]> git.netwichtig.de Git - user/henk/docs/dnsbl_notes.git/blob - dnslists.otl
update schulte.org
[user/henk/docs/dnsbl_notes.git] / dnslists.otl
1 TODO
2         check and link (de)listing policy
3                 NOGO: delisting for money
4         check and link usage policy
5         check and link return codes
6         find newsfeed or mailinglist
7         give feedback?
8         implement in exim
9         implement in SA
10         implement in rspamd
11 00_META
12         https://bugs.launchpad.net/ubuntu/+source/amispammer/+bug/835614
13         http://www.blalert.com/dnsbls
14         http://www.dnsbl.info/dnsbl-list.php
15         http://dnsbl.inps.de/index.cgi?lang=en&site=00002
16         http://www.sdsc.edu/~jeff/spam/cbc.html
17         http://moensted.dk/spam/
18         https://whatismyipaddress.com/blacklist-check
19         https://multirbl.valli.org/
20         https://glockapps.com/blacklist/
21         https://docs.hetrixtools.com/monitored-blacklists/
22         https://www.blacklistmaster.com/
23         https://knowledge.validity.com/hc/en-us/sections/204468388-Blocklists
24         https://github.com/zbetcheckin/DNSBLs
25         https://en.wikipedia.org/wiki/Comparison_of_DNS_blacklists
26 00_ELANG
27         http://dnsbl.aspnet.hu/
28                 hungarian?
29         http://spam-rbl.fr/
30                 french
31         https://mav.com.br/
32                 maybe? they have antispam but it’s all portugese? or spanish? no idea
33 00_DEAD
34         http://openrbl.org/
35                 as seems dead
36                         404s
37                         wiki is down
38         http://mailhosts.org/
39                 dead
40                         https://www.blalert.com/dnsbl/shortlist.mailhosts.org
41         blitzed.org
42                 dead since 2006
43                         https://www.dnsbl.com/2007/02/status-of-opmblitzedorg-dead.html
44                                 referenced ML post is 404
45         blackholes.five-ten-sg.com
46                 Offline as of 1/1/2013
47                         https://whatismyipaddress.com/five-ten-sg
48         dynip.rothen.com
49                 On 9/29/2020 the ROTHEN blacklist appears to have started to list the entire internet
50                         https://www.dnsbl.info/dnsbl-details.php?dnsbl=dynip.rothen.com
51         fl.chickenboner.biz
52                 dead since 2011
53                         https://community.spiceworks.com/topic/329762-blacklist-removal
54                         https://bugs.launchpad.net/ubuntu/+source/amispammer/+bug/835614
55                 website contains spam/crap
56         http://cart00ney.surriel.com/
57                 cart00ney.org is dead
58         http://dsbl.org/
59                 points to surriel.com
60         http://csma.biz/
61                 domain is for sale
62                 dead since 2013
63                         https://www.dnsbl.com/2013/02/status-of-blcsmabiz-dead.html
64         http://dnsbl.net.au/
65                 website contains info about living in australia? called "AusBlog"
66                 http://www.dnsbl.com/2009/04/status-of-dnsblnetau-dead.html
67         http://moensted.dk/spam/
68                 dead since 2010
69                 https://moensted.dk/spam/
70         http://rbl.mw-internet.net/
71                 domain was parked
72                 2023: it is an asian(?) gambling(?) website
73         http://www.blackholes.us/
74                 dead since 2009
75                         https://www.dnsbl.com/2009/10/status-of-blackholesus-dead.html
76         http://www.deadbeef.com/
77                 dead, no info
78         spamsources.dnsbl.info
79                 dead since 2011 or so
80                         http://www.dnsbl.info/spamsources-dnsbl-defunct.php
