RegEx match IP on Mail-Header Received: -

I try to make a regex, which gives me only the sender IP address:

  (? Lt = = bReceived:. To * * []> 
 This is the build of the regular expression, but can not be completed? (<\ {{?}} \ BReceived: from) (. * \ [] (?: \ D {1,3}}. {3} \ d {1,3}  

(On lines starting at: received: from)

  127.0.0.1 127.0.0.1 21.22.23.24  

And this is such an email -Headers are the ones I am looking for:

  to: a@domain.de Return-path: & lt; t@domain.de> X-Original-To: a @ domain .de Delivered: Received c@domain.tld: From local host (local host [127.0.0.1]) to mail1.domain.tld (postfix) ESMTP id 3fT3TR72zNz8m8 & lt; a @ domain.de & gt ;; Tue, 18 Feb 2014 14:54:35 +0100 (CET) X-virus scanned: mail1.domain.tld X-Spam-Flag on Debian amavisd new Yes X- Spam-score: 5.773 X- Spam-level: ***** X- Spam-status: Yes, score = 5.773 tagged_above = 1 requires = 4.5 tests = [BAYES_05 = -0.5, MISSING_MID = 0.497, RCVD_IN_PBL = 3.335, RCVD_IN_RP_RNBL = 1.31, RDNS_DYNAMIC = 0.982, TO_NO_BRKTS_DYNIP = 0.139, T_RCVD_IN_SEMBLACK = 0.01] autolearn = not: mail1.domain.tld ([127.0.0.1]) the local host (mail1.domain.tld [127.0.0.1 ]) (Amavisd new, port 10024) for ESMTP ID with lDJqiZjBn2t4 & lt; A@domain.de>;; Tue, 18 Feb 2014 14:54:34 +0100 received (CET): SMTP by mail.domain.tld (pAAAAAAAA.dip0.t-ipconnect.de [21.22.23.24]) by Maillkdomainktld (postfix) With ID 3fT3TQ4Nwgz8m5 for & lt; A@domain.de>;; Tuesday, 18 February 2014 14:54:34 +0100 (CET) Date: Tuesday, 18 February 2014 15:02:11 +0100 From: "From" & lt; T@domain.de> From: "to" & lt; T@domain.de> Subject: Sabbab (1920.168.123.123) To reply: t@domain.de MIME-version: 1.0 Content-type: text / plain; Charset = UTF-8 Message-ID: & lt; 3fT3TR72zNz8m8@mail1.domain.tld>  

Try this expression:

  received : From [^ \ n] *? \ [[[[0-9.] +) \]  

Edit:

Try something like this for PHP scripts (where $ $ in the email header The data you are looking for is):

  $ regex = '/ Received: + [^ \ \ n] *? \\ [from [[0-9 \\]] +] \\] / s'; If (preg_match_all ($ regex, $ email header, $ matches_out)) {print_r ($ matches_out); } Other {Print ('Sender IP not found'); }