The GAUNTLET filter
http://mailsbestfriend.com/downloads/Filters/GAUNTLET.txt filter has
elements of what you are looking for, it includes some END exceptions.
This is the line which has to do with the sub-domain.
MAILFROM 0 PCRE
(?i:@([a-z0-9-_]{5,25}\.[a-z0-9]+(?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)
Hopefully this helps.
David
On 12/16/2014 4:24 PM, John Tolmachoff wrote:
Trying to catch when the from address is a sub-domain.
Another idea for another test: If a from address is a sub-domain, also check
for MX records for the parent domain. In the spams I am seeing today where the
from address is a sub-domain, and there is and MX record for the sub domain,
there is no MX records for the parent domain.
-----Original Message-----
From: "David Barker" <[email protected]>
Sent: Tuesday, December 16, 2014 12:29pm
To: [email protected]
Subject: [MBF] Re: Need regex help
Not sure exactly what you are trying to match but according to what you
have provided:
(?i:@[0-9a-z]+\..+\..+)
Can you be more specific ?
David
On 12/16/2014 3:17 PM, John Tolmachoff wrote:
I am seeing an increase in spam and using an email in the format of
[email protected].
I would like to find the right regex to use to look for
*@(combinationnumbersletters).*.*
John T
eServices For You
#############################################################
This message is sent to you because you are subscribed to
the mailing list <[email protected]>.
To unsubscribe, E-mail to: <[email protected]>
To switch to the DIGEST mode, E-mail to <[email protected]>
To switch to the INDEX mode, E-mail to <[email protected]>
Send administrative queries to <[email protected]>
--
David Barker
Mail’s Best Friend
Email : [email protected]
Web : www.mailsbestfriend.com
Office : 866.919.2075
Mobile : 978.518.6461
#############################################################
This message is sent to you because you are subscribed to
the mailing list <[email protected]>.
To unsubscribe, E-mail to: <[email protected]>
To switch to the DIGEST mode, E-mail to <[email protected]>
To switch to the INDEX mode, E-mail to <[email protected]>
Send administrative queries to <[email protected]>
