Why IP Blacklisted
AHBL
The AHBL (Abusive Hosts Blocking List) is exclusively related to Email hosts that are having problems in their hosted network environment. Either they have had accounts that have been hijacked and used to send spam, or they have customers that are sending spam (unsolicited bulk mail) and as a result, large portions of their netblocks have been blacklisted.
ASPEWS
ASPEWS is a list of areas on the Internet which several system administrators, ISP postmasters, and other service providers have assembled and use to deny email and in some cases, all network traffic from.
BACKSCATTERER
Listing on Backscatterer blacklist indicates that your server is issuing “back scatter” in the form of Non-Delivery Reports (bounces) to external users, or misdirected autoresponders and sender callouts. Much of this is a function of how your server configuration is set to handle emails directed to users that do not exist on the server, and can cause many problems especially if you are hit with a directory-harvesting attack. Simply requesting delisting and paying their fee will do nothing to help you correct the problem and will give you no guarantee that you won’t get blacklisted again.
BARRACUDA
Listing in the Barracuda Blacklist could indicate any number of issues that need to be addressed in your network including but not limited to: virus-generated spam, poor server configuration, dynamic IP Addresses previously used by spammers, bulk mail sending that does not comply with the CAN-SPAM Act.
BBFHL1
Hosts and networks listed in the level1.txt file have delivered at least 500 spams to our spam-traps in the last 24 hours.
BBFHL2
Hosts and networks listed in the level2.txt file have delivered at least 500 spams to our spamtraps in at least one twenty four hour period in the last 7 days.
BLOCKLIST.DE
www.blocklist.de is a free and voluntary service provided by a Fraud/Abuse-specialist, whose servers are often attacked on SSH-, Mail-Login-, FTP-, Webserver- and other services.
BSB
The BSB is a database of IP addresses that have sent “comment spam”.
BURNT TECH
Burnt-Tech’s Block List takes it’s source data from numerous spamtraps. Spam trap address are virus scanned in an attempt to avoid listing infected machines. The Block List runs entirely automated and designed to avoid listings of spamtrap hits due to bounces of forged spam, virus bounces, and “real” mail servers emitting the occasional spam. It tries very hard to avoid listing legitimate mail sources. It does not attempt to list every possible spam source.
CASA CBL
China Anti-Spam Alliance begin publish blacklist service from 2003 year. Include CBL, CDL, CBL+ and CBL-.
CASA CBLPLUS
China Anti-Spam Alliance begin publish blacklist service from 2003 year. Include CBL CDL CBL+ and CBL-.
CASA CDL
China Anti-Spam Alliance began publishing blacklist services in 2003: Including the CBL, CDL, CBL+ and CBL-. The CDL is a list of Dynamic IP Address ranges in China.
CBL
The CBL is a very strong indication that you have contracted a Virus or Botnet, typically via a Malware infected webpage. If you continually request delisting without further researching the cause, you do run the risk of potentially being permanently blacklisted.
CHOON
CHOON runs their own RBL for their customers.
CYMRU BOGONS
A bogon prefix is a route that should never appear in the Internet routing table. A packet routed over the public Internet (not including over VPNs or other tunnels) should never have a source address in a bogon range. These are commonly found as the source addresses of DDoS attacks. Bogons are defined as Martians (private and reserved addresses defined by RFC 1918, RFC 5735, and RFC 6598) and netblocks that have not been allocated to a regional internet registry (RIR) by the Internet Assigned Numbers Authority. Bogon lists need to be updated frequently as the Internet Assigned Numbers Authority hands out new blocks of IP addresses for assignment several times each year.
DAN TOR
This DNS blacklist contains ALL tor nodes (both entry and exit nodes) – The tor node list is updated every hour automatically from the live tor network. There is no complaint procedure to have an IP address removed from this list as it will be automatically removed once the tor node ceases to run (with a maximum of 1 hour delay).
DAN TOREXIT
This DNS blacklist contains only tor EXIT nodes. The tor node list is updated every hour automatically from the live tor network. There is no complaint procedure to have an IP address removed from this list as it will be automatically removed once the tor node ceases to run (with a maximum of 1 hour delay).
DNS SERVICIOS
Your email has been rejected because your server IP is listed as “spammer” in the DNS-SERVICIOS RBL Database. IP Addresses are added if the DNS-SERVICIOS spam trap receives more than 5 spam messages in a 6 hour period.
