python script as an emergency mailbox cleaner

[Ng Pheng Siong]

According to Phil Weldon <pweldon at mindspring.com>:
> The other type of e-mail
> is a fake notification of undeliverable e-mail.  This one is a real bear.
> There seem to be hundreds variations in the body content and thousands of
> variations in the header.  

So far I've caught all of these using this procmail recipe:

  :0 B
  * ^<BR><BR><BR>(<BR>)*Undeliver
  /dev/null

This scans the body for a string matching the regex in the second line. "*"
is a delimiter, not part of the regex.

The first several hundred I got had 3 <BR>'s, then it started coming with
4.

Similarly, the fake MS update first said "September 2003 Cumulative Patch",
then after several hundred I started to see "July 2003". I just saw one
"January 2000". The thing feels like it is mutating in response to filters!

> My guess is that the internet will not open on Monday.

Civilisation is under attack.


-- 
Ng Pheng Siong <ngps at netmemetic.com> 

http://firewall.rulemaker.net  -+- Manage Your Firewall Rulebase Changes
http://sandbox.rulemaker.net/ngps -+- Open Source Python Crypto & SSL