# SpamBouncer Whitelists # LOCALTAG=no # Amazon Orders :0 * FIRSTEXIP ?? ^(12\.18\.117\.10[4-9]|\ 12\.18\.117\.11[0-1]|\ 12\.30\.177\.15[2-9]|\ 12\.32\.32\.12[8-9]|\ 12\.32\.32\.13[0-9]|\ 12\.32\.32\.14[0-3]|\ 12\.33\.10\.12[8-9]|\ 12\.33\.10\.13[0-9]|\ 12\.33\.10\.14[0-3]|\ 12\.37\.81\.14[4-9]|\ 12\.37\.81\.15[0-9]|\ 12\.37\.84\.4[8-9]|\ 12\.37\.84\.5[0-9]|\ 12\.37\.84\.6[0-3]|\ 12\.40\.178\.22[4-9]|\ 12\.40\.178\.23[0-9]|\ 12\.43\.23\.6[4-9]|\ 12\.43\.23\.7[0-9]|\ 12\.104\.32\.8[0-7]|\ 12\.104\.66\.6[4-9]|\ 12\.104\.66\.7[0-9]|\ 12\.109\.105\.9[6-9]|\ 12\.109\.105\.10[0-9]|\ 12\.109\.105\.11[0-1]|\ 12\.111\.209\.19[2-9]|\ 12\.111\.209\.20[0-7]|\ 12\.146\.22\.12[8-9]|\ 12\.146\.22\.13[0-9]|\ 12\.146\.22\.14[0-3]|\ 12\.149\.186\.3[2-9]|\ 12\.149\.186\.4[0-7]|\ 12\.155\.161\.[0-7]|\ 12\.158\.48\.1[6-9]|\ 12\.158\.48\.2[0-9]|\ 12\.158\.48\.3[0-1]|\ 12\.158\.56\.14[4-9]|\ 12\.158\.56\.15[0-9]|\ 12\.163\.227\.9[6-9]|\ 12\.163\.227\.1[0-1][0-9]|\ 12\.163\.227\.12[0-7]|\ 12\.164\.136\.23[2-9]|\ 12\.164\.141\.16[0-9]|\ 12\.164\.141\.17[0-5]|\ 12\.169\.234\.11[2-9]|\ 12\.169\.234\.12[0-7]|\ 12\.178\.209\.[0-9]|\ 12\.178\.209\.1[0-5]|\ 12\.183\.78\.4[8-9]|\ 12\.183\.78\.5[0-9]|\ 12\.183\.78\.6[0-3]|\ 12\.183\.163\.3[2-9]|\ 12\.183\.163\.4[0-7]|\ 63\.79\.109\.9[6-9]|\ 63\.79\.109\.10[0-9]|\ 63\.79\.109\.11[0-1]|\ 63\.79\.232\.22[4-9]|\ 63\.79\.232\.23[0-9]|\ 63\.83\.9\.12[8-9]|\ 63\.83\.9\.1[3-5][0-9]|\ 63\.172\.60\.13[6-9]|\ 63\.172\.60\.14[0-3]|\ 63\.174\.37\.11[2-9]|\ 63\.175\.98\.24[0-9]|\ 63\.175\.98\.25[0-5]|\ 65\.199\.110\.24[0-9]|\ 65\.199\.110\.25[0-5]|\ 65\.201\.206\.[0-9]|\ 65\.201\.206\.[1-3][0-9]|\ 65\.201\.206\.4[0-7]|\ 65\.201\.233\.14[4-9]|\ 65\.201\.233\.15[0-9]|\ 65\.204\.202\.19[2-9]|\ 65\.204\.202\.20[0-7]|\ 65\.206\.219\.19[2-9]|\ 65\.206\.219\.20[0-7]|\ 65\.212\.6\.12[8-9]|\ 65\.212\.6\.13[0-9]|\ 65\.212\.6\.14[0-3]|\ 65\.222\.194\.17[6-9]|\ 65\.222\.194\.18[0-9]|\ 65\.222\.194\.19[0-1]|\ 206\.159\.98\.[0-9]|\ 206\.159\.98\.1[0-5]|\ 207\.171\.1[6-8][0-9]\.[0-9][0-9]?[0-9]?|\ 207\.171\.19[0-1]\.[0-9][0-9]?[0-9]?|\ 208\.192\.208\.[0-9][0-9]?[0-9]?|\ 208\.216\.180\.[0-9][0-9]?[0-9]?|\ 208\.226\.120\.[0-9][0-9]?[0-9]?)$ { :0 * ^From:.*(account-update|auto-confirm|payments-messages)@amazon\.(com|co\.uk)([^a-z0-9.]|\. |\.$|$) { LOCALTAG=yes } :0 * ^Bounces-to: RealTimeEmail\+[-_0-9a-z]+@bounces\.amazon\.com([^a-z0-9.]|\. |\.$|$) { LOCALTAG=yes } } # AuctionWorks transaction emails :0 * FIRSTEXIP ?? ^216\.154\.195\.72$ * FIRSTEXDOMAIN ?? ^auctionworks\.com$ * FIRSTEXHELODOMAIN ?? ^auctionworks\.com$ * ^Subject:.*[^0-9a-z]Item Shipped([^a-z0-9.]|$) { LOCALTAG=yes } # Barnes & Noble :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^208\.237\.178\.[0-9][0-9]?[0-9]?$ * ^From:.*(service)@barnesandnoble\.com([^a-z0-9.]|\. |\.