SyslogScan::Daemon::SpamDetector::SpamSink - notice messages sent to a honeypot

 plugin SyslogScan::Daemon::SpamDetector as sd_

 sd_plugin SyslogScan::Daemon::SpamDetector::SpamSink
	debug 0
	logfile /var/log/mail.info

Watch the system log files for message sent to spam honeypots.

It looks for the following kind of message line:

 $Date \S+ spamsink: Message-I[dD]: <.*?>

Lines like this can be generate by forwarding mail to a program like:

 #!/bin/sh 
 perl -e '
        $x = <>; 
        while (<>) { 
                last if /^$/; 
                next unless /^(Message-I[dD]: .*)/; 
                $y = $1; 
        } 
        print "$y\n" 
                if      $x =~ /\@/ 
                        && $y =~ /\@/ 
                        && $x !~ /mailer-daemon/i 
                        && $x !~ /postmaster/ ; 
 ' | /usr/bin/logger -p mail.info -t spamsink

The following configuration parameters are supported:

debug

Debugging on (1) or off (0).

logfile

Which logfile to watch (default: /var/log/syslog).

SyslogScan::Daemon::SpamDetector

If you need high-speed internet services (T1, T3, OC3 etc), please send me your request-for-quote. I have access to very good pricing: you'll save money and get a great service.

Copyright(C) 2006 David Muir Sharnoff <muir@idiom.com>. This module may be used and distributed on the same terms as Perl itself.