DRMX
The DrMX Project is a nonprofit organization whose mission is to track the Internet’s spam operations, to provide dependable realtime anti-spam protection for Internet networks, to work with Law Enforcement Agencies to identify and pursue spammers worldwide, and to lobby governments for effective anti-spam legislation.
DULRU
Dial-up User List is a database for the dial-up users IP addresses. Addresses are provided by ISPs. The purpose of maintaining such a database is to provide technical possibility to recognize e-mail sent directly by dial-up users (thus by-passing ISPs mail server).
EFnet RBL
The EFnet IRC Network RBL is comprised of a collection of data from several sources with the purpose of providing a “one stop shop” for IRC admins to block a multitude of undesirable clients.
FABELSOURCES
Someone or something on your network sent spam to the spamsources.fabel.dk nds blacklist. Some networks (in particular in South America and Asia) don’t maintain good records in whois, so a very large netblock including your IP might have been included in this list.
HIL
Habeas Infringer List: Lists IPs of mailservers that infringe on Habeas’ intellectual property, and are unwilling or unable to rectify the situation in a timely matter. “Habeas, founded in 2002, currently provides email reputation intelligence to a million email networks, including hundreds of ISPs, in 190 countries. This global network enables optimum delivery of Habeas-certified email to businesses, organizations, and individuals worldwide.”
HIL2
Habeas Infringer List: Lists IPs of mailservers that infringe on Habeas’ intellectual property, and are unwilling or unable to rectify the situation in a timely matter. “Habeas, founded in 2002, currently provides email reputation intelligence to a million email networks, including hundreds of ISPs, in 190 countries. This global network enables optimum delivery of Habeas-certified email to businesses, organizations, and individuals worldwide.”
ICMFORBIDDEN
Your e-mail has been bounced because the server which tried to deliver it to us is an open relay, i.e. it may have too old or misconfigured software. Please contact your administrator.
IMP SPAM
Listing in the ImproWare (IMP-SPAM or IMP-WORM) blacklist is a result of your IP Address being identified as actually sending Spam. Note, this could be in the form a large bulk-mailer sent that does not follow the “Can Spam” Act, someone using your server to relay spam, or another server configuration problem. Please note that if you are listed on IMP-WORM as well, this is most likely the result of a Worm or Trojan Virus (Malware) that is generating spam from your server, or a machine behind the server IP Address.
IMP WORM
Listing in the ImproWare (IMP-SPAM or IMP-WORM) blacklist is a result of your IP Address being identified as actually sending Spam. Note, this could be in the form a large bulk-mailer sent that does not follow the “Canned Spam” Act, someone using your server to relay spam, or another server configuration problem. Please note that if you are listed on IMP-WORM as well, this is most likely the result of a Worm or Trojan Virus (Malware) that is generating spam from your server, or a machine behind the server IP Address.
INPS_DE
If you are on the inps.de Blacklist, there could be any number of issues that need to be addressed in your network: virus-generated spam, dynamic IP Addresses previously used by spammers or bulk mail sending that does not comply with the CAN-SPAM Act.
INTERSERVER
The InterServer DNS-based Blackhole List is a spam trap DNSBL. This list does not take spam reports from third-parties. All blocking is done based on email received to our multiple spam trap email addresses throughout our network.
ivmSIP
Listing in the ivmSIP/24 blacklists indicates that your IP Address has been identified as a spam-sending server. Whether or not you operate an email-server on this IP Address, it has either sent spam or has been previously identified as such.
ivmSIP24
Listing in the ivmSIP/24 blacklists indicates that your IP Address has been identified as a spam-sending server, or is in a range of IP Addresses of a host-provider that includes spending-sending servers; hence the “/24” block reference. Whether or not you operate an email-server on this IP Address, it has either sent spam or has been previously identified as such.
JIPPG
JIPPG’s Relay Blackhole List Project.
KEMPTBL
The Kempt.net black list is used to catch and react to new hosts used for spamming purposes as quickly as possible. Via an automated process, hosts are listed within minutes of the first time they are caught sending or relaying spam and they are removed from the list a day later.
LASHBACK
The Lashback Unsubscribe Blacklist (UBL) typically suggests that your network was subjected to a possible directory harvesting attack where someone either used the server or email accounts on the server to send “Unsubscribe” probe traffic or phishing emails.