81         http://www.gweep.ca/
82                 domain dead, no other info
83         http://www.njabl.org/
84                 dead since 2013
85                         https://en.wikipedia.org/wiki/Not_Just_Another_Bogus_List
86         http://wytnij.to/
87                 website parked, no other info
88         https://www.transip.nl/
89                 dead since 2013
90                         https://www.blalert.com/dnsbl/proxy.block.transip.nl
91                         https://www.blalert.com/dnsbl/residential.block.transip.nl
92         pss.spambusters.org.ar
93                 NXDOMAIN
94         rbl.snark.net
95                 NXDOMAIN
96                 https://snark.net/ gives access denied
97         whois.rfc-ignorant.org
98                 NXDOMAIN
99                 rfc-ignorant.org registered but no A/AAAA record
100                 dead since 2012
101                         http://www.h-online.com/security/news/item/RFC-Ignorant-org-blacklist-closes-down-1724814.html
102                         https://www.dnsbl.com/2012/09/status-of-rfc-ignorantorg-shutting-down.html
103         will-spam-for-food.eu.org
104                 unmaintained
105                 dead
106                         https://rfc1149.net/blog/2012/01/22/who-did-resurrect-will-spam-for-food/
107         http://proxybl.org/
108                 dead, seemingly written on http://proxybl.org/blog but that’s also dead
109                 https://linuxreviews.org/Mail_Spam_Blacklists
110                 https://community.sophos.com/utm-firewall/f/web-server-security/50273/dnsbl-proxybl-org-offline
111         dev.null.dk
112                 timeout, also on the parent null.dk
113                 effectively dead
114         dnsbl.mags.net
115                 seems dead, no info to be found
116                 domain does not respond
117         http://msrbl.blogspot.ch/
118                 http://msrbl.blogspot.com/ says "no updates" since 2010 but supposed to be reactivated
119                 effectively dead
120         http://www.olsentech.net/
121                 strange content on web
122                 effectively dead
123         rbl.orbitrbl.com
124                 http://www.orbitrbl.com/
125                 timeout
126         rbl.polarcomm.net
127                 NXDOMAIN
128                 registered but no A/AAAA record
129         cidr.bl.mcafee.com
130                 https://kc.mcafee.com/corporate/index?page=content&id=KB53783
131                         404
132                 no info to be found
133                 dead?
134         http://anti-spam.org.cn/?locale=en_US
135                 unreachable DNS
136         rbl.talkactive.net
137                 seems dead
138                 talkactive.net redirects twice to some hosting company
139                 last listings in 2017
140                         https://multirbl.valli.org/detail/rbl.talkactive.net.html
141                         https://www.blacklistmaster.com/blacklists?view=details&blacklist=rbl.talkactive.net
142         dnsbl.ipocalypse.net
143                 no policies published
144                 dead
145                         was a private list of an irc network
146                         network was renamed idlechat.net in 2014
147                         became a discord chat in 2022(?)
148         http://blakjak.net/RBL
149                 external access disabled
150                 2023: seems dead, website is a weird error
151                 https://www.blalert.com/dnsbl/rbl.blakjak.net
152                         This is a private list that we do not monitor as the maintainer has explicity announced that the list is for his personal use
153         http://cyberlogic.net/
154                 french (canada)
155                 https://www.dnsbl.info/dnsbl-details.php?dnsbl=dnsbl.cyberlogic.net
