]> git.netwichtig.de Git - user/henk/docs/dnsbl_notes.git/blob - dnslists.otl
update spamcannibal.org
[user/henk/docs/dnsbl_notes.git] / dnslists.otl
1 TODO
2         check and link (de)listing policy
3                 NOGO: delisting for money
4         check and link usage policy
5         check and link return codes
6         find newsfeed or mailinglist
7         give feedback?
8         implement in exim
9         implement in SA
10         implement in rspamd
11 00_META
12         https://bugs.launchpad.net/ubuntu/+source/amispammer/+bug/835614
13         http://www.blalert.com/dnsbls
14         http://www.dnsbl.info/dnsbl-list.php
15         http://dnsbl.inps.de/index.cgi?lang=en&site=00002
16         http://www.sdsc.edu/~jeff/spam/cbc.html
17         http://moensted.dk/spam/
18         https://whatismyipaddress.com/blacklist-check
19         https://multirbl.valli.org/
20         https://glockapps.com/blacklist/
21         https://docs.hetrixtools.com/monitored-blacklists/
22         https://www.blacklistmaster.com/
23         https://knowledge.validity.com/hc/en-us/sections/204468388-Blocklists
24         https://github.com/zbetcheckin/DNSBLs
25         https://en.wikipedia.org/wiki/Comparison_of_DNS_blacklists
26 00_ELANG
27         http://dnsbl.aspnet.hu/
28                 hungarian?
29         http://spam-rbl.fr/
30                 french
31         https://mav.com.br/
32                 maybe? they have antispam but it’s all portugese? or spanish? no idea
33 00_DEAD
34         http://openrbl.org/
35                 as seems dead
36                         404s
37                         wiki is down
38         http://mailhosts.org/
39                 dead
40                         https://www.blalert.com/dnsbl/shortlist.mailhosts.org
41         blitzed.org
42                 dead since 2006
43                         https://www.dnsbl.com/2007/02/status-of-opmblitzedorg-dead.html
44                                 referenced ML post is 404
45         blackholes.five-ten-sg.com
46                 Offline as of 1/1/2013
47                         https://whatismyipaddress.com/five-ten-sg
48         dynip.rothen.com
49                 On 9/29/2020 the ROTHEN blacklist appears to have started to list the entire internet
50                         https://www.dnsbl.info/dnsbl-details.php?dnsbl=dynip.rothen.com
51         fl.chickenboner.biz
52                 dead since 2011
53                         https://community.spiceworks.com/topic/329762-blacklist-removal
54                         https://bugs.launchpad.net/ubuntu/+source/amispammer/+bug/835614
55                 website contains spam/crap
56         http://cart00ney.surriel.com/
57                 cart00ney.org is dead
58         http://dsbl.org/
59                 points to surriel.com
60         http://csma.biz/
61                 domain is for sale
62                 dead since 2013
63                         https://www.dnsbl.com/2013/02/status-of-blcsmabiz-dead.html
64         http://dnsbl.net.au/
65                 website contains info about living in australia? called "AusBlog"
66                 http://www.dnsbl.com/2009/04/status-of-dnsblnetau-dead.html
67         http://moensted.dk/spam/
68                 dead since 2010
69                 https://moensted.dk/spam/
70         http://rbl.mw-internet.net/
71                 domain was parked
72                 2023: it is an asian(?) gambling(?) website
73         http://www.blackholes.us/
74                 dead since 2009
75                         https://www.dnsbl.com/2009/10/status-of-blackholesus-dead.html
76         http://www.deadbeef.com/
77                 dead, no info
78         spamsources.dnsbl.info
79                 dead since 2011 or so
80                         http://www.dnsbl.info/spamsources-dnsbl-defunct.php
81         http://www.gweep.ca/
82                 domain dead, no other info
83         http://www.njabl.org/
84                 dead since 2013
85                         https://en.wikipedia.org/wiki/Not_Just_Another_Bogus_List
86         http://wytnij.to/
87                 website parked, no other info
88         https://www.transip.nl/
89                 dead since 2013
90                         https://www.blalert.com/dnsbl/proxy.block.transip.nl
91                         https://www.blalert.com/dnsbl/residential.block.transip.nl
92         pss.spambusters.org.ar
93                 NXDOMAIN
94         rbl.snark.net
95                 NXDOMAIN
96                 https://snark.net/ gives access denied
97         whois.rfc-ignorant.org
98                 NXDOMAIN
99                 rfc-ignorant.org registered but no A/AAAA record
100                 dead since 2012
