From a17caa2b5c33b2e9b01186e4bf5921f14adf1a4e Mon Sep 17 00:00:00 2001
From: Art Cancro <ajc@citadel.org>
Date: Tue, 30 May 2023 12:33:34 -0400
Subject: [PATCH] Initial commit

---
 infanticide.pm | 76 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)
 create mode 100755 infanticide.pm

diff --git a/infanticide.pm b/infanticide.pm
new file mode 100755
index 0000000..caff4f8
--- /dev/null
+++ b/infanticide.pm
@@ -0,0 +1,76 @@
+#!/usr/bin/perl
+
+# This is a SpamAssassin module that kills mail from newly-born domains.
+
+
+package infanticide;
+use Mail::SpamAssassin::Plugin;
+use Sys::Syslog;
+use Sys::Syslog qw(:standard :macros);
+#use Time::Local;
+use HTTP::Date;
+
+our @ISA = qw(Mail::SpamAssassin::Plugin);
+my $counter = 100;
+sub new {
+	my ($class, $mailsa) = @_;
+
+	# the usual perlobj boilerplate to create a subclass object
+	$class = ref($class) || $class;
+	my $self = $class->SUPER::new($mailsa);
+	bless ($self, $class);
+ 
+	# syslog is fun
+	syslog('info', 'Initializing INFANTICIDE for SpamAssassin (c) 2022-2023 by Art Cancro');
+
+	# Register evaluation rules
+	$self->register_eval_rule ("check_for_disposable_domain");
+
+	# and return the new plugin object
+	return $self;
+}
+
+
+sub trim {
+	my $s = shift; $s =~ s/^\s+|\s+$//g; return $s
+}
+
+
+sub infanticide_get_creation_date {
+	my $domain_to_test = $_[0];
+	my $cDate = "";
+
+	open my $fh, "-|", "whois", $domain_to_test	or return("");
+	my @lines = <$fh>				or return("");
+	close $fh					or return("");
+	foreach(@lines) {
+		if (index($_, "Creation Date:") != -1) {
+			my @arr = split("Creation Date:", $_);
+			$cDate = trim($arr[1]);
+			# 2017-06-02T13:15:42Z
+		}
+	}
+	return($cDate);
+}
+
+
+sub check_for_disposable_domain() {
+	$counter = $counter + 1;
+
+	my ($self, $pms) = @_;
+	my $fromaddr = $pms->get("From:addr", undef);
+	my @fromarr = split('@', $fromaddr);
+	my $domain = $fromarr[1];
+	my $creationDate = infanticide_get_creation_date($domain);
+	if ($creationDate eq "") {
+		syslog('debug', "infanticide: " . $counter . " no creation date for " . $domain);
+		return(0);
+	}
+	my $dt = str2time($creationDate);
+	my $daysAgo = (time() - $dt) / 86400;
+	syslog("debug", "infanticide: " . $domain . " was created " . $daysAgo . " days ago");
+	if ($daysAgo < 30) {
+		return(1);
+	}
+	return(0);
+}
-- 
2.39.2