This week I started playing around with PHP and a honeypot mailbox I had created some time ago. The following PHP is what I have been using thus far – plenty more work to do:
$hostname = '{imap.domain.uk:143/notls}INBOX';
$username = 'honeypot';
$password = 'topsecret';
$inbox = imap_open($hostname,$username,$password) or die('Cannot connect to Mail server as user: ' . imap_last_error());
$count = imap_num_msg($inbox);
print "\nNumber of messages is:".$count;
$emails = imap_search($inbox,'ALL');
if($emails) {
$output = '';
rsort($emails);
foreach($emails as $email_number) {
/* get information specific to this email */
$overview = imap_fetch_overview($inbox,$email_number,0);
//()Root Message Part (multipart/related)
//(1) The text parts of the message (multipart/alternative)
//(1.1) Plain text version (text/plain)
//(1.2) HTML version (text/html)
//(2) The background stationary (image/gif)
$message = imap_fetchbody($inbox,$email_number,1);
$header = imap_headerinfo($inbox, $email_number);
print_r($header);
$address_sender=$overview[0]->from;
// We only want to check external emails
if(!strstr($address_sender,"domain.uk")){
//pull out the email address of the sender for blacklisting
if (preg_match("<[_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*(\.[a-z]{2,4})>", $address_sender, $matches)) {
print "\nSender: ".$matches[0];
}
$decoded_message=quoted_printable_decode ( $message );
//pull out any links in the email for blacklisting - this still needs some work
if (preg_match("((https?|ftp|gopher|telnet|file|notes|ms-help):((\/\/)|(\\\\))+[\w\d:#@%\/;$()~_?\+-=\\\.&]*)",$decoded_message, $link_matches)){
print_r($link_matches);
}
}
/* output the email header information */
//$overview[0]->seen ? 'read' : 'unread')
//$overview[0]->subject
//$overview[0]->from
//$overview[0]->date
}
}
/* close the connection */
imap_close($inbox);