LNSGBLOCK
SpamBlock Sites: Sites on this listing have sent direct SPAM, but when looking up the rDNS information on the spam’s IP, we realize it’s an entire Class-C that has NO DNS mappings as well. So as it’s a range with identified SPAM, and no way to isolate the range, we block the entire block — If you tried to send email and it was REJECTED with an error message that pointed to this page, then the IP address of your outgoing mail server is on our local blacklist. To see if your on the SpamGuard list (or many of the other lists), go to this URL http://relays.osirusoft.com/cgi-bin/rbcheck.cgi and enter your IP Address/Domain. If you run a mail server, and need help in securing it, then please go see http://mail-abuse.org/tsi/ar-fix.html for more details.
LNSGBULK
Bulk mailers that don’t require confirmed opt-in from their customers, or that have allowed known spammers to become clients and abuse their services — If you tried to send email and it was REJECTED with an error message that pointed to this page, then the IP address of your outgoing mail server is on our local blacklist. To see if your on the SpamGuard list (or many of the other lists), go to this URL http://relays.osirusoft.com/cgi-bin/rbcheck.cgi and enter your IP Address/Domain. If you run a mail server, and need help in securing it, then please go see http://mail-abuse.org/tsi/ar-fix.html for more details.
LNSGMULTI
Multi-Stage Open Relays. chains that have sent spam to us, and are not listed on of the other active RBL’s — If you tried to send email and it was REJECTED with an error message that pointed to this page, then the IP address of your outgoing mail server is on our local blacklist. To see if your on the SpamGuard list (or many of the other lists), go to this URL http://relays.osirusoft.com/cgi-bin/rbcheck.cgi and enter your IP Address/Domain. If you run a mail server, and need help in securing it, then please go see http://mail-abuse.org/tsi/ar-fix.html for more details.
LNSGOR
Single-Stage Open Relays that are not listed on one of the other active RBL’s — If you tried to send email and it was REJECTED with an error message that pointed to this page, then the IP address of your outgoing mail server is on our local blacklist. To see if your on the SpamGuard list (or many of the other lists), go to this URL http://relays.osirusoft.com/cgi-bin/rbcheck.cgi and enter your IP Address/Domain. If you run a mail server, and need help in securing it, then please go see http://mail-abuse.org/tsi/ar-fix.html for more details.
LNSGSRC
Individual SPAM Sources. The addresses in here are from E-Mail received that was SPAM in the spamtrap. If you have inherited such IP address space, please contact LNSG and they will remove you, but should they get additional SPAM from your IP, it will be re-listed immediately — If you tried to send email and it was REJECTED with an error message that pointed to this page, then the IP address of your outgoing mail server is on our local blacklist. To see if your on the SpamGuard list (or many of the other lists), go to this URL http://relays.osirusoft.com/cgi-bin/rbcheck.cgi and enter your IP Address/Domain. If you run a mail server, and need help in securing it, then please go see http://mail-abuse.org/tsi/ar-fix.html for more details.
MADAVI
This DNS blacklist is used to reduce comment spam and form.
MAILSPIKE BL
Inclusion in either of the MAILSPIKE Blacklists (BL or Z) means that your IP Address has most likely been identified as being part of a real-time spam outbreak. More specifically, Mailspike lists IPs that are part of a distributed spam wave and does not take into consideration over-time IP behavior. It is also worth noting that this RBL is a zero-hour list, meaning that you can be listed and then unlisted very quickly. Please remember that normal propagation will occur and while your IP address may be unlisted on the Mailspike site, other services which query their database could still show you as listed until the listing expires.
MSRBL Combined
Any of the following types of spam traffic have hit the MSRBL Spamtraps: Viruses / Images / UBE (Unsolicited Bulk Email.)
MSRBL Images
Image Spam Traffic has hit the MSRBL Spamtraps.
MSRBL Spam
UBE (Unsolicited Bulk Email) has hit the MSRBL Spamtraps.
MSRBL Viruses
Virus-related Traffic has hit the MSRBL Spamtraps.
NETHERRELAYS
Nether.net Open-Relay Blacklist: Any host that sends e-mail to an invalid username @ puck.nether.net or @nether.net is tested to insure that it is not an open-relay. due to the proliferation of spam due to open-relays we have found this to be a necessity.
