if (
  (/sendmail\[.*?\[(.*?)\],.*?Relaying denied/i) ||
  (/gnu-pop3d\[.*?refused connect from (.*?)$/i) ||
  (/cucipop\[.*?authentication failure\s.*?\s(.*?)$/i)
) { return ($1) };