Initial commit

diff --git a/infanticide.pm b/infanticide.pm
new file mode 100755 (executable)
index 0000000..caff4f8
--- /dev/null
+++ b/infanticide.pm
@@ -0,0 +1,76 @@
+#!/usr/bin/perl
+
+# This is a SpamAssassin module that kills mail from newly-born domains.
+
+
+package infanticide;
+use Mail::SpamAssassin::Plugin;
+use Sys::Syslog;
+use Sys::Syslog qw(:standard :macros);
+#use Time::Local;
+use HTTP::Date;
+
+our @ISA = qw(Mail::SpamAssassin::Plugin);
+my $counter = 100;
+sub new {
+       my ($class, $mailsa) = @_;
+
+       # the usual perlobj boilerplate to create a subclass object
+       $class = ref($class) || $class;
+       my $self = $class->SUPER::new($mailsa);
+       bless ($self, $class);
+ 
+       # syslog is fun
+       syslog('info', 'Initializing INFANTICIDE for SpamAssassin (c) 2022-2023 by Art Cancro');
+
+       # Register evaluation rules
+       $self->register_eval_rule ("check_for_disposable_domain");
+
+       # and return the new plugin object
+       return $self;
+}
+
+
+sub trim {
+       my $s = shift; $s =~ s/^\s+|\s+$//g; return $s
+}
+
+
+sub infanticide_get_creation_date {
+       my $domain_to_test = $_[0];
+       my $cDate = "";
+
+       open my $fh, "-|", "whois", $domain_to_test     or return("");
+       my @lines = <$fh>                               or return("");
+       close $fh                                       or return("");
+       foreach(@lines) {
+               if (index($_, "Creation Date:") != -1) {
+                       my @arr = split("Creation Date:", $_);
+                       $cDate = trim($arr[1]);
+                       # 2017-06-02T13:15:42Z
+               }
+       }
+       return($cDate);
+}
+
+
+sub check_for_disposable_domain() {
+       $counter = $counter + 1;
+
+       my ($self, $pms) = @_;
+       my $fromaddr = $pms->get("From:addr", undef);
+       my @fromarr = split('@', $fromaddr);
+       my $domain = $fromarr[1];
+       my $creationDate = infanticide_get_creation_date($domain);
+       if ($creationDate eq "") {
+               syslog('debug', "infanticide: " . $counter . " no creation date for " . $domain);
+               return(0);
+       }
+       my $dt = str2time($creationDate);
+       my $daysAgo = (time() - $dt) / 86400;
+       syslog("debug", "infanticide: " . $domain . " was created " . $daysAgo . " days ago");
+       if ($daysAgo < 30) {
+               return(1);
+       }
+       return(0);
+}