Retrospective Spam Filter

As a good spamcop user, I like to report all the spam that slips through the black lists and filters. That way, making sure the network admins know about any open relays they might have while building the black lists. However, a lot of spam comes through over night and I get a full inbox in the morning. When I report most of these, they have already been black listed. So, I thought it would be best to write a script that would check to see if these had already been listed and filter based on this. This way, even if the spam slipped through the black list on the first try, eventually it would be listed and filtered out of the inbox after the fact. This code seems to be working well for my inbox so I thought I should share it for all Lotus Notes and Ruby users:

require 'win32ole'
require 'socket'

@application = WIN32OLE.new('Notes.NotesSession')

def check_file(server, mail)
@database = @application.GetDatabase(server, mail)
@database.Open(server, mail) unless @database.IsOpen
@view = @database.GetView('($InBox)')


dnsbls = %w{bl.spamcop.net cbl.abuseat.org}

count = @view.TopLevelEntryCount
count.times do |index|
doc = @view.GetNthDocument(index+1)
spamdocs = []

doc.GetReceivedItemText.each do |t|
start = t.split(/[()]/)
start[1] =~ /(\d+).(\d+).(\d+).(\d+)/
dnsbls.each do |dnsbl|
begin
var = Socket.getaddrinfo "#$4.#$3.#$2.#$1.#{dnsbl}", 0
puts var[0][2]

if var[0][2] =~ /127.0/
puts "Access denied for #{start[1]} by #{dnsbl}"
spamdocs << doc
end
rescue
end
end
end

spamdocs.each do |doc|
doc.RemoveFromFolder("($InBox)")
doc.PutInFolder("($JunkMail)")
end

end
end


check_file('www/projectlounge',"mail/iconnor.nsf")


Disposable email, spamcop and a trap

I will never be afraid to give out my email address again. Well, maybe not my actual address, but I will give away my sneakemail address. This service (http://sneakemail.com), will allow you to generate a random looking email address like "a9svgun0211@sneakemail.com" that you can safely give out. It is a disposable address that you can use to sign up for a given site, tag it for that purpose and then if you get any spam from that site, delete the address.
However, I have recently taken this one step further. I have created a spamtrap address that will automatically report spam to spamcop and blacklist the IP address of the hosting servers. So, instead of deleting the address, I simply re route it to the spam trap and increase the power of the blacklist.
Requires tools:
1. Sneakemail (free accounts available)
2. Spamcop reporting account
3. Automatic report account - the trap account (Thunderbird Reporter or Lotus Notes reporter )
Then you can use your disposable email addresses as you need and have them divert to the spam trap if they start to get spammed.

Reporting Spam to SpamCop from Lotus Notes

Here is a very simple agent to report a select email or emails to spamcop's quick reporting service. You will need a spamcop account and access to quick reporting.

It uses a new r6 feature of lotusscript to get the received header information so that spamcop will know exactly where the email came from at each hop. This is important as they use this for their black lists so that the correct servers are blocked while the innocent receiving servers are not.

It is also important to list your allowed hosts with spamcop so that if it routes through some of your servers then these will not be treated at open relays.

Sub Initialize
Dim s As New notessession
Dim dc As NotesDocumentCollection
Dim db As notesdatabase
Dim doc As notesdocument

Set db = s.CurrentDatabase
Set dc = db.UnprocessedDocuments

Set doc = dc.GetFirstDocument


While Not(doc Is Nothing)

Dim text As String
text = ""
Forall t In doc.GetReceivedItemText
text = text + "Received: " + t + Chr(10)
End Forall
Forall it In doc.Items
If it.name <> "Received" Then
text = text + it.name + ": " + it.text + Chr (10)
End If
End Forall

Dim mail As notesdocument
Set mail = db.CreateDocument

mail.form = "memo"
mail.subject = "Spam to report"
mail.body = text

Call mail.Send(False, "spam@uce.gov")
Call mail.Send(False, "quick.[yoursecretkeyhere]@spam.spamcop.net")

'You can then save or just delete it here
doc.RemoveFromFolder("($junkmail)")
Call doc.Save(True, False)

Set doc = dc.GetNextDocument(doc)
Wend
End Sub

Like this article? Digg it!