We were recently hit with a large number of mails in the active recipient queue due to one of our customers being exposed as an open relay, in a nutshell we sat with just over 100 000 mails in the queue destined for Russian domains .ru.
I was surprised to see no regular expression option in deleterecipients, am I missing something or does it not actually exist?

In case anyone finds themselves in this predicament I wrote a handy script to go get the list of domains off the Ironport and output the commands so as to avoid doing one by one recipient deletion

#/bin/bash
/usr/bin/expect /root/scripts/tophosts.exp (ipaddress) tophosts active_rcpts >> hosts

for i in `cat hosts | awk '{print $2}' | sed '/^$/d' | grep .ru` ;do echo deleterecipients host $i;done

rm hosts

The above will search via grep for .ru, this can be changed

For expect script

#!/usr/bin/expect -f
set ipaddr [lrange $argv 0 0]
set scriptname [lrange $argv 1 1]
set arg1 [lrange $argv 2 2]
#set timeout -1
spawn ssh -p 22 admin@$ipaddr $scriptname $arg1
match_max 100000
# send blank line (\r)
#send -- "\r"
expect eof


For this to work you'll have to have your public key on the Ironports sshconfig for admin