#!/bin/sh
#
# Spam checker
# shoorik@ilyichevsk.net (c) Alexander Voronin
#

mydomain=ilyichevsk
spamlimit=40
maillog="/var/log/maillog"
spamlist="/root/viruslist.ip"
spamrefresh="/bin/sh /root/viruslist"

# start this hour
curdate=`date +%H:00:`
startline=`grep -n $curdate $maillog | head -1 | cut -f 1 -d ':'`

# logs hole
if [ "$startline" = "" ]; then
        checklines=5000
else
        totallines=`wc -l /var/log/maillog | awk '{print $1}'`
        checklines=`echo $totallines-$startline | bc`
fi

# last hour check
maxmail=`tail -$checklines $maillog | grep "connect from" | awk '{ print $8 }' | grep $mydomain | sort | uniq -c | sort -n +0 | tail -1`
maxspam=`echo $maxmail | awk '{ print $1 }'`
ipspam=`echo $maxmail | cut -f 2 -d '[' | cut -f 1 -d ']'`

echo "startline=$startline"
echo "checklines=$checklines"
echo "maxspam=$maxspam"
echo "ipspam=$ipspam"

if [ "$maxspam" -ge "$spamlimit" ]; then
        echo -n "Got spamer $ipspam : "
        if [ "`grep $ipspam $spamlist`" = "" ]; then
                  echo "adding to list"
                  echo $ipspam >> $spamlist
                  $spamrefresh
        else
                  echo "already added"
        fi
fi