NETHERUNSURE
Nether.net Open-Relay Blacklist: Any host that sends e-mail to an invalid username @ puck.nether.net or @nether.net is tested to insure that it is not an open-relay. due to the proliferation of spam due to open-relays we have found this to be a necessity. We perform the same tests that are performed if you were to telnet to mail-abuse.org from your mail server. You can check those tests by doing so. It does a reverse-connect to your ip and tests it for a various set of ways that one can send e-mail that would turn out to pass through anti-relaying features.
NIXSPAM
An up-to-date collection of spam emitting IP addresses: The iX blacklist is made of over 500,000 automatically generated entries per day without distinguishing open proxies from relays, dialup gateways, and so on. After 12 hours the IP address will be removed if there is no new spam from there. Follow the removal instructions on www.dnsbl.manitu.net if you need to speed up the delisting process.
NOMOREFUNN
Listing in NOMOREFUNN can result from a variety of problems; actual spam sending from your IP Address, listing in a dynamic range of IP Addresses (generic reverse-dns), open-relays or other server configuration problems. Please note that you may also simply have inherited this listing from the prior owner of the IP Address if you are cable-modem or DSL-user and do not operate an email-server, in which case there may be little or nothing you can do to resolve the issue. *NOTE: The NOMOREFUNN Blacklist Site will be operational in the near future. We have confirmed that they are currently working to update their Website and Database.
NoSolicitado
Spanish language RBL that is attempting to catch unsolicited mail that might be missed by other English based lists.
ORVEDB
Open-Relays Verifying Engine Database List (ORVEDB) – This list contains the IP numbers of hosts that the Open-Relays Verifying Engine (ORVE) verified that are Open-Relays machines (Junkmailers). A host listed here, unlike the RSBL list, isn’t necessarily a spammer host because hosts running an open-relay usually do it accidentally, for inexperience of its administrator(s). ORVEDB is part of ANTISPAM-UFRJ, the official antispam website of the Laboratory for the Processing of Analog and Digital Signals (PADS/COPPE/UFRJ). The ANTISPAM-UFRJ is a realtime database with the mission to supply the Mail Transport Agents (MTA) of the hosts in the PADS and in others networks with the most recent information about open-relay hosts, spammers hosts or dialup machines on the Internet.
OSPAM
Inclusion in the OSPAM Blacklist indicates that your computer/server or a previous user of this IP sent spam to a trap; Or computers and/or servers within your Class C IP network are sending large amounts of spam to the OSPAM Spamtraps.
PSBL
Inclusion in the PSBL indicates the following: If you are running your own mail-server, that server/IP address was used to send spam, either via an open-relay or someone hijacking an account on the server to send spam. In this respect, if the issue is corrected your IP address will most likely eventually time out and be removed from the list unless you go manually request delisting. There is also the possibility that you were hit with a trojan or “zombie” caused by malware, which if not quickly resolved could result in long-term listing in the PSBL.
RATS Dyna
RATS-Dyna – Probable PC or home connection infected with a Trojan, Bot, or Emailer Program — If you are listed in the Spamrats / RATS-Dyna blacklist and you operate your own mail-server, you likely have no valid PTR-Record. If you are simply a home email user, you have a dynamic IP Address and may need to contact your ISP for assistance. If you operate a domain name and are using your ISP for SMTP-Authentication, try contacting your DNS Provider to use their SMTP-Services instead.
RATS NoPtr
RATS-NoPtr – An IP Address which has no reverse DNS, and probably the home of a SpamBot — If you are listed in the Spamrats / RATS-NoPtr blacklist and you operate your own mail-server, you have no “Reverse-DNS Entry” in place with your ISP to resolve that IP Address to your server’s host-name.
RATS Spam
RATS-Spam – An IP Address that has been shown to be abusive (Use at your own risk) — If you are listed in the Spamrats / RATS-Spam blacklist and you operate your own mail-server, actual spam resulting from an Open-relay, virus-traffic or UBE (Unsolicited Bulk Email) has issued from your server and hit the Spamrats spam traps.
RBL JP
Site is: http://www.rbl.jp — RBL.JP stands for Realtime Blackhole List Japan and is the domain name the server designated for this service. RBL.JP is a system that allows anyone, free of charge, to search for the addresses of servers known to send spam. Most Spam is usually sent by third parties from servers from which they are able to access.
