#!/bin/sh
#
# Finds the most active spammers from qsheff.log
# and adds them to qmail badmailfrom.
#
# Created by Baris Simsek
#
# http://www.enderunix.org/qsheff
#
# Note: After this script check your badmailfrom.
# Your local IPs may be added.
# Also check for 127.0.0.1, if added remove it
#
THRESHOLD=8
LOGFILE=/var/log/qsheff.log
BADFILE=/var/qmail/control/badmailfrom
cat $LOGFILE | grep SPAM | cut -d',' -f3 | cut -c11- > /tmp/ips.txt
cat $LOGFILE | grep ATTACH | cut -d',' -f3 | cut -c11- >> /tmp/ips.txt
cat /tmp/ips.txt | sort -u > /tmp/unique_ips.txt
cat /tmp/unique_ips.txt |
while read line; do 
  count=$(grep $line /tmp/ips.txt | wc -l);
  if [ $count -gt $THRESHOLD ]; then echo $line; fi
done >> $BADFILE
rm -f /tmp/ips.txt
rm -f /tmp/unique_ips.txt