Welcome to the Q&A Forum

Annoyingly the disavow tool does not support complex matching. If you're after wildcard or regex matching for your disavow uploads, that's something you won't be able to get your hands on. It is a shame because, coordinated network link-bombardment really has no simple 1-click solution for webmasters right now (that's pretty poor!) You'd have to build something more complex which connects with the API of the tool which detects all of these links. It would have to have its own database and be programatically capable of updating that database. You'd need it to filter out all of the domains which don't match your pattern (and come up with regex / SQL queries for matching that exact pattern in a robust, reliable manner). It would have to de-dupe existing / new entries and then generate a text file for you. It would also have to be capable of comparing the file it generates against your existing file, so it doesn't lose your manual-mode disavows To me, it sounds like a lot of trouble to go to. I'd make a post about it on Google's forum here: https://productforums.google.com/forum/#!forum/webmasters - try to attract the attention of someone from Google and let them know that, these kinds of attacks do happen and you want the Disavow Tool (as a Google product) to properly allow people to defend themselves.

One more detail of note The old site still shows in google site: search, two full years after everything is 301'ed. Change of address was not used - is that critical to ensure that PR passes? If so - it doesnt allow redirecting into a subfolder - what do you recommend in this cases - temporarily change our 301 to point to newsite.com instead of newsite.com/subfolder in able to get past this blocker in the GSC change of address tool? "The old site redirects to newsite.com/xxxx, which does not correspond to the new site you chose."