156                         On or about 5/21/2018 the cyberlogic DNSBL ceased functioning properly.
157                 https://www.dnsbl.com/2018/05/
158                         As reported on the mailop mailing list on Friday May 25, 2018, the blocking list at dnsbl.cyberlogic.net now contains a "wildcard" DNS entry, effectively listing the entire internet
159         http://www.rbl.jp/allrbl-e.html
160                 website asks for login or just errors
161         http://www.spamhauswhitelist.com/en/
162                 looks like a parked domain with ads
163         http://stopspam.org/rblcheck/index.php
164                 aka dul.pacifier.net
165                 http://www.stopspam.org/rbl-info/
166                         stopped in 2013
167         http://countries.nerd.dk/
168                 unable to connect, also for nerd.dk
169         http://dul.ru/dul.en.html
170                 DEAD for sale
171         http://dns.measurement-factory.com/surveys/openresolvers.html
172                 dead
173                         »The following text describes past open DNS resolver surveys and an associated DNS lookup service that has been long shut down«
174         http://www.sectoor.de/tor.php
175                 timeouts
176         http://anticaptcha.net/
177                 for sale
178         http://blacklist.lashback.com/
179                 query zone: ubl.unsubscore.com
180                 provider’s website https://lashback.com/ seems alive and active (news entries from 2023) but does not link to the blacklist
181                 rsync URLs seem dead, so does the download url
182         http://blacklist.woody.ch/
183                 no entries in the displayed "top 100"
184                 may have been absorbed into the swinog blacklists, see antispam.imp.ch
185         http://cbl.abuseat.org/
186                 https://www.abuseat.org/
187                         changes to the CBL that occured in January 2021. In short, the CBL infrastructure was replaced by the Spamhaus XBL structure
188         http://dnsbl.burnt-tech.com/
189                 domain is for sale
190         http://rbl.dns-servicios.com/rbl.php
191                 website can not be found
192 00_NEEDS_RECHECK
193         https://antispam.imp.ch/
194                 no usage policy
195                 no return code info
196                 no good listing policy
197                 information received from inquiry to provider
198                         website will be updated
199                         return codes
200                                 dnsrbl.swinog.ch and uribl.swinog.ch (holding time increases with hits)
201                                         127.0.1.8 = default
202                                         127.0.0.10 => TRAP (Email sent to a spamtrap)
203                                         127.0.0.11 => REPO (Email reported as Spam by customer)
204                                 spamrbl.imp.ch (3 days holding time)
205                                         IPs are listed when trying to send mail to the spamtrap mailserver
206                                         MD5 hash: attachment sent to the swinog blacklist
207                                 wormrbl.imp.ch
208                                         DEAD
209         http://blacklist.woody.ch/rblcheck.php3
210                 dead?
211                 waiting for feedback
212         http://dnsbl.iip.lu/
213                 https://docs.hetrixtools.com/lookup-dnsbl-iip-lu-false-positive-removed/
214                         in 2016: lookup.dnsbl.iip.lu blacklist started issuing false positive responses and upon further investigation looks to be abandoned/dead.
215                 https://www.blalert.com/dnsbl/lookup.dnsbl.iip.lu
216                         This blacklist is marked as "shut down" and non-operational as of 2017-12-31.
217         http://dnsbl.inps.de/
218                 timeout
219                 https://www.dnsbl.com/search/label/dnsbl.inps.de
220                         Today, May 25, 2020, he has announced that it is shutting down, due to concerns around GDPR and personal challenges brought on by the coronavirus pandemic.
221                 https://docs.hetrixtools.com/dnsbl-inps-de-removed-from-our-system/
222                         [May 29,2018] IPv4 RBL dnsbl.inps.de has been removed from our system, as they have decided to discontinue the RBL project for the time being.
223                 https://glockapps.com/blacklist/dnsbl-inps-de/
224                         Today, May 25, 2020, he has announced that it is shutting down, due to concerns around GDPR and personal challenges brought on by the coronavirus pandemic.
225                 https://www.dnsbl.info/dnsbl-details.php?dnsbl=dnsbl.inps.de
226                         This blacklist is offline as of May 1, 2020.
227                 https://web.archive.org/web/20220428013500/http://www.inps.de/
228 00_NEEDS_RESEARCH
229         bl.tiopan.com
230         blocked.hilli.dk
231         dialups.visi.com
232         dnsbl.antispam.or.id
233         dob.sibl.support-intelligence.net
234         intruders.docs.uu.se
235         map.spam-rbl.com
236         rbl.triumf.ca
237         all.s5h.net
238                 http://www.usenix.org.uk/content/rbl.html
239         torexit.dan.me.uk
240         http://pedantic.org/
241                 as of 20140701
242         rbl.fasthosts.co.uk
243                 https://help.fasthosts.co.uk/app/answers/detail/a_id/140/kw/rbl
244                 seems dead?
245                 https://antispam.fasthosts.co.uk/
246 00_ALIVE
247         00_RECONSIDER
248                 http://barracudacentral.org/rbl
249                         requires account with extensive information (more than spamhaus e.g.):
250                                 your name.
251                                 your company name.
252                                 your phone number.
253                                 your address.
254                                 your city name.
255                                 your state/province name.
256                                 your zip/postal code.
257                                 the name of the alternate contact.
258                                 the phone number of the alternate contact.
259                                 the email address of the alternate contact.
