(?!                     : negative lookahead, make sure we don't a=have after
  (?:\w+\.)?            : optional, 1 or more word character and a dot
  (?:                   : start non capture group
    myabcdomain         : literally
  |                     : OR
    abcabcdomain        : literally
  |                     : OR
    abcdomain           : literally
    (?:\.zendesk)?      : followed with optional
  )                     : end group
  \.com                 : literally
)                       : end lookahead
\S+                     : 1 or more any character that is not a space

It matches:

<a href="http://abcdomain.products.com.vbs">
<a href="https://abcdomainproducts.com">
<a href="http://products.abcdomain.products.net">
<a href="https://products.abcdomainproducts.com/test">
<a href="http://fakeabcdomain.products.com.vbs">
<a href="http://myabcdomain.products.com.vbs">
<a href="http://fakeabcdomain.com">

And doesn't match:

<a href="http://products.myabcdomain.com/help">
<a href="http://abcdomain.zendesk.com/help">
<a href="http://myabcdomain.com/help">
<a href="http://abcdomain.com/help">
<a href="http://products.abcabcdomain.com">