101                         http://www.h-online.com/security/news/item/RFC-Ignorant-org-blacklist-closes-down-1724814.html
102                         https://www.dnsbl.com/2012/09/status-of-rfc-ignorantorg-shutting-down.html
103         will-spam-for-food.eu.org
104                 unmaintained
105                 dead
106                         https://rfc1149.net/blog/2012/01/22/who-did-resurrect-will-spam-for-food/
107         http://proxybl.org/
108                 dead, seemingly written on http://proxybl.org/blog but that’s also dead
109                 https://linuxreviews.org/Mail_Spam_Blacklists
110                 https://community.sophos.com/utm-firewall/f/web-server-security/50273/dnsbl-proxybl-org-offline
111         dev.null.dk
112                 timeout, also on the parent null.dk
113                 effectively dead
114         dnsbl.mags.net
115                 seems dead, no info to be found
116                 domain does not respond
117         http://msrbl.blogspot.ch/
118                 http://msrbl.blogspot.com/ says "no updates" since 2010 but supposed to be reactivated
119                 effectively dead
120         http://www.olsentech.net/
121                 strange content on web
122                 effectively dead
123         rbl.orbitrbl.com
124                 http://www.orbitrbl.com/
125                 timeout
126         rbl.polarcomm.net
127                 NXDOMAIN
128                 registered but no A/AAAA record
129         cidr.bl.mcafee.com
130                 https://kc.mcafee.com/corporate/index?page=content&id=KB53783
131                         404
132                 no info to be found
133                 dead?
134         http://anti-spam.org.cn/?locale=en_US
135                 unreachable DNS
136         rbl.talkactive.net
137                 seems dead
138                 talkactive.net redirects twice to some hosting company
139                 last listings in 2017
140                         https://multirbl.valli.org/detail/rbl.talkactive.net.html
141                         https://www.blacklistmaster.com/blacklists?view=details&blacklist=rbl.talkactive.net
142         dnsbl.ipocalypse.net
143                 no policies published
144                 dead
145                         was a private list of an irc network
146                         network was renamed idlechat.net in 2014
147                         became a discord chat in 2022(?)
148         http://blakjak.net/RBL
149                 external access disabled
150                 2023: seems dead, website is a weird error
151                 https://www.blalert.com/dnsbl/rbl.blakjak.net
152                         This is a private list that we do not monitor as the maintainer has explicity announced that the list is for his personal use
153         http://cyberlogic.net/
154                 french (canada)
155                 https://www.dnsbl.info/dnsbl-details.php?dnsbl=dnsbl.cyberlogic.net
156                         On or about 5/21/2018 the cyberlogic DNSBL ceased functioning properly.
157                 https://www.dnsbl.com/2018/05/
158                         As reported on the mailop mailing list on Friday May 25, 2018, the blocking list at dnsbl.cyberlogic.net now contains a "wildcard" DNS entry, effectively listing the entire internet
159         http://www.rbl.jp/allrbl-e.html
160                 website asks for login or just errors
161         http://www.spamhauswhitelist.com/en/
162                 looks like a parked domain with ads
163         http://stopspam.org/rblcheck/index.php
164                 aka dul.pacifier.net
165                 http://www.stopspam.org/rbl-info/
166                         stopped in 2013
167         http://countries.nerd.dk/
168                 unable to connect, also for nerd.dk
169         http://dul.ru/dul.en.html
170                 DEAD for sale
171         http://dns.measurement-factory.com/surveys/openresolvers.html
172                 dead
173                         »The following text describes past open DNS resolver surveys and an associated DNS lookup service that has been long shut down«
174         http://www.sectoor.de/tor.php
175                 timeouts
176         http://anticaptcha.net/
177                 for sale
178         http://blacklist.lashback.com/
179                 query zone: ubl.unsubscore.com
180                 provider’s website https://lashback.com/ seems alive and active (news entries from 2023) but does not link to the blacklist
181                 rsync URLs seem dead, so does the download url
182         http://blacklist.woody.ch/
183                 no entries in the displayed "top 100"
