]> git.netwichtig.de Git - user/henk/docs/dnsbl_notes.git/blob - dnslists.otl
update st.technovision.dk
[user/henk/docs/dnsbl_notes.git] / dnslists.otl
1 TODO
2         check and link (de)listing policy
3                 NOGO: delisting for money
4         check and link usage policy
5         check and link return codes
6         find newsfeed or mailinglist
7         give feedback?
8         implement in exim
9         implement in SA
10         implement in rspamd
11 00_META
12         https://bugs.launchpad.net/ubuntu/+source/amispammer/+bug/835614
13         http://www.blalert.com/dnsbls
14         http://www.dnsbl.info/dnsbl-list.php
15         http://dnsbl.inps.de/index.cgi?lang=en&site=00002
16         http://www.sdsc.edu/~jeff/spam/cbc.html
17         http://moensted.dk/spam/
18         https://whatismyipaddress.com/blacklist-check
19         https://multirbl.valli.org/
20         https://glockapps.com/blacklist/
21         https://docs.hetrixtools.com/monitored-blacklists/
22         https://www.blacklistmaster.com/
23         https://knowledge.validity.com/hc/en-us/sections/204468388-Blocklists
24         https://github.com/zbetcheckin/DNSBLs
25         https://en.wikipedia.org/wiki/Comparison_of_DNS_blacklists
26         https://www.impressionwise.com/kb/threats/rbl-advisories.html
27 00_ELANG
28         http://dnsbl.aspnet.hu/
29                 hungarian?
30         http://spam-rbl.fr/
31                 french
32         https://mav.com.br/
33                 maybe? they have antispam but it’s all portugese? or spanish? no idea
34 00_DEAD
35         http://openrbl.org/
36                 as seems dead
37                         404s
38                         wiki is down
39         http://mailhosts.org/
40                 dead
41                         https://www.blalert.com/dnsbl/shortlist.mailhosts.org
42         blitzed.org
43                 dead since 2006
44                         https://www.dnsbl.com/2007/02/status-of-opmblitzedorg-dead.html
45                                 referenced ML post is 404
46         blackholes.five-ten-sg.com
47                 Offline as of 1/1/2013
48                         https://whatismyipaddress.com/five-ten-sg
49         dynip.rothen.com
50                 On 9/29/2020 the ROTHEN blacklist appears to have started to list the entire internet
51                         https://www.dnsbl.info/dnsbl-details.php?dnsbl=dynip.rothen.com
52         fl.chickenboner.biz
53                 dead since 2011
54                         https://community.spiceworks.com/topic/329762-blacklist-removal
55                         https://bugs.launchpad.net/ubuntu/+source/amispammer/+bug/835614
56                 website contains spam/crap
57         http://cart00ney.surriel.com/
58                 cart00ney.org is dead
59         http://dsbl.org/
60                 points to surriel.com
61         http://csma.biz/
62                 domain is for sale
63                 dead since 2013
64                         https://www.dnsbl.com/2013/02/status-of-blcsmabiz-dead.html
65         http://dnsbl.net.au/
66                 website contains info about living in australia? called "AusBlog"
67                 http://www.dnsbl.com/2009/04/status-of-dnsblnetau-dead.html
68         http://moensted.dk/spam/
69                 dead since 2010
70                 https://moensted.dk/spam/
71         http://rbl.mw-internet.net/
72                 domain was parked
73                 2023: it is an asian(?) gambling(?) website
74         http://www.blackholes.us/
75                 dead since 2009
76                         https://www.dnsbl.com/2009/10/status-of-blackholesus-dead.html
77         http://www.deadbeef.com/
78                 dead, no info
79         spamsources.dnsbl.info
80                 dead since 2011 or so
81                         http://www.dnsbl.info/spamsources-dnsbl-defunct.php
82         http://www.gweep.ca/
83                 domain dead, no other info
84         http://www.njabl.org/
85                 dead since 2013
86                         https://en.wikipedia.org/wiki/Not_Just_Another_Bogus_List
87         http://wytnij.to/
88                 website parked, no other info
89         https://www.transip.nl/
90                 dead since 2013
91                         https://www.blalert.com/dnsbl/proxy.block.transip.nl
92                         https://www.blalert.com/dnsbl/residential.block.transip.nl
93         pss.spambusters.org.ar
94                 NXDOMAIN
95         rbl.snark.net
96                 NXDOMAIN
97                 https://snark.net/ gives access denied
98         whois.rfc-ignorant.org
99                 NXDOMAIN
100                 rfc-ignorant.org registered but no A/AAAA record
101                 dead since 2012
102                         http://www.h-online.com/security/news/item/RFC-Ignorant-org-blacklist-closes-down-1724814.html
103                         https://www.dnsbl.com/2012/09/status-of-rfc-ignorantorg-shutting-down.html
104         will-spam-for-food.eu.org
105                 unmaintained
106                 dead
