'script to get just the originating IP of (EMAILS) .eml files - Exchange Queue
'Author: Felipe Ferreira fel.h2o(a)gmail.com
'Date: 19/09/2007
'Version: 1.0

on error resume next
strScriptFile = WScript.ScriptFullname
strScriptPath = Left(strScriptFile, Len(strScriptFile) - Len(WScript.Scriptname)) 'used to define the path from where the script file is located
Dim iFSO : Set iFSO = CreateObject("Scripting.FilesyStemObject")
Dim oFSO : Set oFSO = CreateObject("Scripting.FilesyStemObject")
Dim o2FSO : Set o2FSO = CreateObject("Scripting.FilesyStemObject")
on error resume next
outputfile = strScriptPath & "Ips.txt"
Set ofile2 = o2FSo.OpenTextFile(Outputfile, 8, TRUE)

'@@@@@@@@@@@@@@@@@@@@@@@@@@EDIT HERE@@@@@@@@@@@@@@@
pathemail ="X:\SMTP\vsi 1\Queue\"
'@@@@@@@@@@@@@@@@@@@@@@@@@@EDIT HERE@@@@@@@@@@@@@@@

 Set oFolder = oFSO.GetFolder(pathemail)
 Set oFileCollection = oFolder.Files  
 For each oFile in oFileCollection 
  Set ifile = iFSO.OpenTextFile(pathemail & ofile.name)  
  filec = 0
  Do until ifile.AtEndOfLine
	strLine = ifile.ReadLine
	'wscript.echo filec
	if instr(strLine,"Received:") then
	  if filec = 2 then
	  strLine = mid(strline,15,55)
	  'wscript.echo strLine
	  arrlines = split(strline, " ")
	  'wscript.echo strline
	  if arrlines(2) <> "" then
	   'wscript.echo arrlines(2)
	  end if
	  	strPattern="(\d{1,3}\.\d{1,3}\.\d{1,3})\.(\d{1,3})"
		Set RegEx = New RegExp              
		RegEx.IgnoreCase = True             
		RegEx.Global=True                   
		RegEx.Pattern=strPattern
		Set colMatches=RegEx.Execute(arrlines(2))
		     For Each match In colMatches
				WScript.Echo "IP Address: " & match.value   
				ofile2.writeline  match.value
			 Next
		'wscript.echo strLine
		
	  end if
	filec = filec + 1
	end if
  loop
 next
 wscript.echo "done, output IPs at " & Outputfile 
 ofile2.close
 ifile.close
 wscript.quit