Is it supposed to be top level domain? And is it really what it appears to be, i.e. regexp for <anything>istar (aistar, bistar, abcdistar, ...)? If it's TLD, then use simple: istar.\x01 It might give you some false positives, e.g. istarx.y.example.net, but it should not be too bad. Need only anythi...