107                         https://rfc1149.net/blog/2012/01/22/who-did-resurrect-will-spam-for-food/
108         http://proxybl.org/
109                 dead, seemingly written on http://proxybl.org/blog but that’s also dead
110                 https://linuxreviews.org/Mail_Spam_Blacklists
111                 https://community.sophos.com/utm-firewall/f/web-server-security/50273/dnsbl-proxybl-org-offline
112         dev.null.dk
113                 timeout, also on the parent null.dk
114                 effectively dead
115         dnsbl.mags.net
116                 seems dead, no info to be found
117                 domain does not respond
118         http://msrbl.blogspot.ch/
119                 http://msrbl.blogspot.com/ says "no updates" since 2010 but supposed to be reactivated
120                 effectively dead
121         http://www.olsentech.net/
122                 strange content on web
123                 effectively dead
124         rbl.orbitrbl.com
125                 http://www.orbitrbl.com/
126                 timeout
127         rbl.polarcomm.net
128                 NXDOMAIN
129                 registered but no A/AAAA record
130         cidr.bl.mcafee.com
131                 https://kc.mcafee.com/corporate/index?page=content&id=KB53783
132                         404
133                 no info to be found
134                 dead?
135         http://anti-spam.org.cn/?locale=en_US
136                 unreachable DNS
137         rbl.talkactive.net
138                 seems dead
139                 talkactive.net redirects twice to some hosting company
140                 last listings in 2017
141                         https://multirbl.valli.org/detail/rbl.talkactive.net.html
142                         https://www.blacklistmaster.com/blacklists?view=details&blacklist=rbl.talkactive.net
143         dnsbl.ipocalypse.net
144                 no policies published
145                 dead
146                         was a private list of an irc network
147                         network was renamed idlechat.net in 2014
148                         became a discord chat in 2022(?)
149         http://blakjak.net/RBL
150                 external access disabled
151                 2023: seems dead, website is a weird error
152                 https://www.blalert.com/dnsbl/rbl.blakjak.net
153                         This is a private list that we do not monitor as the maintainer has explicity announced that the list is for his personal use
154         http://cyberlogic.net/
155                 french (canada)
156                 https://www.dnsbl.info/dnsbl-details.php?dnsbl=dnsbl.cyberlogic.net
157                         On or about 5/21/2018 the cyberlogic DNSBL ceased functioning properly.
158                 https://www.dnsbl.com/2018/05/
159                         As reported on the mailop mailing list on Friday May 25, 2018, the blocking list at dnsbl.cyberlogic.net now contains a "wildcard" DNS entry, effectively listing the entire internet
160         http://www.rbl.jp/allrbl-e.html
161                 website asks for login or just errors
162         http://www.spamhauswhitelist.com/en/
163                 looks like a parked domain with ads
164         http://stopspam.org/rblcheck/index.php
165                 aka dul.pacifier.net
166                 http://www.stopspam.org/rbl-info/
167                         stopped in 2013
168         http://countries.nerd.dk/
169                 unable to connect, also for nerd.dk
170         http://dul.ru/dul.en.html
171                 DEAD for sale
172         http://dns.measurement-factory.com/surveys/openresolvers.html
173                 dead
174                         »The following text describes past open DNS resolver surveys and an associated DNS lookup service that has been long shut down«
175         http://www.sectoor.de/tor.php
176                 timeouts
177         http://anticaptcha.net/
178                 for sale
179         http://blacklist.lashback.com/
180                 query zone: ubl.unsubscore.com
181                 provider’s website https://lashback.com/ seems alive and active (news entries from 2023) but does not link to the blacklist
182                 rsync URLs seem dead, so does the download url
183         http://blacklist.woody.ch/
184                 no entries in the displayed "top 100"
185                 may have been absorbed into the swinog blacklists, see antispam.imp.ch
186         http://cbl.abuseat.org/
187                 https://www.abuseat.org/
188                         changes to the CBL that occured in January 2021. In short, the CBL infrastructure was replaced by the Spamhaus XBL structure
189         http://dnsbl.burnt-tech.com/
190                 domain is for sale
191         http://rbl.dns-servicios.com/rbl.php
192                 website can not be found
193         http://spamcannibal.org/
194                 dead, as of at least 2018
195         http://st.technovision.dk/
196                 https://docs.hetrixtools.com/st-technovision-dk-inactive-removed/
197                         [December 8, 2021] This RBL has stopped responding to DNS queries.