260                         seems well documented
261         00_E_EVIL
262                 sbl.nszones.com
263                         http://www.spamhaus.org/organization/statement/008/fake-dnsbl-uncovered-nszones.com
264         00_E_INFORMATION
265                 blacklist.sci.kun.nl
266                         https://cncz.science.ru.nl/en/howto/email-spam/
267                         not really its own DNSBL?
268                         no usage information
269                         no usage policy
270                 http://anonmails.de/
271                         seems serious but missing necessary info
272                                 usage policy
273                                 listing policy
274                 http://blacklist.jippg.org/
275                         no usage policy
276                         no listing policy
277                         no return code info
278                 bip.virusfree.cz
279                         used by rspamd
280                         https://www.virusfree.cz/en/help is the only place I can find any official reference to this list at all but no policies or usage information
281                 https://www.nixspam.net/
282                         previously http://www.dnsbl.manitu.net/
283                         query zone: ix.dnsbl.manitu.net
284                         provided by the reputable german publisher 'heise' which makes the high quality c’t, iX, and telepolis magacines
285                         difficult to find info regarding listing policy
286                         asked for more information to be added
287                                 https://www.heise.de/forum/iX/Kommentare/Gemeinsam-stark/Nutzungsbedingungen-Return-Codes-sonstige-Infos/posting-42669177/show/
288                 access.redhawk.org
289                         website works but barely any info, not even how to query it
290                         https://www.redhawk.org/?p=64
291                         https://www.redhawk.org/SpamHawk/index.php
292                 https://senderscore.org/
293                         requires registration?
294                         Scam? http://www.complaintsboard.com/complaints/buyer-beware-senderscoreorg-is-a-scam-c276871.html
295                         https://senderscore.org/assess/blocklist-lookup/
296                         FAQ: https://knowledge.validity.com/hc/en-us/articles/360006992592-Return-Path-Blocklist-RPBL-FAQ-
297                         no information how to query found
298                 mail-abuse.org
299                         https://ers.trendmicro.com/
300                         trendmicro paid service
301                         https://docs.trendmicro.com/en-us/enterprise/email-reputation-services-online-help/getting-started_001/configuring-email-re/creating-an-account.aspx
302                                 »If you don’t create an account, you can still query the reputation of an IP address«
303                         I don’t find any pricing or usage information
304                 http://dnsbl.tornevall.org/
305                         https://www.tornevall.net/
306                         related to https://www.fraudbl.org/
307                         seems a bit unstructured and not very well documented
308                                 I can’t be arsed to deal with confluence slowing my browser to a halt repeatedly and it’s really hard to navigate but there seems to be some information on https://docs.tornevall.net/display/TORNEVALL/Endpoint%3A+dnsbl+-+DNSBL+v5+with+API+v3
309                         seems active
310                 http://rbl.schulte.org/
311                         seems active
312                         listing policy seems to be: they received spam from an IP
313                         usage policy: Anyone can use this RBL list [sic]
314                         return codes: probably boolean, i.e. either listed or not
315         00_E_PAID
316         00_E_PRIVATE
317                 88.blacklist.zap
318                         http://blogs.technet.com/b/fss/archive/2009/05/08/forefront-dnsbl-yeah-or-nay.aspx
319                         https://web.archive.org/web/20150812003556/http://blogs.technet.com/b/fss/archive/2009/05/08/forefront-dnsbl-yeah-or-nay.aspx
320                         https://www.blalert.com/dnsbl/88.blacklist.zap
321                                 88.blacklist.zap is an internal blacklist maintained by Microsoft's Forefront
322                         https://www.dnsbl.com/search/label/frontbridge
323                 http://drmx.org/
324                         »Use of any DrMX.ORG DNS Zone is by request and by contract only.«
325                 rbl.tdk.net
326                         tdk.net seems dead on http(s)
327                         private
328                                 https://www.blalert.com/dnsbl/rbl.tdk.net
329                         old link: http://postmaster.tdc.dk/publish.php?id=31787
330                                 tdc.dk redirects to yousee.dk
331                                 https://web.archive.org/web/20170703084224/http://postmaster.tdc.dk/publish.php?id=31787
332                 rbl.zenon.net
333                         private
334                                 https://www.blalert.com/dnsbl/rbl.zenon.net
335                         http://www.noc.zenon.net/rbl/
336                         russian(?)
