Regular Expressions

This page contains a collection of useful regular expressions (RegEx), among others for URLs, phone numbers, e-mail addresses, IP addresses and wallet addresses.

Content

Apache HTTP Logs
BitLocker Recovery Key
E-Mail Address
Hostname
IPv4 Address
IPv6 Address
Hashes
Onion Domain
Telephone Number
Uniform Resource Locator (URL)
Wallet Addresses

The regular expressions are kept as neutral as possible. For some scripting or programming languages or various other programs, modifications - such as masking of certain characters - may be necessary. Checks for exact match (^ or $) or respect of word boundaries (\b) are usually not included. For the entire match, the expression can be enclosed in round brackets if these are not required and are already included anyway.

Apache HTTP Logs

^(\S+) (\S+) (\S+) \[([^:]+):(\d+:\d+:\d+) ([^\]]+)\] "(\S+) (.*?) (\S+)" (\S+) (\S+) "([^"]*)" "([^"]*)"

This expression splits one line of an Apache HTTP log (for PHP / PCRE)

The end of the expression must/can be adjusted depending on the available log fields.

The data included are: Host, user, password, date, time, time offset, method, request, HTTP version, status code, size, referrer, user agent

BitLocker Recovery Key

([0-9]{6}-){7}[0-9]{6}

E-Mail Address

(?:[a-z0-9!#$%&'"*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'"*+/=?^_`{|}~-]+)*)@(?:(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?|\[(?:(?:(?:2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\.){3}(?:(?:2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9])|[a-z0-9-]*[a-z0-9]:)\])

Support for quotation marks in local part:

(?:[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*|"(?:[ \x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[ \x01-\x09\x0b\x0c\x0e-\x7f])*")@(?:(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?|\[(?:(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\.){3}(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9])|[a-z0-9-]*[a-z0-9]:(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21-\x5a\x53-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])+)\])

Simple:

[_a-zA-Z0-9-]+(?:\.[_a-zA-Z0-9 .+-]+)*@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*(?:\.[a-zA-Z]{2,6})

Hostname

(?:[0-9a-zA-Z](?:[0-9a-zA-Z-]{0,61}[0-9a-zA-Z])?\.)+[0-9a-zA-Z][0-9a-zA-Z-]{0,61}[0-9a-zA-Z]

IPv4 Address

(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)

IPv6 Address

(?:[0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?:(?::[0-9a-fA-F]{1,4}){1,6})|:(?:(?::[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(?::0{1,4}){0,1}:){0,1}(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])|(?:[0-9a-fA-F]{1,4}:){1,4}:(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])

Full notation only and without IPv4 mapped addresses:

(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}

Hashes

MD5

[a-zA-Z0-9]{32}

SHA-1

[a-zA-Z0-9]{40}

SHA-224

[a-zA-Z0-9]{56}

SHA-256

[a-zA-Z0-9]{64}

SHA-384

[a-zA-Z0-9]{96}

SHA-512

[a-zA-Z0-9]{128}

Onion Domain

[a-z2-7]{56}\.onion

Telephone Number

(?:tel:\+?|\+)([0-9][-.+ /0-9\(\)]+[0-9])

The first matching group contains the phone number.

Uniform Resource Locator (URL)

[A-Za-z]+://[-0-9a-zA-Z_]+(?:\.[0-9a-zA-Z_][-0-9a-zA-Z_]*)+(?::[0-9]+)?(?:/[^.!,?\"<>\[\]{}\s\x7F-\xFF]*(?:[.!,?]+[^.!,?\"<>\[\]{}\s\x7F-\xFF]+)*)?

Wallet Addresses

AEON:

Wm[st]{1}[0-9a-zA-Z]{94}

Bitcoin (BTC):

([13][a-km-zA-HJ-NP-Z1-9]{24,33}|bc1[a-z0-9]{39,59})

Bitcoin Cash (BCH):

(?:(?:bitcoincash|bchreg|bchtest):)?(?:q|p)(?:[a-z0-9]{41}|[A-Z0-9]{41})

Bytecoin (BCN):

2[0-9AB][0-9a-zA-Z]{93}

Dash (DASH):

X[a-zA-Z0-9]{33}

Dogecoin (DOGE):

D{1}[5-9A-HJ-NP-U]{1}[1-9A-HJ-NP-Za-km-z]{32}

Ethereum (ETH):

0x[a-fA-F0-9]{40}

Litecoin (LTC):

(?:[LM3][a-km-zA-HJ-NP-Z1-9]{24,33}|ltc1[a-z0-9]{39,59})

Monero (XMR):

[48][0-9AB][1-9A-HJ-NP-Za-km-z]{93}

Nano (NANO):

(?:nano|xrb)_[13]{1}[13-9a-km-z]{59}

Ripple (XRP) / XRP Ledger:

r[1-9A-HJ-NP-Za-km-z]{25,33}