From - Fri Sep 19 07:18:05 1997 Path: news.mitre.org!blanket.mitre.org!news.tufts.edu!cam-news-feed5.bbnplanet.com!cam-news-hub1.bbnplanet.com!news.bbnplanet.com!news.maxwell.syr.edu!Supernews60!supernews.com!news.nap.net!news2.nap.net!news.dls.net!not-for-mail From: Sam Rozenfeld Newsgroups: comp.os.vms Subject: Quick spam scanner for MX 4.2 Date: Thu, 18 Sep 1997 20:20:32 -0500 Organization: DLS Internet Services Lines: 39 Message-ID: <3421D360.40D5@dls.net> Reply-To: rozenfeld@dls.net NNTP-Posting-Host: office.dls.net Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Mailer: Mozilla 3.0Gold (Win95; I) $! $! This is a quick spam Filter for MX 4.2. After extensive spam attacks we have $! noticed that few bulk emailers are using the same method to generate $! fake random email addresses. Addresses look something like $! <12432134@aol.com>. It is safe to assume that if we convert the part of $! email address before "@" into an integer and get value greater than 10 - $! username is likely a spammer. $! $! We also have a filter to do it only to outgoing mail. But incoming mail $! could be taken care of too. We have this running every 5 minutes now but $! feel free to run it however often you want. $! $! 09/18/1997 Sam Rozenfeld $! $ mcp :== $mx_exe:mcp $ on control_y then goto endit $ mcp show queue/output=mxqueue.lis $ sear/output=temp.lis mxqueue.lis "<" $ open/read mxqueue temp.lis $ loop: $ read/end=endit mxqueue record $! $! Only do SMTP (outgoing) $! $ if f$locate("SMTP",record) .eqs. f$length(record) then goto loop $ address = f$extract(f$locate("<",record),f$locate(">",record),record) $ full_ad = address - "<" - ">" $ address = f$extract(full_ad,f$locate("@",full_ad),full_ad) $ if f$integer(address) .gt. 10 $ then $ mail_id = f$edit(f$extract(0,7,record),"trim") $ mcp queue cancel 'mail_id' $ write sys$output "''full_ad' is a spammer - entry ''mail_id' cancelled" $ endif $ goto loop $ endit: $ close mxqueue $ purge mxqueue.lis,temp.lis $ exit