$|$) { LOCALTAG=yes } # Dell Order info :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^143\.166\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?$ * ^(From|Sender): .*@([0-9a-z][-_0-9a-z]+\.)*dell\.com([^a-z0-9]|$) { LOCALTAG=yes } # eBay/Half.com/PayPal # :0 * LOCALTAG ?? no * FROMEMAIL ?? ^((aw-confirm|bidconfirm|endofauction|\ endofitem|endoftransaction|outbidnotice|\ savedsearches)@ebay\.(com|co\.de|co\.uk)|\ billpoint@billpoint\.com|\ service@paypal\.com)([^a-z0-9.]|\. |\.$|$) { LOCALIPREGEXP=${FIRSTEXIPREGEXP} LT2=no TESTCIDR=${SBDIR}/info/ebay-ips.cidr INCLUDERC=${SBDIR}/functions/check-cidr.rc :0 * LT2 ?? yes { LOCALTAG=yes } } # More eBay/Half.com/PayPal # :0 * LOCALTAG ?? no * FIRSTEXDOMAIN ?? ^(billpoint\.com|\ ebay\.(com|co\.de|co\.jp|co\.uk)|\ half\.com|\ paypal\.com)$ * ^X-eBay-EID:( ) * ^X-eBay-MailTracker:( ) { LOCALIPREGEXP=${FIRSTEXIPREGEXP} LT2=no TESTCIDR=${SBDIR}/info/ebay-ips.cidr INCLUDERC=${SBDIR}/functions/check-cidr.rc :0 * LT2 ?? yes { LOCALTAG=yes } } # Equifax # :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^216\.46\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?$ * ^From:.*member\.benefits@equifax\.com([^a-z0-9.]|\. |\.$|$) { LOCALTAG=yes } # Evite # # Although I've received e-vites from people and not been spammed, Evite # has language in its privacy policy that allows it to send "marketing # messages", not only to Evite members, but also to addresses that a member # sends evites to. :/ That is, of course, spam, and no amount of privacy # policy language makes it anything else. # # This recipe whitelists only invitations from Evite, not other email. # Evite might well end up blocked by the SpamBouncer in the future if # I receive credible reports that they are availing themselves of the # "permission" they claim to extract in their privacy policy. # :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^(209\.104\.3[2-9]\.[0-9][0-9]?[0-9]?|\ 209\.104\.[4-5][0-9]\.[0-9][0-9]?[0-9]?|\ 209\.104\.6[0-3]\.[0-9][0-9]?[0-9]?)$ * ^From:.*[^0-9a-z]info@evite\.com([^a-z0-9.]|$) { LOCALTAG=yes } # Federal Express # :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^137\.236\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?$ * FROMEMAIL ?? ^fedexpredelvry@mail\.xpedite\.com$ * ^X-xsi-job: [0-9]+$ * ^X-xsi-user-id: FEDEXPREDELVRY$ { LOCALTAG=yes } # F-Prot # :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^213\.220\.100\.[0-9][0-9]?[0-9]?$ * ^From: .*[0-9a-z][-_0-9a-z]+@f-prot\.com([^a-z0-9.]|\. |\.$|$) { LOCALTAG=yes } # FTC # :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^(164\.62\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?|\ 206\.16\.196\.19[2-9]|\ 206\.16\.196\.2[0-4][0-9]|\ 206\.16\.196\.25[0-5])$ * ^From:.*(donotcall|ftc|uce)\.gov([^a-z0-9.]|\. |\.