# Tagging messages sent to multiple addresses - Regex?

## iloose2

What I'm looking to do is count the number of addresses messages are sent to; with the intent of identifying compromised accounts sending SPAM.

Example log line from OpenWebMail:

```

Tue Sep 23 11:59:23 2008 - [5301] (111.111.111.111) username - send message - subject=Congratulations...You Have Won ï¿½1,200,000.00 - bcc=tosales@performancenissan.com, tosborn@fordsales.com,

totallybradical@homail.com, toubie2001@yahoo.ca, touchette.automobile@sympatico.ca, tourismyorkton@sasktel.net, tower@crossroadsautocenter.com, towerford@charterinternet.com, towerford@harborside.com,

towerford@salespoint.dealerconnection.com, towergar@fsbdial.co.uk, towings@racewayford.com, towler@tampabay.rr.com, townandcountry@rockymountains.net, townandcountry@vanion.com, townauto@midmaine.com,

towncenternissanservice@yahoo.com, towne@towneford.com, towne_ford@yahoo.ca, towneford1@aol.com, townsedge@frontiernet.net, towsonsales@usedcarsmaryland.com, toy-volks-sales@crestmont.com,

toy31052@aol.com, toylompo@west.net, toymgmt@mcgeorgecarco.com, toyoexport@hotmail.com, toyoparts@heritagevt.com, toyosale@heritagevt.com, toyota-pekin@ntslink.net, toyota.bridgend.sc3@sytner.co.uk,

toyota.bristolcentral.sc3@sytner.co.uk, toyota.bristolnorth.sc3@sytner.co.uk, toyota.newport.sc3@sytner.co.uk, toyota.occasion@complexeauto.com, toyota.sales@dickhannah.com,

toyota.sales@eddiewiggins.com, toyota.scion@billionauto.com, toyota.tamworth.sc3@sytner.co.uk, toyota6615055@aol.com, toyota@adamsautogroup.com, toyota@baliseauto.com, toyota@castlemaine.net.au,

toyota@culliganautoplace.com, toyota@eddystoyota.com, toyota@heiser.com, toyota@hoselton.com, toyota@hoyfox.com, toyota@machens.com, toyota@nyefrontier.com, toyota@peruzzi.com, toyota@prtel.com,

toyota@rohrman.com, toyota@rotters.com, toyota@southsidetoyota.com.au, toyota@sullivanbrothers.com, toyota@toyotaofnashua.com, toyota@ulster.net, toyota@westoy.com.au, toyota@winsoft.net.au,

toyota_mc@yahoo.com, toyotabill@email.com, toyotabob@bright.net, toyotachris@yahoo.com, toyotacleveland@aol.com, toyotacol@aol.com, toyotafinance@bredemann.com, toyotafinance@obrienauto.com,

toyotaford@kisser.net.au, toyotaleads@burt.com, toyotamejia@yahoo.com, toyotanashville@yahoo.com, toyotaofcolchester@izmocars.com, toyotaofelcajon@outsellchats.dl, toyotaofstamford@aol.com,

toyotaofstamford@prodigy.net, toyotaone@aol.com, toyotaparts@bredemann.com, toyotaparts@concordnc.com, toyotaparts@driveclassic.com, toyotaparts@greenstoyotadirect.com, toyotaparts@hoffmanauto.com,

toyotaparts@paulmiller.com, toyotaparts@rockinghammotors.com, toyotaparts@vossauto.net, toyotarentals@coxtoyota.com, toyotarentals@toyotaofstuart.com, toyotasales@amigoautomotive.com,

toyotasales@burdickcars.com, toyotasales@checkeredflag.com, toyotasales@chuckhutton.com, toyotasales@driveclassic.com, toyotasales@greenstores.net, toyotasales@hoffmanauto.com, toyotasales@lithia.com,

toyotasales@markmiller.com, toyotasales@neillsandler.com, toyotasales@qualityimports.com, toyotasales@rockinghammotors.com, toyotasales@rohrman.com, toyotasales@vossauto.net,

toyotaservice@billionauto.com, toyotaservice@bredemann.com, toyotaservice@driveclassic.com, toyotaservice@heritagevt.com, toyotaservice@hoffmanauto.com, toyotaservice@paulmiller.com,

toyotaservice@rockinghammotors.com, toyotaservice@vossauto.net, toyotasv@crestmont.com, toyotavallejo@izmocars.com, toyotawestparts@setdlr.com, toyotawestservice@setdlr.com, toyotawpt@aol.com,