RSBL
Realtime Spammers BlackList (RSBL) – This blacklist is currently in “frozen” status for an unspecified time period, however the database still returns results. RSBL is part of ANTISPAM-UFRJ, the official antispam website of the Laboratory for the Processing of Analog and Digital Signals (PADS/COPPE/UFRJ). The ANTISPAM-UFRJ is a realtime database with the mission to supply the Mail Transport Agents (MTA) of the hosts in the PADS and in others networks with the most recent information about open-relay hosts, spammers hosts or dialup machines on the Internet.
SCHULTE
This blacklist generally adds /24 or /16 catch all entries when repeated spam comes from a /24 or /16 and they don’t foresee any legitimate email coming from these hosts.
SEM BACKSCATTER
If you are on the Spam Eating Monkey Blacklist, there could be any number of issues that need to be addressed in your network: virus-generated spam, dynamic IP Addresses previously used by spammers or bulk mail sending that does not comply with the CAN-SPAM Act.
SENDERBASE
SenderBase (Cisco IronPort SenderBase Security Network) is the world’s largest email and Web traffic monitoring network. First introduced in February 2003 IronPort’s SenderBase Network collects nowadays data on more than 25 percent of the world’s email traffic and provides an unprecedented real-time view into security threats from around the world. SenderBase can be used like a “credit reporting service” for email, providing comprehensive data that ISPs and companies can use to differentiate legitimate senders from spammers and other attackers and giving email administrators visibility into who is sending them email.
SERVICESNET
I.E.C.C.: E-mail from South Korean Networks: We have blocked mail from most South Korean networks. You cannot simply request delisting – this list does not block individual computers or mail-servers, rather it blocks entire networks.
SOLID
You are on the SOLID Blacklist if and only if: You actually sent offensive spam, a large of volume of spam, sent spam or forged messages (open-relay traffic) — even if you engage in one of the aforementioned spamming behaviors, you still will not get on the SOLID list unless you send email to a non-existent user and then the server referenced in your return address refuses to accept the error message your spam created. As long as you are not operating as an open-relay, simply submit their request form and you will likely be removed within a few hours.
SORBS BLOCK
Specific SORBS BLOCK Details:
This SORBS Zone lists IP Addresses and networks which have requested to be omitted from the SORBS scanning and processing. SORBS makes this zone available so that administrators that wish to use SORBS can identify mail from these IPs as having not been included in other zones.
SORBS General Info:
The SORBS (Spam and Open Relay Blocking System), owned and operated by Proofpoint, Inc., provides free access to its DNS-based Block List (DNSBL) to effectively block email from more than 12 million host servers known to disseminate spam, phishing attacks and other forms of malicious email. The list typically includes email servers suspected of sending or relaying spam, servers that have been hacked and hijacked, and those with Trojan infestations. In an attempt to provide preemptive protection, SORBS also lists servers with dynamically allocated IP addresses.
SORBS DUHL
The SORBS (Spam and Open Relay Blocking System), owned and operated by Proofpoint, Inc., provides free access to its DNS-based Block List (DNSBL) to effectively block email from more than 12 million host servers known to disseminate spam, phishing attacks and other forms of malicious email. The list typically includes email servers suspected of sending or relaying spam, servers that have been hacked and hijacked, and those with Trojan infestations. In an attempt to provide preemptive protection, SORBS also lists servers with dynamically allocated IP addresses.
SORBS HTTP
The SORBS (Spam and Open Relay Blocking System), owned and operated by Proof point, Inc., provides free access to its DNS-based Block List (DNSBL) to effectively block email from more than 12 million host servers known to disseminate spam, phishing attacks and other forms of malicious email. The list typically includes email servers suspected of sending or relaying spam, servers that have been hacked and hijacked, and those with Trojan infestations. In an attempt to provide preemptive protection, SORBS also lists servers with dynamically allocated IP addresses.
SORBS MISC
The SORBS (Spam and Open Relay Blocking System), owned and operated by Proofpoint, Inc., provides free access to its DNS-based Block List (DNSBL) to effectively block email from more than 12 million host servers known to disseminate spam, phishing attacks and other forms of malicious email. The list typically includes email servers suspected of sending or relaying spam, servers that have been hacked and hijacked, and those with Trojan infestations. In an attempt to provide preemptive protection, SORBS also lists servers with dynamically allocated IP addresses.
