Changeset 12 for trunk

Timestamp:

01/12/10 11:20:24 (15 years ago)

Author:

Kris Deugau

Message:

/trunk/dnsbl

Update extract-data with changes from live version

File:

• trunk/dnsbl/extract-data (modified) (6 diffs)

trunk/dnsbl/extract-data

@@ -179 +179 @@
     my ($tmprelayip) = ($recv =~ /from source \(\[([\d.]+)\]\) (?:\(using TLSv1\) )?by (?:exprod\dm[xo]b?|chipmx)\d+\.postini\.com/);
     $relayip = new NetAddr::IP $tmprelayip;
+
+  } elsif ($recv =~ /\[137\.82\.45\.(?:[0-9]|1[0-5])\]\) by mx\d\.company\.com/) {
+# Customer with (spam)forwarding from UBC - enough to justify this code
+  #IP-Network                    137.82.0.0/16
+  #IP-Network-Block              137.082.000.000 - 137.082.255.255
+  #Org-Name                      University of British Columbia
+  # only 137.82.45.0/28 or so seem to be outbound relays (duh)
+    $recv = $recv = $headerlist{'Received'}[++$recvnum];
+#Received: from bcnbib.gov.ar (200-42-22-14.dup.prima.net.ar [200.42.22.14])
+#  by mr4.mail-relay.ubc.ca (Postfix)
+    my ($tmprelayip) = ($recv =~ /from \[?[a-zA-Z0-9._-]+\]? \([a-zA-Z0-9._-]+ \[([\d+.]+)\]\) by mr\d\.mail-relay\.ubc\.ca \(Postfix\)/);
+    $relayip = new NetAddr::IP $tmprelayip;
+
   } else {
     my ($tmprelayip) = ($recv =~ /\[([\d+.]+)\]\) by mx\d\.company\.com/);
@@ -184 +197 @@
   }
 
+print "eep, no ip from manual extraction\n$recv\n" if !$relayip;
 print "SA vs manual extraction, relay IP mismatch: $sa_intip vs $relayip on\n\t$recv\n" if $sa_intip != $relayip;
 
@@ -201 +215 @@
   #Received: from omr-m33.mx.aol.com (omr-m33.mx.aol.com [64.12.143.145]) by
   # mx1.company.com (Postfix) with ESMTP id 7B9431C3255 for <webmaster@tyenet.com>;
-  next if $recv =~ /from (?:omr|imo)-[dm]\d+\.mx\.aol\.com \((?:omr|imo)-[dm]\d+\.mx\.aol\.com \[[\d.]+\]\) by mx\d\.company\.com/;
+  next if $recv =~ /from (?:omr|im[or])-[dm][ab]?\d+\.mx\.aol\.com \((?:omr|im[or])-[dm][ba]?\d+\.mx\.aol\.com \[[\d.]+\]\) by mx\d\.company\.com/;
 
 # Google may relay spam, GMail may originate it, but we can't blacklist them.
@@ -260 +274 @@
   my $yahoo14 = new NetAddr::IP "212.82.104.0/21";
   next if $relayip->within($yahoo14);
+ #IP-Network                    66.163.160.0/19
+  my $yahoo15 = new NetAddr::IP "66.163.160.0/19";
+  next if $relayip->within($yahoo15);
 
 # and the same goes for Bell Canada.  *le sigh*
@@ -272 +289 @@
   my $bell1 = new NetAddr::IP "209.226.175.0/24";
   next if $relayip->within($bell1);
-#  next if $recv =~ /\[209\.226\.175\.\d+\] by mx\d\.company\.com/;
+  #IP-Network                    207.236.0.0/16
+  # only listing a subsection - rDNS hosts look like Bell SMTP hardware
+  my $bell2 = new NetAddr::IP "207.236.237.0/26";
+  next if $relayip->within($bell2);
 
 # ... and your little dog too!
@@ -288 +308 @@
   my $apple1 = new NetAddr::IP "17.148.16.64/26";
   next if $relayip->within($apple1);
+
+# and Vodafone...
+# 212.183.156.227  (.227 through .230 have server rdns)
+#route:        212.183.128.0/19
+#descr:        Vodafone UK
+#inetnum:        212.183.156.0 - 212.183.156.255
+#descr:          Vodafone Limited
+  my $voda1 = new NetAddr::IP "212.183.156.224/29";
+  next if $relayip->within($voda1);
+
+# ooohhh, Eastlink wants to join the party
+#24.222.0.30
+#IP-Network                    24.222.0.0/16
+#IP-Network-Block              024.222.000.000 - 024.222.255.255
+#Org-Name                      Bragg Communications Incorporated
+  my $eastlink1 = new NetAddr::IP "24.222.0.30";
+  next if $relayip->within($eastlink1);
+
+# and now Cogeco
+#216.221.81.192
+#IP-Network                    216.221.64.0/19
+#IP-Network-Block              216.221.064.000 - 216.221.095.255
+#Org-Name                      Cogeco Telecom
+# only ignoring systems-looking IPs or blocks with mostly systems-looking IPs
+  my $cogeco1 = new NetAddr::IP "216.221.81.192";
+  next if $relayip->within($cogeco1);
+  my $cogeco2 = new NetAddr::IP "216.221.81.96/30";
+  next if $relayip->within($cogeco2);
+
+# and UAlberta
+#129.128.5.19
+#IP-Network                    129.128.0.0/16
+#IP-Network-Block              129.128.000.000 - 129.128.255.255
+#Org-Name                      University of Alberta
+  my $ualberta1 = new NetAddr::IP "129.128.5.19";
+  next if $relayip->within($ualberta1);
 
   $iplist{$relayip->addr}++ if $relayip;