toyparts@thomason.com, toyparts@wilderauto.com, toyrecep@reinhardttoyota.com, toysales@billionauto.com, toysales@mcgeorgetoyota.com, toyservice@frankmotors.com, toystore@vettenet.com, toywey@aol.com,

tozfive@aol.com, tp_hillips@yahoo.com, tpadfield@ezeeweb.com, tpage@classicbmw.com, tpal@stewarttoyota.com.au, tpalermo@dennyfordlm.com, tpalm@blautogroup.com, tpalmieri@habberstadbmw.com,

tpandjiris@devoeauto.com, tpaniagua@ontariovolvo.com, tpanthofer@zimbrick.com, tpaque@wppisys.org, tparker@arnellmotors.com, tparker@covingtonbuick.com, tparker@mcclurehonda.com,

tparker@newboldtoyota.com, tparness@westonauto.com, tparsley@bobmcdormanchevrolet.com, tpatterson@smithsouthplains.com, tpauls@zimbrick.com, tpc@familyautos.com, tpedersen@charlesgabus.com,

tpeek@robertsmazda.com, tpellman@genereedtoyota.com, tpelzl@gopeoples.com, tpeters@donwood.com, tpeters_autogiuffre@gs.reyrey.com, tpeterson@shackfindlayhonda.dealerspace.com,

tpetrozzino@driveprestige.com, tpez@meadeauto.com, tpfeiler@springhillford.com, tpflieger@mileone.com, tphan@elmoretoyota.com, tphelps@ruraltel.net, tphillips@joehallford.com, tpickens@harrisonfm.com,

tpickett@jacobsmotors.com, tpietras@naylormotors.com, tpilon@welcomeford.com, tplatt@germain.com, tplumb@ramseyauto.com, tpoirier@daytonamazda.com, tpolicaro@bramaleatoyota.com,

tpolicaro@northwestlexus.com, tpolk@worldoferhard.com, tpomo@boundbrookford.com, tpoole@longlewis.com, tporelle@roverhanover.com, tporter@actonlincolnmercury.com, tportis@lynchauto.com,

tpotts@wyler.com, tpoulin@bellaudi.com, tpowell@miltonmartintoyota.com, tpratt@gladstonedodge.com, tpreusser@hawkford.com, tprofit@savageautogroup.com, tpsmith2000@hotmail.com, tpulkowski@keyauto.com,

tputney@fordofupland.com, tpwaters@eircom.net, tqueen@myatlanticford.com, tquinn@niello.com, tr.palmer@maitruck.com, tra@jpthibodeaux.com, trabey@boardwalkag.com, trac@foxfamily.com,

trac@libertytoyota.com, trac@petersonautoplex.com, trace.beck@beckmtr.com, tracey@buerge.com, tracey@goldkey.ca, traceyp@conyerstoyota.com, tracie.pierce@comcast.net, trackit@o2.ie,

tracy.duckworth@jimskinnerford.com, tracy.hunt@alabamaford.com, tracy.mandernach@villageford.net, tracy.nicholson@pritchards.com

```

The above message was sent to 201 users.

What is the best way to count this?

Is there a way to count the number of '@'s with a regex?

I want to be able to have something like the script provided at http://blinkeye.ch/mediawiki/index.php/SSH_Blocking to automatically drop traffic from IPs that send a message to more than X addresses.

Any pointers would be appreciated.

Thanks!

----------

## notHerbert

 *iloose2 wrote:*   

> The above message was sent to 201 users.

 

I think it's 200.

```
$ grep -o "@" logfile | wc -l

200
```

 :Cool: 

----------

## iloose2

Thanks for the grep command, though I had figured that part out.

What I was originally looking for was a regex to parse each line by itself; returning the number of messages and user's source IP.  I should have stated the question more clearly.

I was able to accomplish this with logtail from http://sourceforge.net/projects/sentrytools/ and some scripts.

Each minute with a cron job logtail is run on the openwebmail.log file and the new lines that contain "\- send message-\" are output to a temporary file.  A php script is run which searches the temp file line by line counting the number of recipients and gathering the user's source IP.  If a user sends to more than 50 email address all future traffic is dropped on the Layer 2 bridge with iptables.

Thus continues the fight against this annoying Bot Net that keeps getting into OpenWebMail accounts and sending SPAM.

----------