SORBS SMTP
The SORBS (Spam and Open Relay Blocking System), owned and operated by Proofpoint, Inc., provides free access to its DNS-based Block List (DNSBL) to effectively block email from more than 12 million host servers known to disseminate spam, phishing attacks and other forms of malicious email. The list typically includes email servers suspected of sending or relaying spam, servers that have been hacked and hijacked, and those with Trojan infestations. In an attempt to provide preemptive protection, SORBS also lists servers with dynamically allocated IP addresses.
SORBS SOCKS
The SORBS (Spam and Open Relay Blocking System), owned and operated by Proofpoint, Inc., provides free access to its DNS-based Block List (DNSBL) to effectively block email from more than 12 million host servers known to disseminate spam, phishing attacks and other forms of malicious email. The list typically includes email servers suspected of sending or relaying spam, servers that have been hacked and hijacked, and those with Trojan infestations. In an attempt to provide preemptive protection, SORBS also lists servers with dynamically allocated IP addresses.
SORBS SPAM
The SORBS (Spam and Open Relay Blocking System), owned and operated by Proofpoint, Inc., provides free access to its DNS-based Block List (DNSBL) to effectively block email from more than 12 million host servers known to disseminate spam, phishing attacks and other forms of malicious email. The list typically includes email servers suspected of sending or relaying spam, servers that have been hacked and hijacked, and those with Trojan infestations. In an attempt to provide preemptive protection, SORBS also lists servers with dynamically allocated IP addresses.
SORBS WEB
The SORBS (Spam and Open Relay Blocking System), owned and operated by Proofpoint, Inc., provides free access to its DNS-based Block List (DNSBL) to effectively block email from more than 12 million host servers known to disseminate spam, phishing attacks and other forms of malicious email. The list typically includes email servers suspected of sending or relaying spam, servers that have been hacked and hijacked, and those with Trojan infestations. In an attempt to provide preemptive protection, SORBS also lists servers with dynamically allocated IP addresses.
SORBS ZOMBIE
The SORBS (Spam and Open Relay Blocking System), owned and operated by Proofpoint, Inc., provides free access to its DNS-based Block List (DNSBL) to effectively block email from more than 12 million host servers known to disseminate spam, phishing attacks and other forms of malicious email. The list typically includes email servers suspected of sending or relaying spam, servers that have been hacked and hijacked, and those with Trojan infestations. In an attempt to provide preemptive protection, SORBS also lists servers with dynamically allocated IP addresses.
SPAMCANNIBAL
Listing in SpamCannibal’s results from sending spam or virus ladened email to their mail-servers (spamtraps). SpamCannibal can be used to block specific IP Addresses or entire ranges of IP Addresses; this also means your IP Address can be listed if you are sending messages with BOGUS/FORGED headers, i.e. you don’t run a mail-server and have a generic dynamic address and connect to a hosted mail-provider. Or, if you operate a server, you do not have the proper Reverse-DNS entry in place with your ISP.
SPAMCOP
The SpamCop Blocking List lists IP Addresses which have sent unsolicited email to SpamCop users. This is often an indication of a Virus or Botnet from a Malware infection contracted inside your network.
Spamhaus ZEN
Inclusion in the Spamhaus-ZEN Blacklist results from sub-listings in one more the following Blacklists:
CBL – You have contracted a Virus or Malware that is operating a Botnet, either on your email server on a workstation behind the NAT – Continual delisting requests without eliminating the virus will result in permanent blacklisting;
XBL (Spamhaus Exploits Block List) is a realtime database of IP addresses of hijacked PCs infected by illegal 3rd party exploits, including open proxies;
PBL – Spamhaus PBL is a DNSBL database of end-user IP address ranges which should not be delivering unauthenticated SMTP email to any Internet mail server except those provided for specifically by an ISP for that customer’s use.
SPEWS1
SPEWS is a list of areas on the Internet which several system administrators deny E-mail from. Warning: Intentionally lists legitimate mailservers that either have IPs close to spammers, or that had problems in the past that have been complvcely fixed. Should not be used to block mail, although could be used in a weighting system.
SPEWS2
SPEWS is a list of areas on the Internet which several system administrators deny E-mail from. Warning: Intentionally lists legitimate mailservers that either have IPs close to spammers, or that had problems in the past that have been complvcely fixed. Should not be used to block mail, although could be used in a weighting system.
SWINOG
The Swinog DNSBL is a realtime blacklist assembled by spamtraps. Is an e-mail arriving in such a spamtrap, all URL’s are extracted, verified with a whitelist and added to the blacklist.
