Trying to catch when the from address is a sub-domain. Another idea for another test: If a from address is a sub-domain, also check for MX records for the parent domain. In the spams I am seeing today where the from address is a sub-domain, and there is and MX record for the sub domain, there is no MX records for the parent domain.
-----Original Message----- From: "David Barker" <[email protected]> Sent: Tuesday, December 16, 2014 12:29pm To: [email protected] Subject: [MBF] Re: Need regex help Not sure exactly what you are trying to match but according to what you have provided: (?i:@[0-9a-z]+\..+\..+) Can you be more specific ? David On 12/16/2014 3:17 PM, John Tolmachoff wrote: > I am seeing an increase in spam and using an email in the format of > [email protected]. > > I would like to find the right regex to use to look for > *@(combinationnumbersletters).*.* > > John T > eServices For You > > > ############################################################# > This message is sent to you because you are subscribed to > the mailing list <[email protected]>. > To unsubscribe, E-mail to: <[email protected]> > To switch to the DIGEST mode, E-mail to <[email protected]> > To switch to the INDEX mode, E-mail to <[email protected]> > Send administrative queries to <[email protected]> > -- David Barker Mail’s Best Friend Email : [email protected] Web : www.mailsbestfriend.com Office : 866.919.2075 Mobile : 978.518.6461 ############################################################# This message is sent to you because you are subscribed to the mailing list <[email protected]>. To unsubscribe, E-mail to: <[email protected]> To switch to the DIGEST mode, E-mail to <[email protected]> To switch to the INDEX mode, E-mail to <[email protected]> Send administrative queries to <[email protected]> ############################################################# This message is sent to you because you are subscribed to the mailing list <[email protected]>. To unsubscribe, E-mail to: <[email protected]> To switch to the DIGEST mode, E-mail to <[email protected]> To switch to the INDEX mode, E-mail to <[email protected]> Send administrative queries to <[email protected]>