184                 may have been absorbed into the swinog blacklists, see antispam.imp.ch
185         http://cbl.abuseat.org/
186                 https://www.abuseat.org/
187                         changes to the CBL that occured in January 2021. In short, the CBL infrastructure was replaced by the Spamhaus XBL structure
188         http://dnsbl.burnt-tech.com/
189                 domain is for sale
190         http://rbl.dns-servicios.com/rbl.php
191                 website can not be found
192         http://spamcannibal.org/
193                 dead, as of at least 2018
194 00_NEEDS_RECHECK
195         https://antispam.imp.ch/
196                 no usage policy
197                 no return code info
198                 no good listing policy
199                 information received from inquiry to provider
200                         website will be updated
201                         return codes
202                                 dnsrbl.swinog.ch and uribl.swinog.ch (holding time increases with hits)
203                                         127.0.1.8 = default
204                                         127.0.0.10 => TRAP (Email sent to a spamtrap)
205                                         127.0.0.11 => REPO (Email reported as Spam by customer)
206                                 spamrbl.imp.ch (3 days holding time)
207                                         IPs are listed when trying to send mail to the spamtrap mailserver
208                                         MD5 hash: attachment sent to the swinog blacklist
209                                 wormrbl.imp.ch
210                                         DEAD
211         http://blacklist.woody.ch/rblcheck.php3
212                 dead?
213                 waiting for feedback
214         http://dnsbl.iip.lu/
215                 https://docs.hetrixtools.com/lookup-dnsbl-iip-lu-false-positive-removed/
216                         in 2016: lookup.dnsbl.iip.lu blacklist started issuing false positive responses and upon further investigation looks to be abandoned/dead.
217                 https://www.blalert.com/dnsbl/lookup.dnsbl.iip.lu
218                         This blacklist is marked as "shut down" and non-operational as of 2017-12-31.
219         http://dnsbl.inps.de/
220                 timeout
221                 https://www.dnsbl.com/search/label/dnsbl.inps.de
222                         Today, May 25, 2020, he has announced that it is shutting down, due to concerns around GDPR and personal challenges brought on by the coronavirus pandemic.
223                 https://docs.hetrixtools.com/dnsbl-inps-de-removed-from-our-system/
224                         [May 29,2018] IPv4 RBL dnsbl.inps.de has been removed from our system, as they have decided to discontinue the RBL project for the time being.
225                 https://glockapps.com/blacklist/dnsbl-inps-de/
226                         Today, May 25, 2020, he has announced that it is shutting down, due to concerns around GDPR and personal challenges brought on by the coronavirus pandemic.
227                 https://www.dnsbl.info/dnsbl-details.php?dnsbl=dnsbl.inps.de
228                         This blacklist is offline as of May 1, 2020.
229                 https://web.archive.org/web/20220428013500/http://www.inps.de/
230 00_NEEDS_RESEARCH
231         bl.tiopan.com
232         blocked.hilli.dk
233         dialups.visi.com
234         dnsbl.antispam.or.id
235         dob.sibl.support-intelligence.net
236         intruders.docs.uu.se
237         map.spam-rbl.com
238         rbl.triumf.ca
239         all.s5h.net
240                 http://www.usenix.org.uk/content/rbl.html
241         torexit.dan.me.uk
242         http://pedantic.org/
243                 as of 20140701
244         rbl.fasthosts.co.uk
245                 https://help.fasthosts.co.uk/app/answers/detail/a_id/140/kw/rbl
246                 seems dead?
247                 https://antispam.fasthosts.co.uk/
248 00_ALIVE
249         00_RECONSIDER
250                 http://barracudacentral.org/rbl
251                         requires account with extensive information (more than spamhaus e.g.):
252                                 your name.
253                                 your company name.
254                                 your phone number.
255                                 your address.
256                                 your city name.
257                                 your state/province name.
258                                 your zip/postal code.
259                                 the name of the alternate contact.
260                                 the phone number of the alternate contact.
261                                 the email address of the alternate contact.