$|$) { LOCALTAG=yes } # Holiday Inns, etc. (ichotelsgroup.com) # :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^165\.2\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?$ * FROMEMAIL ?? ^reservations@ichotelsgroup\.com$ { LOCALTAG=yes } # iTunes customer service email # :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^17\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?$ * ^From: iTunes Music Store([^0-9\.]|$) { LOCALTAG=yes } # Klingon Language Institute # :0 * FIRSTEXIP ?? ^64\.81\.214\.101$ * ^From:.*kli\.org([^a-z0-9.]|$) * ! ^Mailing-List: { LOCALTAG=yes } # LexMark Supplies orders # :0 * FIRSTEXIP ?? ^216\.39\.102\.[0-9][0-9]?[0-9]?$ * ^From:.*service@lexmarkstore\.com([^a-z0-9.]|$) { LOCALTAG=yes } # Network Solutions # # Network Solutions unfortunately does spam. :/ It has both # a history inherited from Verisign, although it appears to have # left much of that behind, and a recent decision to spam domain # registration contact addresses. It also sends a lot of # legitimate email to its customers, however, regarding their # domain registrations. This whitelists that email. # :0 * LOCALTAG ?? no * ^From:.*[^0-9a-z]custserv@netsol\.com([^a-z0-9.]|$) { LOCALIPREGEXP=${FIRSTEXIPREGEXP} LT2=no TESTCIDR=${SBDIR}/info/netsol-ips.cidr INCLUDERC=${SBDIR}/functions/check-cidr.rc :0 * LT2 ?? yes { LOCALTAG=yes } } # NJABL # :0 * FIRSTEXIP ?? ^209\.208\.0\.1[5-6]$ * ^From:.*njabl\.org([^a-z0-9.]|$) { LOCALTAG=yes } # PartSolver # :0 * FIRSTEXIP ?? ^199\.107\.236\.52$ * ^From:.*[^0-9a-z]orders@partsolver\.com([^a-z0-9.]|$) { LOCALTAG=yes } # Powell's Bookstore # :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^(204\.245\.236\.[0-9][0-9]?[0-9]?|\ 206\.163\.11\.[0-9][0-9]?[0-9]?)$ * ^From:.*powells\.com([^a-z0-9.]|\. |\.$|$) { LOCALTAG=yes } # SFF.net # :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^208\.14\.20[8-9]\.[0-9][0-9]?[0-9]?$ * ^From:.*(greyware\.com|sff\.net)([^a-z0-9.]|$) { LOCALTAG=yes } # SmarterMall.com # :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^(216\.39\.102\.232)$ * ^From:.*[^0-9a-z]service@thermos\.smartermall\.com([^a-z0-9.]|$) { LOCALTAG=yes } # Spamcop (owned by Ironport) # # Last Updated: 8/25/2005 # # This whitelists spamcop autoresponder replies so they # do not get inadvertently filtered and/or reported back # to spamcop as spam. # :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^(64\.74\.133\.2(2[4-9]|[3-4][0-9]|5[0-5])|\ 204\.15\.82\.[0-9][0-9]?[0-9]?|\ 216\.127\.43\.94)$ * ^(From|Return-Path): .*((bounces|spamcop|deputies)@(devnull\.)?\ spamcop\.net|\ spamcop\.julianhaight\.com)([^a-z0-9.]|$) { LOCALTAG=yes } # Southwest Airlines # :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^12\.5\.136\.[0-9][0-9]?[0-9]?$ * ^From:.*[^0-9a-z]southwest\.com([^a-z0-9.]|\. |\.