#! /bin/bash
# Afrihost - check mail queue and clean if spam found
# Please feel free to improve / add patterns.
date

! [ -f /etc/spamnuke_hourly_auto_deny ] || exit

mailicious_mail_patterns () {
        egrep -i '\ last longer\ |\ viagra\ |\ Cialis\ |\ Levitra\ |\ Stendra\ |\ comcast\ |\ impotence\ |\ nude\ |\ get hard\ |t-online.de|\ Innovative drug|\ Drug prescription'
}

# clear spam if from-address is multiple different from addresses but the auth_id is one user.
echo -e  "If from-address is multiple different from addresses but the auth_id is one user.\n"
rm -fv  /tmp/{ptmp,spam_auth_total_check} 
cat /dev/null > /root/africlamusers.tmp

eximanage --stats | awk '{print $1,$5}' | grep -v sample | while read pfrom pmid ; do
	echo "$pfrom $(exim -Mvh $pmid|egrep 'auth_id' )"| grep auth_id ; done | 
	awk '{print $1,$3}'|grep -v from-address | tee /tmp/.spam_auth_total_check 
for i in $(awk  '{print $2}' /tmp/.spam_auth_total_check | sort | uniq ) ; do         
        echo "$i $(grep  $i /tmp/.spam_auth_total_check | wc -l)" |awk ' $2>200  {print $0}'|         
        awk '{print $1}' | tee -a /root/africlamusers.tmp; done | 
while read pspammer ; do if echo "$pspammer" |grep "\@" ; then  
        echo "spammer email address" ; echo "$pspammer" ; frob spamming "$pspammer"  ; 
        /usr/local/afribin/ips spamnuke "$pspammer" ; else  echo "pspammer is $pspammer" ; 
        echo "$pspammer" | 
tee -a  /root/africlamusers.tmp ; eximanage --dfrom  ".*`hostname`" ;  screen -ls ; fi ; 
if ! grep "$(date +"%Y"-"%m-%d").*::spamnuke_rule1::"$pspammer"" /root/.spamnuke  ; then echo "$(date +"%Y"-"%m-%d-%R")::spamnuke_rule1::$pspammer" | tee -a /root/.spamnuke ; fi ; done

#eximanage --stats | awk '{print $1,$5}' | while read pfrom pmid ; do echo "$pfrom $(exim -Mvh $pmid|grep -A1  '\-aclm' )" ; done  | sort | uniq -c  | sort -k1n  | awk '{if($1==$1+0 && $1>20)print $2}' | grep -v "\-aclm"  | grep [a-z] | while read sitespam ; do echo "SITESPAMIN QUEUE $sitespam" ; find /home/$sitespam/ | grep mailer  |grep php  | xargs -i frob disable {}  ; ips spamnuke "$sitespam"  ; done
#find  /home/*/public_html/ -maxdepth 1 -name post.php | quarantine

# clear spam if amount if ricipients total is more than 200 from user@hostname at the point of time of queue count check
echo -e  "If ricipients total is more than 200 from user@`hostname` \n"
eximanage --stats | egrep -v 'from-address|<>|root' | sed 's/,//' | grep `hostname` | sed 's/,//' | awk ' $2>200  {print $0}' |
while read psource adddrtotal bytes msgtotal msgid ; do
        echo "$msgid $(exim -Mvh "$msgid" | grep '"$msgid"\|auth_id')"  ;
done |
while read pmsid pauth pspammer ; do
        if echo "$pspammer" |grep "\@" ; then
                echo "spammer email address" 
                echo "$pspammer"
                frob spamming "$pspammer"
           else
                echo "pspammer is $pspammer"
                echo "$pspammer" | tee -a  /root/africlamusers.tmp
		eximanage --dfrom  ".*`hostname`"
                screen -ls
        fi
if ! grep "$(date +"%Y"-"%m-%d").*::spamnuke_rule2::"$pspammer"" /root/.spamnuke  ; then echo "$(date +"%Y"-"%m-%d-%R")::spamnuke_rule2::$pspammer" | tee -a /root/.spamnuke ; fi 
done

