0

I am trying to create a bit of regex that matches any deviation of the domain “example.com”.

Finding characters before or after “example” is easy enough. Finding deviations of “example” is where it gets challenging for me.

I could do something like [^e][^x][^a][^m][^p][^l][^e], but then every character has to be deviated. If I place a ? after each bracketed group, “x.com” now matches.

I need the expression to match a deviation but not match “example”.

I am doing this within the context of a YARA rule, so lookaround is not available.

Anyone have any ideas?

Rory O'Kane
  • 29,210
  • 11
  • 96
  • 131
Brandon Force
  • 73
  • 1
  • 8
  • 2
    What do you mean by *deviation*? – revo Jan 09 '18 at 22:50
  • Can't you just match example.com and use the `!=` operator? – CAustin Jan 09 '18 at 22:51
  • 1
    I think you need to come up with a formal definition for "deviation" before you can search for them. For example I assume you would consider "exemple" to be a deviation because it is the same length and different by only one letter. But is "exaample" a deviation? How about "ample" or "hexample" or "uxumplu"? – Blackhawk Jan 10 '18 at 00:05

0 Answers0