python script as an emergency mailbox cleaner

Ng Pheng Siong ngps at
Sat Sep 20 17:03:22 CEST 2003

According to Phil Weldon <pweldon at>:
> The other type of e-mail
> is a fake notification of undeliverable e-mail.  This one is a real bear.
> There seem to be hundreds variations in the body content and thousands of
> variations in the header.  

So far I've caught all of these using this procmail recipe:

  :0 B
  * ^<BR><BR><BR>(<BR>)*Undeliver

This scans the body for a string matching the regex in the second line. "*"
is a delimiter, not part of the regex.

The first several hundred I got had 3 <BR>'s, then it started coming with

Similarly, the fake MS update first said "September 2003 Cumulative Patch",
then after several hundred I started to see "July 2003". I just saw one
"January 2000". The thing feels like it is mutating in response to filters!

> My guess is that the internet will not open on Monday.

Civilisation is under attack.

Ng Pheng Siong <ngps at>  -+- Manage Your Firewall Rulebase Changes -+- Open Source Python Crypto & SSL

More information about the Python-list mailing list