TRIUMF
RBL2.TRIUMF.CA realtime blackhole list — Lists open relays that send E-mail to the triumf.ca domain.
TRUNCATE
If you are on the Truncate Blacklist, there could be any number of issues that need to be addressed in your network: virus-generated spam, dynamic IP Addresses previously used by spammers or bulk mail sending that does not comply with the CAN-SPAM Act.
UCEPROTECTL1
If you are on the UCEPROTECTL1, it typically means you have either had an open-relay on the server, or you have a reverse-DNS problem that is causing your server to be identified as part of a bad range of IP Addresses through your ISP.
UCEPROTECTL2
If you are on the UCEPROTECTL2 / L3, you have an IP Address from your ISP that falls into a poor reputation range; i.e. the entire range of IP Addresses is blocked as a result of the provider hosting spammers.
UCEPROTECTL3
If you are on the UCEPROTECTL2 / L3, you have an IP Address from your ISP that falls into a poor reputation range; i.e. the entire range of IP Addresses is blocked as a result of the provider hosting spammers.
VIRBL
Virbl is a project of which the idea was born during the RIPE-48 meeting. The plan was to get reports of virusscanning mailservers, and put the IP-addresses that were reported to send viruses on a blacklist. VIRBL only provide a list with IP’s which have sent viruses to their Spamtraps or contributors spamtraps.
WPBL
WPBL – Weighted Private Block List – WPBL is a private block list consisting of IP addresses which connected to members’ systems and delivered unsolicited bulk mail (spam). The list is designed to be useful and effective when used by WPBL members, but may not be suitable for other uses. This is NOT a public spam blocking service. WPBL should not be used to block mail or deny SMTP connections. It is most effective in a scoring-based system like SpamTestBuddy or SpamAssassin rather than black-and-white filtering.
ZONEEDIT
Zoneedit.com – Advanced DNS Management – DNS Blacklist Info – Enter Zone OR IP at legacy.zoneedit.com/blcheck.html
AHBL RHSBL
The AHBL RSHBL lists domain names that spammers own and use in their UCE/UBE/spam. This list claims to not contain domains that are not owned/operated by known spammers.
BSB Domain
The BSB is a database of IP addresses that have sent “comment spam”.
ivmURI
Listing in the ivmURL blacklists indicates that your domain has been seen in unsolicited emails by the Invaluement team.
SEM FRESH
This RHSBL run by Spam Eating Monkey contains domains registered in the last 5 days under the .AERO, .BIZ, .COM, .INFO, .NAME, .NET, .PRO, .SK, .TEL and .US TLDs. Domains are automatically expired after five days.
SEM URI
Spam Eating Monkey URI: URIs found a requisite number of times in unwanted messages. Domains automatically expire after 15 days of inactivity.
SEM URIRED
Spam Eating Monkey URI-RED: URI early and preemptive dvcection list that lists URIs before they appear in the flow of unwanted mail.
Spam Eating Monkey URI-RED: URI early and preemptive dvcection list that lists URIs before they appear in the flow of unwanted mail.
SORBS RHSBL BADCONF
This RHSBL list run by SORBS contains domain names where the A or MX records point to bad address space.
SORBS RHSBL MULTI
This RHSBL run by SORBS is an aggregate list containing all of the listings in the SORBS-RHSBL-BADCONF and SORBS-RHSBL-NOMAIL lists.
SORBS RHSBL NOMAIL
This RHSBL list run by SORBS contains domain names where the owners have indicated no email should ever originate from these domains.
Spamhaus DBL
This RHSBL run by Spamhaus contains domains (typically web site domains) found in spam messages.
The list is maintained by a dedicated team of specialists working with an automated system that constantly analyses a large portion of the world’s email flow and the domains used in spam emails.
SURBL Multi
This RHSBL run by SURBL.org is an aggregate list containing all of the listings found on the SURBL lists. They contain domain names of web sites that have appeared in unsolicited messages.
URIBL Multi
URIBL lists domains that appear in spam, NOT where they were sent from. Their lists are intended to be used with antispam software to help TAG emails as spam. We do not BLOCK. If you are being blocked by someone because you are on this list, take it up with the person blocking you, not us!
URIBL Multi checks to see if a domain is on any of their lists. This zone rebuilds if any of the above zones are rebuilt, with the exception of white.