#! /bin/bash
# Afrihost - hourly spam handle script


! [ -f /etc/spamnuke_hourly_auto_deny ] || exit
mkdir  /var/mail/quarantine/  2>/dev/null
chown mailnull.   /var/mail/quarantine/
cat /etc/exim.conf.local | grep / | awk -F "lsearch:" '{print $2}' | xargs -i touch {}
if ! [ -f /etc/whitelist_exim_deny ] ; then  touch /etc/whitelist_exim_deny ; fi 

/usr/local/afribin/senderstats --lasthour   | geoip  | egrep -v 'google|my.com|outlook.com'  | sed 's/<=//g'| egrep -v 'ZA|__' |  grep  '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'  | grep  "\[..\ " | awk '{print $2,$3}' | grep -o  ".*@.*\ "|  sort | uniq -c  | sort -k1n |awk '{if($1==$1+0 && $1>4)print $NF}'| grep @ | while read pspammer ; do if ! grep "$(date +"%Y"-"%m-%d").*::multisourceIP-login-spam::"$pspammer"" /root/.spamnuke  ; then echo "$(date +"%Y"-"%m-%d-%R")::multisourceIP-login-spam::$pspammer" | tee -a /root/.spamnuke ; echo "=== Cleaning mail based on /usr/local/afribin/senderstats  -- logged to /root/.spamnuke" ; ips eximstop ;  frob spamming $pspammer ; /scripts/restartsrv_exim ; /scripts/restartsrv_dovecot  ; else echo "=== $pspammer - should be handled already - contact server-admin if still spamming ===" ; fi ; done

tail -n1  /root/.preports/exim/`hostname`.hsbu.txt  | awk '$1 > 1000' | awk '{print $2}' | grep -v @ | while read puname ; do if grep "$(date +"%Y"-"%m"-"%d %H")" /var/log/exim_mainlog | grep $puname  | grep -v -f /etc/whitelist_exim_deny| grep cwd | grep -o "......\-......\-.." | sort | uniq -c | awk '($1 > 1000)' ; then if ! grep "$puname" /etc/exim_deny_auto_local ; then echo "$puname@`hostname`" >> /etc/exim_deny_auto_local ; if ! grep "$(date +"%Y"-"%m-%d")" /root/.spamnuke ; then echo "$(date +"%Y"-"%m-%d-%R")::exploited-site-spam::"$puname"@`hostname`" |tee -a /root/.spamnuke ; fi ; echo "=== Cleaning mail based on /root/.preports/exim/`hostname`.hsbu.txt -- logged to /root/.spamnuke" ;  ips eximstop ; ips spamnuke $puname ; /scripts/restartsrv_exim ; /scripts/restartsrv_dovecot ;  else echo "=== $puname - should be handled already - contact server-admin if still spamming ===" ; fi ; fi  ; done

#grep "<>" /var/log/exim_mainlog |  grep "$(date +"%Y"-"%m"-"%d"\ "%H")"  |grep "from <> for" | awk '{print $NF}' | sort | uniq -c  | sort -k1n |awk '{if($1==$1+0 && $1>10)print $NF}'| grep @ | while read pspammer ; do if !  grep "$(date +"%Y"-"%m-%d").*::bounce-count-spam::"$pspammer"" /root/.spamnuke ; then echo "$(date +"%Y"-"%m-%d-%R")::bounce-count-spam::$pspammer" >> /root/.spamnuke;  ips eximstop ;  echo "frob spamming $pspammer" ; /scripts/restartsrv_exim ; /scripts/restartsrv_dovecot  ; else echo "=== $pspammer - should be handled already - contact server-admin if still spamming === Or run frob spamming emailaccount" ; fi ; done

# clear spam if there are more than 100 bounce in current queue for a particular user or email address
exim -bp | grep "<>" |grep -o  "......-......-.." | while read pbounces ; do
        exim -Mvh "$pbounces" | emailgrep | egrep -v 'Mailer-Daemon|root\@|fail2ban\@|inContact@fnb.co.za'
done | sort | uniq -c  | sort -k1n |awk ' $1>100 {print $2}'| while read pspammer ; do
        if echo "$pspammer" | grep -q `hostname`; then echo "echo \"$pspammer\"|sed 's/@`hostname`//'"|bash|tee -a /root/africlamusers.tmp ; if ! grep $pspammer /etc/exim_deny_auto_local ; then echo $pspammer >> /etc/exim_deny_auto_local ; ips spamnuke $pspammer ; echo "$(date +"%Y"-"%m-%d-%R")::inqueue_bounceback-over100-spam::"$pspammer"" >> /root/.spamnuke ; fi else if echo "$pspammer" | grep -q "\@" ; then echo "frob spamming $pspammer" | bash ;  echo "$(date +"%Y"-"%m-%d-%R")::bounceback-over5000-spam::"$pspammer"" | tee -a /root/.spamnuke ; fi ; fi ; done

# lock spammers based on bounce per hour...
grep "`date -d '1 hour ago'  "+%Y-%m-%d\ %H"`" /var/log/exim_mainlog  | egrep 'This message was blocked because its content|Messages missing a valid address|The email account that you tried to reach does not exist'| egrep -v 'delay|unattended'  | grep -o " for\ .*@.*"  | sort | uniq -c | sort -k1n  |awk '{if($1==$1+0 && $1>100)print $NF}'| grep @ | while read pspammer ; do if !  grep "$(date +"%Y"-"%m-%d").*::bounce-per-hour-count100-spam::"$pspammer"" /root/.spamnuke ; then echo "$(date +"%Y"-"%m-%d-%R")::bounce-per-hour-count-spam::$pspammer" >> /root/.spamnuke;  ips eximstop ; frob spamming $pspammer ; /scripts/restartsrv_exim ; /scripts/restartsrv_dovecot  ; else echo "=== $pspammer - should be handled already - contact server-admin if still spamming === Or run frob spamming emailaccount" ; fi ; done

cat /etc/whitelist_exim_deny  | xargs -i echo "sed -i '/{}/d' /etc/exim_deny_*" | bash