262                         seems well documented
263         00_E_EVIL
264                 sbl.nszones.com
265                         http://www.spamhaus.org/organization/statement/008/fake-dnsbl-uncovered-nszones.com
266         00_E_INFORMATION
267                 blacklist.sci.kun.nl
268                         https://cncz.science.ru.nl/en/howto/email-spam/
269                         not really its own DNSBL?
270                         no usage information
271                         no usage policy
272                 http://anonmails.de/
273                         seems serious but missing necessary info
274                                 usage policy
275                                 listing policy
276                 http://blacklist.jippg.org/
277                         no usage policy
278                         no listing policy
279                         no return code info
280                 bip.virusfree.cz
281                         used by rspamd
282                         https://www.virusfree.cz/en/help is the only place I can find any official reference to this list at all but no policies or usage information
283                 https://www.nixspam.net/
284                         previously http://www.dnsbl.manitu.net/
285                         query zone: ix.dnsbl.manitu.net
286                         provided by the reputable german publisher 'heise' which makes the high quality c’t, iX, and telepolis magacines
287                         difficult to find info regarding listing policy
288                         asked for more information to be added
289                                 https://www.heise.de/forum/iX/Kommentare/Gemeinsam-stark/Nutzungsbedingungen-Return-Codes-sonstige-Infos/posting-42669177/show/
290                 access.redhawk.org
291                         website works but barely any info, not even how to query it
292                         https://www.redhawk.org/?p=64
293                         https://www.redhawk.org/SpamHawk/index.php
294                 https://senderscore.org/
295                         requires registration?
296                         Scam? http://www.complaintsboard.com/complaints/buyer-beware-senderscoreorg-is-a-scam-c276871.html
297                         https://senderscore.org/assess/blocklist-lookup/
298                         FAQ: https://knowledge.validity.com/hc/en-us/articles/360006992592-Return-Path-Blocklist-RPBL-FAQ-
299                         no information how to query found
300                 mail-abuse.org
301                         https://ers.trendmicro.com/
302                         trendmicro paid service
303                         https://docs.trendmicro.com/en-us/enterprise/email-reputation-services-online-help/getting-started_001/configuring-email-re/creating-an-account.aspx
304                                 »If you don’t create an account, you can still query the reputation of an IP address«
305                         I don’t find any pricing or usage information
306                 http://dnsbl.tornevall.org/
307                         https://www.tornevall.net/
308                         related to https://www.fraudbl.org/
309                         seems a bit unstructured and not very well documented
310                                 I can’t be arsed to deal with confluence slowing my browser to a halt repeatedly and it’s really hard to navigate but there seems to be some information on https://docs.tornevall.net/display/TORNEVALL/Endpoint%3A+dnsbl+-+DNSBL+v5+with+API+v3
311                         seems active
312                 http://rbl.schulte.org/
313                         seems active
314                         listing policy seems to be: they received spam from an IP
315                         usage policy: Anyone can use this RBL list [sic]
316                         return codes: probably boolean, i.e. either listed or not
317                 http://relaytest.kundenserver.de/
318                         by 1und1 (now ionos?), used internally
319                         https://www.blalert.com/dnsbl/relays.bl.kundenserver.de
320                         no usage policy found
321                         no listing policy found
322                         no return code explanation found
323         00_E_PAID
324         00_E_PRIVATE
325                 88.blacklist.zap
326                         http://blogs.technet.com/b/fss/archive/2009/05/08/forefront-dnsbl-yeah-or-nay.aspx
327                         https://web.archive.org/web/20150812003556/http://blogs.technet.com/b/fss/archive/2009/05/08/forefront-dnsbl-yeah-or-nay.aspx
328                         https://www.blalert.com/dnsbl/88.blacklist.zap
329                                 88.blacklist.zap is an internal blacklist maintained by Microsoft's Forefront
330                         https://www.dnsbl.com/search/label/frontbridge
331                 http://drmx.org/
332                         »Use of any DrMX.ORG DNS Zone is by request and by contract only.«
333                 rbl.tdk.net
334                         tdk.net seems dead on http(s)
335                         private
336                                 https://www.blalert.com/dnsbl/rbl.tdk.net
337                         old link: http://postmaster.tdc.dk/publish.php?id=31787
338                                 tdc.dk redirects to yousee.dk
339                                 https://web.archive.org/web/20170703084224/http://postmaster.tdc.dk/publish.php?id=31787
340                 rbl.zenon.net
341                         private
342                                 https://www.blalert.com/dnsbl/rbl.zenon.net
343                         http://www.noc.zenon.net/rbl/
344                         russian(?)
