use Mail::Address (); sub register { my ($self, $qp) = @_; $self->register_hook("data_post", "check_sober"); } sub check_sober { my ($self, $transaction) = @_; my @from = Mail::Address->parse($transaction->header->get('From')); return (DECLINED) if @from == 0; my @msgid = Mail::Address->parse($transaction->header->get('Message-ID')); return (DECLINED) if @msgid == 0; my $fhost = $from[0]->host; if ($msgid[0]->address =~ /^.*?[a-f].*\..*?[a-f].*?\.qmail\@$fhost$/) { $self->log(1,"sober_filter: Denied I-Worm.Sober.* mail with Subject: '" .$transaction->header->get('Subject')."'"); return (DENY, "Sober Virus Detected") } return (DECLINED); }