$|$) { LOCALTAG=yes } # SpamGourmet Service # # Disposable email addresses, not-for-profit, exists because the admins # hate spam with a passion. Spam *can* be sent from here, but not much # of it and not more than once through a single account. This recipe # doesn't whitelist all email from SpamGourmet addresses, but only email # sent to or from a SpamGourmet address AND through the SpamGourmet mail # server(s). If you get any spam from there, complain to abuse@spamgourmet.com # and watch the admins turn the spammer's account into a glowing crater. ;> # :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^216\.218\.230\.146$ * (^From: |^Received: |^TO)[0-9a-z][-_0-9a-z.]+@(antichef\.(com|net)|\ dfgh\.net|\ neverbox\.com|\ recursor\.net|\ spamcannon\.net|\ spamgourmet\.(com|net|org)|\ xoxy\.net)([^a-z0-9.]|$) { LOCALTAG=yes } :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^216\.218\.159\.210$ * ^From:.*[^0-9a-z]info@spamgourmet\.com([^a-z0-9.]$) { LOCALTAG=yes } # SpamHaus # :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^67\.89\.105\.244$ * ^From:.*[^0-9a-z]spamhaus\.org([^a-z0-9.]|$) { LOCALTAG=yes } # UPS # :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^153\.2\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?$ * ^From:.*(auto-notify|pkginfo|QuantumViewNotify)@ups\.com([^a-z0-9.]|$) { LOCALTAG=yes } # Usenet moderation responses # :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^204\.74\.68\.[0-9][0-9]?[0-9]?$ * From:.*[^0-9a-z]nobody@blocklisting\.com([^a-z0-9.]|\. |\.$|$) { LOCALTAG=yes } # Vandyke Software # :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^216\.184\.8\.8$ * From:.*[^0-9a-z]orders@vandyke\.com([^a-z0-9.]|\. |\.$|$) { LOCALTAG=yes } # VeriSign # # Verisign definitely spams, and is one of the more abusive spammers out # there. It also has legitimate customers and sends legitimate email. # Where possible, I whitelist sources of known legitimate email within # Verisign. It will not always be possible, since VeriSign changes domain # names, moves servers around, and does not notify me (or other maintainers # of spam filters) when it does so. # :0 * LOCALTAG ?? no * ^From:.*[^0-9a-z]migration@verisign\.com([^a-z0-9.]|$) { LOCALIPREGEXP=${FIRSTEXIPREGEXP} LT2=no TESTCIDR=${SBDIR}/info/verisign-ips.cidr INCLUDERC=${SBDIR}/functions/check-cidr.rc :0 * LT2 ?? yes { LOCALTAG=yes } } # Verizon Wireless Online # :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^199\.74\.158\.[0-9][0-9]?[0-9]?$ * ^From:.*[^0-9a-z][0-9a-z][-_0-9a-z]+@(myvzw|vzwcorp|verizonwireless)\.com([^a-z0-9.]|\. |\.$|$) { LOCALTAG=yes } # White House # :0 * LOCALTAG ?? no * FIRSTEXIP ?? ^198\.137\.24[0-1]\.[0-9][0-9]?[0-9]?$ * ^From:.*(eop|whitehouse)\.gov([^a-z0-9.]|\. |\.$|$) { LOCALTAG=yes } :0 * LOCALTAG ?? yes { SBLOG="A1R-SpamBouncer Whitelist" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 { WHITELIST=yes } }