Email bomb processing

[Chris Swinney]

We are seeing an email bomb attack enabled through mass automated sign up to mailing lists. There are literally thousands of emails from thousands of list servers, almost all identical and similar to the following:

Mailing list subscription confirmation notice for mailing list ThisMailingList

We have received a request from x.x.x.x for subscription of your email address, "user@ourdomain.com", to the list@mailinglist.com mailing list. To confirm that you want to be added to this mailing list, simply reply to this message, keeping the Subject: header intact. Or visit this web page:

https://lsiturl/e71d81d79ebb4806c684cddb0e7da7a6ba147b8b

Or include the following line -- and only the following line -- in a message to list@mailinglist.com:

confirm e71d81d79ebb4806c684cddb0e7da7a6ba147b8b


Note that simply sending a `reply' to this message should work from most mail readers, since that usually leaves the Subject: line in the right form (additional "Re:" text in the Subject: is okay).


If you do not wish to be subscribed to this list, please simply disregard this message. If you think you are being maliciously subscribed to the list, or have any other questions, send them to list@mailinglist.com.

These are genuine lists but have nothing to do with users signing up. I would like to extract all the "list@mailinglist.com" URI in the paragraph that contains the text "If you think you are being maliciously subscribed to the list", then reply to that address to say remove.

Has anyone got any bright ideas on extracting the relevant info, even if it requires sending in an alternative step?

 

[Diane Poremsky]

I have a macro that can pull values from the message body - as long as its the last email in the message, it will be easy to pull out.

Use RegEx to extract text from an Outlook email message

How to use RegEx to extract text from an Outlook email message, for example, extracting a tracking code from an email that is always identified as "Tracking code:".

www.slipstick.com

.global = true will look for all instances -

if you write each found value to a string, the last one you find will be used after you exit the 'for each M' loop.

    If Reg1.test(olMail.Body) Then
    
        Set M1 = Reg1.Execute(olMail.Body)
        For Each M In M1
            ' M.SubMatches(1) is the (\w*) in the pattern
            ' use M.SubMatches(2) for the second one if you have two (\w*)
            Debug.Print M.SubMatches(1)

            strAddress =  M.SubMatches(1)
        Next

' do whatever with strAddress write to a file, add to a string if you are processing other messages, etc 
  
  End If