On Fri, 2 Nov 2007, Mike Kenny wrote: > I have a number of users that are receiving spam of varying types. The only > common factor is the from address. This looks like > > from=<[EMAIL PROTECTED]> > > where sX.com looks like it is a genuine site name, e.g. > shibatec.com > southstreetfinancial.com > skiprockmultimedia.com > > etc. > > What I need (I think) is a perl regex that will match the above > patter. This is beyond my experience, can anybody assist me?
Backreferences. Try this - I haven't had a chance to test it yet: header XX From =~ /<dw(\S+)[EMAIL PROTECTED]>/ -- John Hardin KA7OHZ http://www.impsec.org/~jhardin/ [EMAIL PROTECTED] FALaholic #11174 pgpk -a [EMAIL PROTECTED] key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 ----------------------------------------------------------------------- "Bother," said Pooh as he struggled with /etc/sendmail.cf, "it never does quite what I want. I wish Christopher Robin was here." -- Peter da Silva in a.s.r ----------------------------------------------------------------------- 2 days until Daylight Saving Time ends in U.S. - Fall Back