198 00_NEEDS_RECHECK
199         https://antispam.imp.ch/
200                 no usage policy
201                 no return code info
202                 no good listing policy
203                 information received from inquiry to provider
204                         website will be updated
205                         return codes
206                                 dnsrbl.swinog.ch and uribl.swinog.ch (holding time increases with hits)
207                                         127.0.1.8 = default
208                                         127.0.0.10 => TRAP (Email sent to a spamtrap)
209                                         127.0.0.11 => REPO (Email reported as Spam by customer)
210                                 spamrbl.imp.ch (3 days holding time)
211                                         IPs are listed when trying to send mail to the spamtrap mailserver
212                                         MD5 hash: attachment sent to the swinog blacklist
213                                 wormrbl.imp.ch
214                                         DEAD
215         http://blacklist.woody.ch/rblcheck.php3
216                 dead?
217                 waiting for feedback
218         http://dnsbl.iip.lu/
219                 https://docs.hetrixtools.com/lookup-dnsbl-iip-lu-false-positive-removed/
220                         in 2016: lookup.dnsbl.iip.lu blacklist started issuing false positive responses and upon further investigation looks to be abandoned/dead.
221                 https://www.blalert.com/dnsbl/lookup.dnsbl.iip.lu
222                         This blacklist is marked as "shut down" and non-operational as of 2017-12-31.
223         http://dnsbl.inps.de/
224                 timeout
225                 https://www.dnsbl.com/search/label/dnsbl.inps.de
226                         Today, May 25, 2020, he has announced that it is shutting down, due to concerns around GDPR and personal challenges brought on by the coronavirus pandemic.
227                 https://docs.hetrixtools.com/dnsbl-inps-de-removed-from-our-system/
228                         [May 29,2018] IPv4 RBL dnsbl.inps.de has been removed from our system, as they have decided to discontinue the RBL project for the time being.
229                 https://glockapps.com/blacklist/dnsbl-inps-de/
230                         Today, May 25, 2020, he has announced that it is shutting down, due to concerns around GDPR and personal challenges brought on by the coronavirus pandemic.
231                 https://www.dnsbl.info/dnsbl-details.php?dnsbl=dnsbl.inps.de
232                         This blacklist is offline as of May 1, 2020.
233                 https://web.archive.org/web/20220428013500/http://www.inps.de/
234 00_NEEDS_RESEARCH
235         bl.tiopan.com
236         blocked.hilli.dk
237         dialups.visi.com
238         dnsbl.antispam.or.id
239         dob.sibl.support-intelligence.net
240         intruders.docs.uu.se
241         map.spam-rbl.com
242         rbl.triumf.ca
243         all.s5h.net
244                 http://www.usenix.org.uk/content/rbl.html
245         torexit.dan.me.uk
246         http://pedantic.org/
247                 as of 20140701
248         rbl.fasthosts.co.uk
249                 https://help.fasthosts.co.uk/app/answers/detail/a_id/140/kw/rbl
250                 seems dead?
251                 https://antispam.fasthosts.co.uk/
252 00_ALIVE
253         00_RECONSIDER
254                 http://barracudacentral.org/rbl
255                         requires account with extensive information (more than spamhaus e.g.):
256                                 your name.
257                                 your company name.
258                                 your phone number.
259                                 your address.
260                                 your city name.
261                                 your state/province name.
262                                 your zip/postal code.
263                                 the name of the alternate contact.
264                                 the phone number of the alternate contact.
265                                 the email address of the alternate contact.