#  clear spam if amount if ricipients total is more than 200 from user@hostname and joomla reg or comment spam at the point of time of queue count check
echo -e  "If ricipients total is more than 200 from user@`hostname` \n"
eximanage --stats | egrep -v 'from-address|<>|root' | sed 's/,//'  | sed 's/,//' | awk ' $2>50  {print $0}' | 
 while read psource adddrtotal bytes msgtotal msgid ; do 
  if echo "$msgid $(exim -Mvh "$msgid" | egrep 'index.php/component/users/')" ; then 
   SPAMMINGUNAME=$(exim -Mvh "$msgid" | egrep '"$msgid"|auth_id' | awk '{print $2}') ; 
   if grep $SPAMMINGUNAME  /etc/trueuserdomains ; then 
    find /home/"$SPAMMINGUNAME"/public_html/ -name class.phpmailer.php -exec frob disable {} \;  ; 
    ips spamnuke $SPAMMINGUNAME  ; 
    tail -n1000  /usr/local/apache/domlogs/"$SPAMMINGUNAME"/*  | grep component/users |   
        egrep -vi 'google|facebook|twitter|bing|jetpack|vaultpress|yahoo' | 
        geoip | awk '{print $1,$2}' | egrep -v 'ZA|127.0.0|_|AU' | ipgrep |  
        xargs -i ipset add sysadmin_added_ips {}
   fi  ; 
  fi   ; 
if ! grep "$(date +"%Y"-"%m-%d").*::spamnuke_rule3::"$SPAMMINGUNAME"" /root/.spamnuke  ; then echo "$(date +"%Y"-"%m-%d-%R")::spamnuke_rule3::$SPAMMINGUNAME" | tee -a /root/.spamnuke ; fi 
done

##  clear spam if uniq ricipients is more than 20 and match mailicious_mail_patterns
#echo -e  "clear spam if uniq ricipients is more than 20 and match mailicious_mail_patterns \n"
#eximanage --stats | egrep -v 'from-address|<>|root' | sed 's/,//'  | sed 's/,//' | awk ' $2>40  {print $0}' |  while read psource adddrtotal bytes msgtotal msgid ; 
# do  exim -Mvb "$msgid" | mailicious_mail_patterns && echo spamming_string_found && frob spamming $psource   ; 
# if ! grep "$(date +"%Y"-"%m-%d").*::spamnuke_rule4::"$msgid"::"$psource"" /root/.spamnuke;
# then echo "$(date +"%Y"-"%m-%d-%R")::spamnuke_rule4::"$msgid"::"$psource"" | tee -a /root/.spamnuke ; 
# fi
#done

# clear spam if amount of recipients total is more than 2000 at the point of time of queue count check
echo -e  "If ricipients total is more than 2000\n"
eximanage --stats | egrep -v 'from-address|<>' | sed 's/,//' | awk ' $2>5000  {print $0}' |
while read psource adddrtotal bytes msgtotal msgid ; do
        echo "$msgid $(exim -Mvh "$msgid" | grep '"$msgid"\|auth_id')"  ;
done |
while read pmsid pauth pspammer ; do
 if echo "$pspammer" |grep "\@" ; then
      echo "spammer email address" 
      echo "$pspammer"
      frob spamming "$pspammer"
      eximanage --dfrom  ".*`hostname`"
       /usr/local/afribin/ips spamnuke $pspammer
  else
       echo "pspammer is $pspammer"
       echo "$pspammer" | tee -a  /root/africlamusers.tmp
      eximanage --dfrom  ".*`hostname`"
       screen -ls
 fi
if ! grep "$(date +"%Y"-"%m-%d").*::spamnuke_rule5::"$pspammer"" /root/.spamnuke  ; then echo "$(date +"%Y"-"%m-%d-%R")::spamnuke_rule5::$pspammer" | tee -a /root/.spamnuke ; fi 
done

# clear spam if amount of messages total is more than 2000 at the point of time of queue count check
echo -e  "If messgages more than 5000\n"
eximanage --stats | egrep -v 'from-address|<>' | sed 's/,//' | awk ' $4>5000  {print $0}' |
while read psource adddrtotal bytes msgtotal msgid ; do
        echo "$msgid $(exim -Mvh "$msgid" | grep '"$msgid"\|auth_id')"  ;
done |
while read pmsid pauth pspammer ; do
        if echo "$pspammer" |grep "\@" ; then
                echo "spammer email address "$pspammer"" 
                 echo "$pspammer"
                frob spamming "$pspammer"
		eximanage --dfrom  ".*`hostname`"
           else
                echo "pspammer is $pspammer"
                echo "$pspammer" | tee -a  /root/africlamusers.tmp
                screen -ls
		eximanage --dfrom  ".*`hostname`"
        fi
if ! grep "$(date +"%Y"-"%m-%d").*::spamnuke_rule6::"$pspammer"" /root/.spamnuke  ; then echo "$(date +"%Y"-"%m-%d-%R")::spamnuke_rule6::$pspammer" | tee -a /root/.spamnuke ; fi
done