337                 https://ahbl.org/
338                         was public until 2015
339                         now private, invite-only
340         http://rfc-clueless.org/
341                 lists domains
342                         that do not adhere to common best practices or requirements
343                 does NOT list spammers!
344                 listing criteria are explained well
345                         http://rfc-clueless.org/pages/listing_policy
346                 return codes are explained
347                         http://rfc-clueless.org/
348                 usage policy is not so clear but the FAQ implies that it’s just free to use for everyone
349                 many timeouts
350                         first noticed in 2014 and deactivated
351                         retried in 2023 and still the case
352         http://spameatingmonkey.com/
353                 lists IPs
354                         that sent backscatter
355                         that sent to spamtrap
356                         added by policy
357                                 this includes dial-up!
358                                 https://spameatingmonkey.com/faq/policy-based-listing
359                 lists domains/URIs
360                         by age
361                         in spam bodies
362                 usage policy seems clear
363                         https://spameatingmonkey.com/faq/query-limits
364                 listing policy seems clear
365                         https://spameatingmonkey.com/services
366                 return codes documented
367                         https://spameatingmonkey.com/services
368                 http://blogspambl.com/
369                         redirects to spameatingmonkey.com
370         http://uribl.com/
371                 lists domains/URIs
372                         that appear in spam bodies
373                         has whitelist
374                 lists IPs
375                         that URIs in spam bodies resolve to
376                 return codes are documented
377                         https://uribl.com/about.shtml#implementation
378                         bitmasked
379                         127.0.0.1 is used to signal abusive query behaviour
380         http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists
381                 called "hostkarma"
382                 lists domains/URIs
383                 lists IPs
384                 usage policy is relatively clear that it’s free, except maybe for big for-profit oranizations
385                 listing policy is documented
386                 return codes are documented
387                 seems very trustworthy
388         http://www.sorbs.net/
389                 good reputation
390                 lists domains/URIs
391                 lists IPs
392                 usage policy is clear that it’s free
393                 listing policy is documented
394                 return codes are documented
395                 seems trustworthy
396         http://www.spamhaus.org/
397                 good reputation
398                 very well done
399                 seems very professional
400                 lists domains/URIs
401                 lists IPs
402                 usage policy is clear
403                         https://www.spamhaus.org/organization/dnsblusage/
404                 listing policies are clearly documented
405                 return codes are clearly documented
406         http://www.surbl.org/
407                 good reputation
408                 lists domains/URIs
409                 usage policy is clear
410                         https://surbl.org/usage-policy
411                 listing policy is documented
412                 return codes are documented
413                         bitmasked
414                         127.0.0.1 means blocked
415         http://zapbl.net/
416                 lists domains/URIs
417                 lists IPs
418                 listing policy seems clear
419                         https://zapbl.net/policy
420                 usage policy seems clearly free for everyone
421                         https://zapbl.net/using
422                 return codes are documented
423                 seems well done
424         https://rbl.foobar.hu/
425                 lists domains/URIs
426                 lists IPs
427                 listing policy seems clear
428                 usage policy seems clearly free for everyone
429                 return codes are documented
430                 possibly unmaintained or dead
431                         footer says: ©2013-14
432         http://apews.org/?page=filter
433                 questionable
434                         https://www.dnsbl.com/search/label/apews
435                         https://whatismyipaddress.com/apews
436                 dead?
437                         no news on http://apews-user.blogspot.com/ since 2014
438                 not further looked into because of the above
439         https://www.dnswl.org/
440                 seems to be run with best intentions but has had issues from what I have heard from some users
441                 IRC channel has some activity
442                 usage policy relatively clear
443                         free within certain limits
444                 listing policy
445                         self-service
446                 return codes are documented
447         00_E_FOCUS
448                 https://www.dnsblchile.org/index.en.html
449                         chilenian spam so not interesting for me
450                         seems alive
451         00_LISTS_BLOGSPAMMERS
452                 https://www.madavi.de/madavibl/
453                         »This blacklist should only be used to block comment spammer (on blogs and websites). Don’t use it for mail.«
454                 http://bsb.empty.us/
455                         does not exist anymore
456                         empty.us returns »Nothing here, obviously.«
457         00_LISTS_COUNTRIES
458                 korea
459                         http://korea.services.net/
460         00_LISTS_DIALUPS
461         00_LISTS_OPENRESOLVERS
462         00_LISTS_TORNODES
463                 https://www.dan.me.uk/dnsbl
464         https://0spam.org/
465                 clear information on usage policy
466                         Nothing. The 0Spam Project is absolutely free for email providers, IT professionals and general removal request.