266                         seems well documented
267         00_E_EVIL
268                 sbl.nszones.com
269                         http://www.spamhaus.org/organization/statement/008/fake-dnsbl-uncovered-nszones.com
270         00_E_INFORMATION
271                 blacklist.sci.kun.nl
272                         https://cncz.science.ru.nl/en/howto/email-spam/
273                         not really its own DNSBL?
274                         no usage information
275                         no usage policy
276                 http://anonmails.de/
277                         seems serious but missing necessary info
278                                 usage policy
279                                 listing policy
280                 http://blacklist.jippg.org/
281                         no usage policy
282                         no listing policy
283                         no return code info
284                 bip.virusfree.cz
285                         used by rspamd
286                         https://www.virusfree.cz/en/help is the only place I can find any official reference to this list at all but no policies or usage information
287                 https://www.nixspam.net/
288                         previously http://www.dnsbl.manitu.net/
289                         query zone: ix.dnsbl.manitu.net
290                         provided by the reputable german publisher 'heise' which makes the high quality c’t, iX, and telepolis magacines
291                         difficult to find info regarding listing policy
292                         asked for more information to be added
293                                 https://www.heise.de/forum/iX/Kommentare/Gemeinsam-stark/Nutzungsbedingungen-Return-Codes-sonstige-Infos/posting-42669177/show/
294                 access.redhawk.org
295                         website works but barely any info, not even how to query it
296                         https://www.redhawk.org/?p=64
297                         https://www.redhawk.org/SpamHawk/index.php
298                 https://senderscore.org/
299                         requires registration?
300                         Scam? http://www.complaintsboard.com/complaints/buyer-beware-senderscoreorg-is-a-scam-c276871.html
301                         https://senderscore.org/assess/blocklist-lookup/
302                         FAQ: https://knowledge.validity.com/hc/en-us/articles/360006992592-Return-Path-Blocklist-RPBL-FAQ-
303                         no information how to query found
304                 mail-abuse.org
305                         https://ers.trendmicro.com/
306                         trendmicro paid service
307                         https://docs.trendmicro.com/en-us/enterprise/email-reputation-services-online-help/getting-started_001/configuring-email-re/creating-an-account.aspx
308                                 »If you don’t create an account, you can still query the reputation of an IP address«
309                         I don’t find any pricing or usage information
310                 http://dnsbl.tornevall.org/
311                         https://www.tornevall.net/
312                         related to https://www.fraudbl.org/
313                         seems a bit unstructured and not very well documented
314                                 I can’t be arsed to deal with confluence slowing my browser to a halt repeatedly and it’s really hard to navigate but there seems to be some information on https://docs.tornevall.net/display/TORNEVALL/Endpoint%3A+dnsbl+-+DNSBL+v5+with+API+v3
315                         seems active
316                 http://rbl.schulte.org/
317                         seems active
318                         listing policy seems to be: they received spam from an IP
319                         usage policy: Anyone can use this RBL list [sic]
320                         return codes: probably boolean, i.e. either listed or not
321                 http://relaytest.kundenserver.de/
322                         by 1und1 (now ionos?), used internally
323                         https://www.blalert.com/dnsbl/relays.bl.kundenserver.de
324                         no usage policy found
325                         no listing policy found
326                         no return code explanation found
327         00_E_PAID
328         00_E_PRIVATE
329                 88.blacklist.zap
330                         http://blogs.technet.com/b/fss/archive/2009/05/08/forefront-dnsbl-yeah-or-nay.aspx
331                         https://web.archive.org/web/20150812003556/http://blogs.technet.com/b/fss/archive/2009/05/08/forefront-dnsbl-yeah-or-nay.aspx
332                         https://www.blalert.com/dnsbl/88.blacklist.zap
333                                 88.blacklist.zap is an internal blacklist maintained by Microsoft's Forefront
334                         https://www.dnsbl.com/search/label/frontbridge
335                 http://drmx.org/
336                         »Use of any DrMX.ORG DNS Zone is by request and by contract only.«
337                 rbl.tdk.net
338                         tdk.net seems dead on http(s)
339                         private
340                                 https://www.blalert.com/dnsbl/rbl.tdk.net
341                         old link: http://postmaster.tdc.dk/publish.php?id=31787
342                                 tdc.dk redirects to yousee.dk
343                                 https://web.archive.org/web/20170703084224/http://postmaster.tdc.dk/publish.php?id=31787
344                 rbl.zenon.net
345                         private
346                                 https://www.blalert.com/dnsbl/rbl.zenon.net
347                         http://www.noc.zenon.net/rbl/
348                         russian(?)