345                 https://ahbl.org/
346                         was public until 2015
347                         now private, invite-only
348         http://rfc-clueless.org/
349                 lists domains
350                         that do not adhere to common best practices or requirements
351                 does NOT list spammers!
352                 listing criteria are explained well
353                         http://rfc-clueless.org/pages/listing_policy
354                 return codes are explained
355                         http://rfc-clueless.org/
356                 usage policy is not so clear but the FAQ implies that it’s just free to use for everyone
357                 many timeouts
358                         first noticed in 2014 and deactivated
359                         retried in 2023 and still the case
360         http://spameatingmonkey.com/
361                 lists IPs
362                         that sent backscatter
363                         that sent to spamtrap
364                         added by policy
365                                 this includes dial-up!
366                                 https://spameatingmonkey.com/faq/policy-based-listing
367                 lists domains/URIs
368                         by age
369                         in spam bodies
370                 usage policy seems clear
371                         https://spameatingmonkey.com/faq/query-limits
372                 listing policy seems clear
373                         https://spameatingmonkey.com/services
374                 return codes documented
375                         https://spameatingmonkey.com/services
376                 http://blogspambl.com/
377                         redirects to spameatingmonkey.com
378         http://uribl.com/
379                 lists domains/URIs
380                         that appear in spam bodies
381                         has whitelist
382                 lists IPs
383                         that URIs in spam bodies resolve to
384                 return codes are documented
385                         https://uribl.com/about.shtml#implementation
386                         bitmasked
387                         127.0.0.1 is used to signal abusive query behaviour
388         http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists
389                 called "hostkarma"
390                 lists domains/URIs
391                 lists IPs
392                 usage policy is relatively clear that it’s free, except maybe for big for-profit oranizations
393                 listing policy is documented
394                 return codes are documented
395                 seems very trustworthy
396         http://www.sorbs.net/
397                 good reputation
398                 lists domains/URIs
399                 lists IPs
400                 usage policy is clear that it’s free
401                 listing policy is documented
402                 return codes are documented
403                 seems trustworthy
404         http://www.spamhaus.org/
405                 good reputation
406                 very well done
407                 seems very professional
408                 lists domains/URIs
409                 lists IPs
410                 usage policy is clear
411                         https://www.spamhaus.org/organization/dnsblusage/
412                 listing policies are clearly documented
413                 return codes are clearly documented
414         http://www.surbl.org/
415                 good reputation
416                 lists domains/URIs
417                 usage policy is clear
418                         https://surbl.org/usage-policy
419                 listing policy is documented
420                 return codes are documented
421                         bitmasked
422                         127.0.0.1 means blocked
423         http://zapbl.net/
424                 lists domains/URIs
425                 lists IPs
426                 listing policy seems clear
427                         https://zapbl.net/policy
428                 usage policy seems clearly free for everyone
429                         https://zapbl.net/using
430                 return codes are documented
431                 seems well done
432         https://rbl.foobar.hu/
433                 lists domains/URIs
434                 lists IPs
435                 listing policy seems clear
436                 usage policy seems clearly free for everyone
437                 return codes are documented
438                 possibly unmaintained or dead
439                         footer says: ©2013-14
440         http://apews.org/?page=filter
441                 questionable
442                         https://www.dnsbl.com/search/label/apews
443                         https://whatismyipaddress.com/apews
444                 dead?
445                         no news on http://apews-user.blogspot.com/ since 2014
446                 not further looked into because of the above
447         https://www.dnswl.org/
448                 seems to be run with best intentions but has had issues from what I have heard from some users
449                 IRC channel has some activity
450                 usage policy relatively clear
451                         free within certain limits
452                 listing policy
453                         self-service
454                 return codes are documented
455         00_E_FOCUS
456                 https://www.dnsblchile.org/index.en.html
457                         chilenian spam so not interesting for me
458                         seems alive
459         00_LISTS_BLOGSPAMMERS
460                 https://www.madavi.de/madavibl/
461                         »This blacklist should only be used to block comment spammer (on blogs and websites). Don’t use it for mail.«
462                 http://bsb.empty.us/
463                         does not exist anymore
464                         empty.us returns »Nothing here, obviously.«
465         00_LISTS_COUNTRIES
466                 korea
467                         http://korea.services.net/
468         00_LISTS_DIALUPS
469         00_LISTS_OPENRESOLVERS
470         00_LISTS_TORNODES
471                 https://www.dan.me.uk/dnsbl
472         https://0spam.org/
473                 clear information on usage policy
474                         Nothing. The 0Spam Project is absolutely free for email providers, IT professionals and general removal request.