# clear spam if amount if ricipients total is more than 200 from user@hostname at the point of time of queue count check
echo -e  "If ricipients total is more than 2000 user@`hostname` \n"
eximanage --stats | egrep -v 'from-address|<>|root' | sed 's/,//' | grep `hostname` | sed 's/,//' | awk ' $2>200  {print $0}' |
while read psource adddrtotal bytes msgtotal msgid ; do
        echo "$msgid $(exim -Mvh "$msgid" | grep '"$msgid"\|auth_id')" 
done |
while read pmsid pauth pspammer ; do
        if echo "$pspammer" |grep "\@" ; then
                echo "spammer email address "$pspammer"" 
                echo "$pspammer"
                eximanage --dfrom  ".*`hostname`"
                frob spamming "$pspammer"
           else
                echo "pspammer is $pspammer"
                echo "$pspammer" | tee -a  /root/africlamusers.tmp
                screen -ls
                eximanage --dfrom  ".*`hostname`"
        fi
if ! grep "$(date +"%Y"-"%m-%d").*::spamnuke_rule7::"$pspammer"" /root/.spamnuke  ; then echo "$(date +"%Y"-"%m-%d-%R")::spamnuke_rule7::$pspammer" | tee -a /root/.spamnuke ; fi
done

# an extra check from /root/.preports if we don't catch spammer anywhere above see if other spam finding scripts have established spammer today:
echo -e  "Check /root/.preports \n"
cat /root/.preports/exim/*.hsb* |awk ' $1>2000  {print $0}' | 
        while read ptotal pspammer ; do 
                if echo "$pspammer"|grep "\@" 
                        then echo "Spammer email account = "$pspammer"" 
                        frob spamming "$pspammer"  || egrep "$pspammer" /var/log/exim_mainlog | head -n2 | grep auth_id | awk -F "=" '{print $NF}' | xargs -i frob spamming {}
                   else 
                        echo "Spammer username : $pspammer"
                        echo "$pspammer" | tee -a  /root/africlamusers.tmp
                fi  
if ! grep "$(date +"%Y"-"%m-%d").*::spamnuke_rule8::"$pspammer"" /root/.spamnuke  ; then echo "$(date +"%Y"-"%m-%d-%R")::spamnuke_rule8::$pspammer" | tee -a /root/.spamnuke ; fi 
done 

# catch contact or site spaming domains and stop mail from going out.
tail -n1  /root/.preports/exim/`hostname`.hsbu.txt  | awk '$1 > 200' | awk '{print $2}' | grep -v @ | while read puname ; do if  grep $puname  /var/log/exim_mainlog | grep icwd | egrep -o "1.....-......-..|1.....-...........-...." | sort | uniq -c | awk '($1 > 500)' ; then if ! grep "$puname" /etc/exim_deny_spe_sender ; then echo "$puname@`hostname`" >> /etc/exim_deny_spe_sender ; echo "`date "+%Y-%m-%d-%T"` $puname - sitespamlock" >> /root/.cwdspamlock ; fi ; fi ; if ! grep "$(date +"%Y"-"%m-%d").*::spamnuke_rule9::"$pspammer"" /root/.spamnuke  ; then echo "$(date +"%Y"-"%m-%d-%R")::spamnuke_rule9::$pspammer" | tee -a /root/.spamnuke ; fi  ; done

# clear spam if there are more than 100 bounce backs for a particular user or email address
exim -bp | grep "<>" | egrep -o "1.....-......-..|1.....-...........-...." | grep ^1 | head -n100 | while read pbounces ; do   grep $pbounces  /var/log/exim_mainlog | grep "The account or domain may not exist" | emailgrep  ; done | sort | uniq -c | sort -k1n | awk '($1>10)' | emailgrep  |    while read spammer ; do     grep $spammer /var/log/exim_mainlog | grep -oP "A=dovecot_login:.*?S=" ; done | sort | uniq | emailgrep |      while read pspammer ; do         if echo "$pspammer" | grep -q `hostname`; then echo "echo \"$pspammer\"|sed 's/@`hostname`//'"|bash|tee -a /root/africlamusers.tmp ; else if echo "$pspammer" | grep -q "\@" ; then echo "frob spamming $pspammer" | bash ; fi ; fi ; if ! grep "$(date +"%Y"-"%m-%d").*::spamnuke_rule10_morethan200bounces::"$pspammer"" /root/.spamnuke  ; then echo "$(date +"%Y"-"%m-%d-%R")::spamnuke_rule10_morethan200bounces::$pspammer" | tee -a /root/.spamnuke ; fi ; done