467                         DNSBL service and removals are 100% for free for all uses; commercial, non profit and personal.
468                 seems serious
469                 listing policies are a little less clear
470                         bl.0spam.org DNSBL | 0spam Spam Trap Primary Database
471                         nbl.0spam.org Network Black List | Spam Source Networks, high volume of spam trap hits in a Class C block will result in network listings in this DNSBL.
472                         url.0spam.org URL Black List | This list contains the IP address of domains found to be in the source of spam emails found in our traps.
473                 return codes not very clear
474         https://abuse.ro/
475                 policy
476                         spamtraps
477                         The last IP address before destination in the email headers is listed into rbl.abuse.ro list.
478                         Sender domains are analyzed and if confirmed to be not spoofed, are listed into dbl.abuse.ro list
479                         Spamvertized domains (including those indirectly linked through services like bit.ly) are listed into uribl.abuse.ro list
480         http://dronebl.org/
481                 usage policy is clear: free for whatever
482                 listing policy is not quite so clear
483                         can be mostly inferred from the classes but not entirely clear IMHO
484                 has an IRC channel
485                 return codes
486                         not explicitly mentioned but it’s 127.0.0.X where X is the class from https://dronebl.org/classes
487         http://psbl.org/
488                 query zone: psbl.surriel.com
489                 no usage policy, but seems implied that usage is free
490                 listing policy
491                         no explicit, complete policy given but sending to spamtraps is mentioned to get you listed and seems the exclusive mechanism
492                 return codes
493                         not documented, probably only boolean
494         http://rbldata.interserver.net/
495                 may be dead: http://www.blalert.com/dnsbl/rbl.interserver.net
496         http://relaytest.kundenserver.de/
497         http://rv-soft.info/
498         http://spamcannibal.org/dnsbl_check.shtml
499         http://spamrats.com/
500         http://spamstinks.com/
501         http://st.technovision.dk/
502         http://tor.efnet.org/
503                 http://rbl.efnetrbl.org/ MIRROR
504         http://v4bl.org/
505         http://virbl.bit.nl/
506         http://wpbl.info/
507         http://www.aupads.org/
508         http://www.backscatterer.org/
509                 fragwuerdige policy - bezahlen fuer schnelleres delisting
510         http://www.blockedservers.com/
511         http://www.blocklist.de/en/index.html
512         http://www.emailbasura.org/cgi-bin/emailbasura-ini.pl?lang=eng
513         http://www.gbudb.com/truncate/
514         http://www.justspam.org/
515         http://www.kempt.net/dnsbl/
516         http://www.leadmon.net/spamguard/
517         http://www.spamcop.net/
518                 good policy
519                 good reputation
520         http://www.spamsources.fabel.dk/
521                 sensible policy
522         http://www.srntools.com/blacklist/
523         http://www.uceprotect.net/en/index.php
524         https://bl.konstant.no/
525         https://choon.net/rbl.php
526         https://www.abuse.ch/
527                 https://www.abuse.ch/?tag=httpbl
528         https://www.kisarbl.or.kr/
529         https://www.megarbl.net/
530         https://www.team-cymru.org/Services/Bogons/dns.html
531         http://mailspike.net/usage.html
532                 reputation-based
533         http://www.whitelisted.org/
534                 paid subscription
535                 policy on site
536         https://puck.nether.net/or/
537                 policies on website
538         http://www.isipp.com/email-accreditation/iadb-query-instruction/
539                 requires signup
540                 not quite a usage policy, but seems ok
541                 strange split of ipv4 and ipv6
542                 seems dead?