I’ve been using a catch-all on all my custom domains for as long as I’ve had a custom domain and it’s worked great.

However, about 2 weeks back my business custom domain started creating loads of aliases that were used to send me spam (all related to finance/accounts, the message would say I owe a vendor money.) I disabled the catch-all so that they spam would stop, but I’d still like to use it if possible (via the auto create rules).

Does anyone have a regex for Simplelogin that I can use to help combat this issue? Or is this there not much that I can do?

I can provide a list of the aliases that were created if it helps?