349                 https://ahbl.org/
350                         was public until 2015
351                         now private, invite-only
352         http://rfc-clueless.org/
353                 lists domains
354                         that do not adhere to common best practices or requirements
355                 does NOT list spammers!
356                 listing criteria are explained well
357                         http://rfc-clueless.org/pages/listing_policy
358                 return codes are explained
359                         http://rfc-clueless.org/
360                 usage policy is not so clear but the FAQ implies that it’s just free to use for everyone
361                 many timeouts
362                         first noticed in 2014 and deactivated
363                         retried in 2023 and still the case
364         http://spameatingmonkey.com/
365                 lists IPs
366                         that sent backscatter
367                         that sent to spamtrap
368                         added by policy
369                                 this includes dial-up!
370                                 https://spameatingmonkey.com/faq/policy-based-listing
371                 lists domains/URIs
372                         by age
373                         in spam bodies
374                 usage policy seems clear
375                         https://spameatingmonkey.com/faq/query-limits
376                 listing policy seems clear
377                         https://spameatingmonkey.com/services
378                 return codes documented
379                         https://spameatingmonkey.com/services
380                 http://blogspambl.com/
381                         redirects to spameatingmonkey.com
382         http://uribl.com/
383                 lists domains/URIs
384                         that appear in spam bodies
385                         has whitelist
386                 lists IPs
387                         that URIs in spam bodies resolve to
388                 return codes are documented
389                         https://uribl.com/about.shtml#implementation
390                         bitmasked
391                         127.0.0.1 is used to signal abusive query behaviour
392         http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists
393                 called "hostkarma"
394                 lists domains/URIs
395                 lists IPs
396                 usage policy is relatively clear that it’s free, except maybe for big for-profit oranizations
397                 listing policy is documented
398                 return codes are documented
399                 seems very trustworthy
400         http://www.sorbs.net/
401                 good reputation
402                 lists domains/URIs
403                 lists IPs
404                 usage policy is clear that it’s free
405                 listing policy is documented
406                 return codes are documented
407                 seems trustworthy
408         http://www.spamhaus.org/
409                 good reputation
410                 very well done
411                 seems very professional
412                 lists domains/URIs
413                 lists IPs
414                 usage policy is clear
415                         https://www.spamhaus.org/organization/dnsblusage/
416                 listing policies are clearly documented
417                 return codes are clearly documented
418         http://www.surbl.org/
419                 good reputation
420                 lists domains/URIs
421                 usage policy is clear
422                         https://surbl.org/usage-policy
423                 listing policy is documented
424                 return codes are documented
425                         bitmasked
426                         127.0.0.1 means blocked
427         http://zapbl.net/
428                 lists domains/URIs
429                 lists IPs
430                 listing policy seems clear
431                         https://zapbl.net/policy
432                 usage policy seems clearly free for everyone
433                         https://zapbl.net/using
434                 return codes are documented
435                 seems well done
436         https://rbl.foobar.hu/
437                 lists domains/URIs
438                 lists IPs
439                 listing policy seems clear
440                 usage policy seems clearly free for everyone
441                 return codes are documented
442                 possibly unmaintained or dead
443                         footer says: ©2013-14
444         http://apews.org/?page=filter
445                 questionable
446                         https://www.dnsbl.com/search/label/apews
447                         https://whatismyipaddress.com/apews
448                 dead?
449                         no news on http://apews-user.blogspot.com/ since 2014
450                 not further looked into because of the above
451         https://www.dnswl.org/
452                 seems to be run with best intentions but has had issues from what I have heard from some users
453                 IRC channel has some activity
454                 usage policy relatively clear
455                         free within certain limits
456                 listing policy
457                         self-service
458                 return codes are documented
459         00_E_FOCUS
460                 https://www.dnsblchile.org/index.en.html
461                         chilenian spam so not interesting for me
462                         seems alive
463         00_LISTS_BLOGSPAMMERS
464                 https://www.madavi.de/madavibl/
465                         »This blacklist should only be used to block comment spammer (on blogs and websites). Don’t use it for mail.«
466                 http://bsb.empty.us/
467                         does not exist anymore
468                         empty.us returns »Nothing here, obviously.«
469         00_LISTS_COUNTRIES
470                 korea
471                         http://korea.services.net/
472         00_LISTS_DIALUPS
473         00_LISTS_OPENRESOLVERS
474         00_LISTS_TORNODES
475                 https://www.dan.me.uk/dnsbl
476         https://0spam.org/
477                 clear information on usage policy
478                         Nothing. The 0Spam Project is absolutely free for email providers, IT professionals and general removal request.