# spamnuke and lock if mails to .aol|.ru|.fr|
exim -bp > /tmp/peximstats.tmp
peximstats="/tmp/peximstats.tmp"
chmod 600  $peximstats
if egrep -B1 '\.aol|\.fr|\.com.br|@.*\.ru' $peximstats | wc -l | awk '( $1 > 40 )' | grep -q [0-9]  ; then
 egrep -B1 '\.aol|\.fr|\.com.br|@.*\.ru' $peximstats | egrep -o "1.....-......-..|1.....-...........-...."  | 
 xargs -i grep {} /var/log/exim_mainlog | egrep "A=dovecot_plain|A=dovecot_login" | grep -oP 'A=dovecot_.*:.*?S=' | 
 sed -e 's/A=dovecot_\(.*\)S=.*/\1/' | awk -F ":" '{print $2}' 
fi | sort | uniq -c| awk  '( $1 > 20 )' | awk '{print $NF}' | grep @ | while read pspammer ; do 
 if echo "$pspammer" | grep -q "\@" ; 
  then echo "frob spamming $pspammer" | bash 
  ips spamnuke "$pspammer"
  if ! grep "$(date +"%Y"-"%m-%d").*::spamnuke_rule18_aol_fr_ru_br_spam::"$pspammer"" /root/.spamnuke  ; then 
   echo "$(date +"%Y"-"%m-%d-%R")::spamnuke_rule18_aol_fr_ru_br_spam::$pspammer" | tee -a /root/.spamnuke ; 
  fi 
 fi
done 




# sort uniq /root/africlamusers.tmp and run CS if file not empty
cat /root/africlamusers.tmp|sort|uniq|grep -v  "/" | tee /root/africlamusers
if [ -s /root/africlamusers ]
then
	echo "spam found but no culprits found" # tee somewhere todo
	eximanage --dfrom "<>"
	eximanage --dfrom ".*_.*"
else
	echo "spam found and culprits found" # tee somewhere todo
	screen -dmS cs africlam_scan -u
	eximanage --dfrom "<>"
	eximanage --dfrom ".*_.*"
	#/scripts/restartsrv_exim 
	#/scripts/restartsrv_dovecot
fi

#if for i in $( if [[ `exim -bpc` -gt 350 ]]; then eximanage --stats |  awk '($2 > 350)' | grep -v  "from-address" | awk '{print $1}' | awk  -F "@" '{print $2}' ; fi   ) ; do if  [ "$i" == `hostname` ] ; then echo $i ; fi ; done  ; then  eximanage --stats  | grep `hostname` |  awk '($2 > 350)' ||  awk '($4 > 350)' ; fi  | grep  "......-......-.." | awk '{print $1}' | awk -F "@"  '{print $1}' | while read hacked_user ; do grep  "$hacked_user" /etc/shadow ; echo "Locking password" ;  usermod -p '$1$Mw1ksjdhfkj87wfyige9w7g9m/3nqT/lgDm7/' "$hacked_user" ; grep  "$hacked_user" /etc/shadow  ;  eximanage --dfrom ".*"$hacked_user".*"  ; done
#
#eximanage --dfrom "<>"
#eximanage --dfrom ".*_.*"
#
#	eximanage --stats |grep -v from-address | egrep -v '<>|root@'  | while read pfrom paddr pbytes pmsgs ppid ; do NEWPADDR=$(echo  $paddr|sed 's/,//')  ; echo $NEWPADDR ; if [ $(echo "$NEWPADDR")  -gt 200 ] ; then ips eximstop ; echo "`date +"%b %d %T"` `hostname` [frob spamming $pfrom $paddr $pbytes $pmsgs $ppid::"| tee -a /var/log/messages ; frob spamming "$pfrom" ; /scripts/restartsrv_exim  ; fi ; done
#
#if [[ `exim -bpc` -gt 20 ]]; then
#	ips eximstop || /scripts/restartsrv_exim --stop
#	rm -fv  /tmp/{ptmp,spam_auth_total_check} ; eximanage --stats | awk '{print $1,$5}'  | while read pfrom pmid ; do echo "$pfrom $(exim -Mvh $pmid|egrep 'auth_id' )" ; done | awk '{print $1,$3}'|grep -v from-address | tee /tmp/.spam_auth_total_check ; for i in $(awk  '{print $2}' /tmp/.spam_auth_total_check | sort | uniq ) ; do echo "$i $(grep  $i /tmp/.spam_auth_total_check | wc -l)" |  awk ' $2>20  {print $0}' | awk '{print $1}' | tee -a ptmp  ; done ; cat ptmp| sort | uniq | while read HDOM ; do frob spamming $HDOM ; echo "for i in \`exim -bp | awk '{print \$3}'  | grep .|grep  "......-......-.."\` ; do echo \$i && exim -Mvh \$i | grep -E '\$i|$HDOM'; done  | grep -B1 $HDOM | grep  "......-......-.."  | xargs -i exim -Mrm  {}"  ; done| bash
#fi
#
##eximanage --stats |grep -v from-address | egrep -v '<>|root@'  | while read pfrom paddr pbytes pmsgs ppid ; do if [[ "$paddr" -gt 2000 || "$pmsgs" -gt  2000 ]]; then ips eximstop ; echo "`date +"%b %d %T"` `hostname` [frob spamming $pfrom $paddr $pbytes $pmsgs $ppid::"| tee -a /var/log/messages ; frob spamming "$pfrom" ; /scripts/restartsrv_exim  ; fi ; done  
date