Dev::Blog

I’ve been getting swamped with spam lately on the order of 300 messages a day, and I’ve nobody to blame but myself. See, I’ve had some of my domains for more than 5 years now, and back then, having a “catch-all” email setup was pretty cool - I didn’t have to worry about giving my friends an exact email address, and I could make “one-off” addresses easily for form signups that I wanted to track to see where future spam came from. Anything addressed to an arbitrary account @ thrustlabs.com would get
to me.

Of course, spammers win big in this scenario, and I’m getting hit with 7 or 8 emails at a time with the same subject addressed to various made-up accounts like “accounting@thrustlabs.com” and whatnot.

The solution’s obvious - shut off the catch-all, right? Unfortunately, I didn’t exactly keep track of the addresses I’ve given out over the years, so turning off catch-all could block something that’s actually important. Urgh.

Fortunately, I know just enough Ruby and just enough about Thunderbird’s mbox format to write something that’ll extract my email addresses from email stored in folders:

emails = {}
Dir['c:/documents and settings/your account/application data/thunderbird/profiles/**/*'].each { |file|
  if FileTest.size?(file) then
    mbox = File.new(file, "r")
    while(line = mbox.gets)
      emails[line.scan(/[A-Za-z0-9._]+@thrustlabs.com/)[0]] = 1
    end
    mbox.close
  end
}
emails.each_key {|email| puts email }

It might not be pretty, but it works for me (as always,it might destroy your computer, handle with caution, etc., etc.)

I took the output, edited out the spam-generated accounts, and set up explicit forwarding accounts for each of the addresses that were left, disabling catch-all at the same time. Once that takes effect (it’s a shared server, so there’s a lag), I can go through the rest of my spam and identify other troublesome addresses for other domains (I just did the two oldest, and thus biggest problem, domains to start). You know, assuming I didn’t do something stupid like block all my mail. Come to think
of it, that would be rather peaceful…

Technorati Tags: Spam, Ruby, Thunderbird