475                         DNSBL service and removals are 100% for free for all uses; commercial, non profit and personal.
476                 seems serious
477                 listing policies are a little less clear
478                         bl.0spam.org DNSBL | 0spam Spam Trap Primary Database
479                         nbl.0spam.org Network Black List | Spam Source Networks, high volume of spam trap hits in a Class C block will result in network listings in this DNSBL.
480                         url.0spam.org URL Black List | This list contains the IP address of domains found to be in the source of spam emails found in our traps.
481                 return codes not very clear
482         https://abuse.ro/
483                 policy
484                         spamtraps
485                         The last IP address before destination in the email headers is listed into rbl.abuse.ro list.
486                         Sender domains are analyzed and if confirmed to be not spoofed, are listed into dbl.abuse.ro list
487                         Spamvertized domains (including those indirectly linked through services like bit.ly) are listed into uribl.abuse.ro list
488         http://dronebl.org/
489                 usage policy is clear: free for whatever
490                 listing policy is not quite so clear
491                         can be mostly inferred from the classes but not entirely clear IMHO
492                 has an IRC channel
493                 return codes
494                         not explicitly mentioned but it’s 127.0.0.X where X is the class from https://dronebl.org/classes
495         http://psbl.org/
496                 query zone: psbl.surriel.com
497                 no usage policy, but seems implied that usage is free
498                 listing policy
499                         no explicit, complete policy given but sending to spamtraps is mentioned to get you listed and seems the exclusive mechanism
500                 return codes
501                         not documented, probably only boolean
502         http://rbldata.interserver.net/
503                 listing policy more or less clear
504                 usage policy not given but since usage is explained it’s probably free for all
505                 return codes seem to be binary, i.e. either listed or not
506                 lists IPs
507                 lists domains/URIs
508         http://rv-soft.info/
509                 usage policy not explicit but seems to be free
510                 listing policy also not explicit but can be inferred from return code explanation
511                 return codes are explained
512         http://spamrats.com/
513         http://spamstinks.com/
514         http://st.technovision.dk/
515         http://tor.efnet.org/
516                 http://rbl.efnetrbl.org/ MIRROR
517         http://v4bl.org/
518         http://virbl.bit.nl/
519         http://wpbl.info/
520         http://www.aupads.org/
521         http://www.backscatterer.org/
522                 fragwuerdige policy - bezahlen fuer schnelleres delisting
523         http://www.blockedservers.com/
524         http://www.blocklist.de/en/index.html
525         http://www.emailbasura.org/cgi-bin/emailbasura-ini.pl?lang=eng
526         http://www.gbudb.com/truncate/
527         http://www.justspam.org/
528         http://www.kempt.net/dnsbl/
529         http://www.leadmon.net/spamguard/
530         http://www.spamcop.net/
531                 good policy
532                 good reputation
533         http://www.spamsources.fabel.dk/
534                 sensible policy
535         http://www.srntools.com/blacklist/
536         http://www.uceprotect.net/en/index.php
537         https://bl.konstant.no/
538         https://choon.net/rbl.php
539         https://www.abuse.ch/
540                 https://www.abuse.ch/?tag=httpbl
541         https://www.kisarbl.or.kr/
542         https://www.megarbl.net/
543         https://www.team-cymru.org/Services/Bogons/dns.html
544         http://mailspike.net/usage.html
545                 reputation-based
546         http://www.whitelisted.org/
547                 paid subscription
548                 policy on site
549         https://puck.nether.net/or/
550                 policies on website
551         http://www.isipp.com/email-accreditation/iadb-query-instruction/
552                 requires signup
553                 not quite a usage policy, but seems ok
554                 strange split of ipv4 and ipv6
555                 seems dead?