479                         DNSBL service and removals are 100% for free for all uses; commercial, non profit and personal.
480                 seems serious
481                 listing policies are a little less clear
482                         bl.0spam.org DNSBL | 0spam Spam Trap Primary Database
483                         nbl.0spam.org Network Black List | Spam Source Networks, high volume of spam trap hits in a Class C block will result in network listings in this DNSBL.
484                         url.0spam.org URL Black List | This list contains the IP address of domains found to be in the source of spam emails found in our traps.
485                 return codes not very clear
486         https://abuse.ro/
487                 policy
488                         spamtraps
489                         The last IP address before destination in the email headers is listed into rbl.abuse.ro list.
490                         Sender domains are analyzed and if confirmed to be not spoofed, are listed into dbl.abuse.ro list
491                         Spamvertized domains (including those indirectly linked through services like bit.ly) are listed into uribl.abuse.ro list
492         http://dronebl.org/
493                 usage policy is clear: free for whatever
494                 listing policy is not quite so clear
495                         can be mostly inferred from the classes but not entirely clear IMHO
496                 has an IRC channel
497                 return codes
498                         not explicitly mentioned but it’s 127.0.0.X where X is the class from https://dronebl.org/classes
499         http://psbl.org/
500                 query zone: psbl.surriel.com
501                 no usage policy, but seems implied that usage is free
502                 listing policy
503                         no explicit, complete policy given but sending to spamtraps is mentioned to get you listed and seems the exclusive mechanism
504                 return codes
505                         not documented, probably only boolean
506         http://rbldata.interserver.net/
507                 listing policy more or less clear
508                 usage policy not given but since usage is explained it’s probably free for all
509                 return codes seem to be binary, i.e. either listed or not
510                 lists IPs
511                 lists domains/URIs
512         http://rv-soft.info/
513                 usage policy not explicit but seems to be free
514                 listing policy also not explicit but can be inferred from return code explanation
515                 return codes are explained
516         http://spamrats.com/
517         http://spamstinks.com/
518         http://tor.efnet.org/
519                 http://rbl.efnetrbl.org/ MIRROR
520         http://v4bl.org/
521         http://virbl.bit.nl/
522         http://wpbl.info/
523         http://www.aupads.org/
524         http://www.backscatterer.org/
525                 fragwuerdige policy - bezahlen fuer schnelleres delisting
526         http://www.blockedservers.com/
527         http://www.blocklist.de/en/index.html
528         http://www.emailbasura.org/cgi-bin/emailbasura-ini.pl?lang=eng
529         http://www.gbudb.com/truncate/
530         http://www.justspam.org/
531         http://www.kempt.net/dnsbl/
532         http://www.leadmon.net/spamguard/
533         http://www.spamcop.net/
534                 good policy
535                 good reputation
536         http://www.spamsources.fabel.dk/
537                 sensible policy
538         http://www.srntools.com/blacklist/
539         http://www.uceprotect.net/en/index.php
540         https://bl.konstant.no/
541         https://choon.net/rbl.php
542         https://www.abuse.ch/
543                 https://www.abuse.ch/?tag=httpbl
544         https://www.kisarbl.or.kr/
545         https://www.megarbl.net/
546         https://www.team-cymru.org/Services/Bogons/dns.html
547         http://mailspike.net/usage.html
548                 reputation-based
549         http://www.whitelisted.org/
550                 paid subscription
551                 policy on site
552         https://puck.nether.net/or/
553                 policies on website
554         http://www.isipp.com/email-accreditation/iadb-query-instruction/
555                 requires signup
556                 not quite a usage policy, but seems ok
557                 strange split of ipv4 and ipv6
558                 seems dead?