]> git.netwichtig.de Git - user/henk/docs/dnsbl_notes.git/blob - dnslists.otl
add impressionwise.com blacklist overview
[user/henk/docs/dnsbl_notes.git] / dnslists.otl
1 TODO
2         check and link (de)listing policy
3                 NOGO: delisting for money
4         check and link usage policy
5         check and link return codes
6         find newsfeed or mailinglist
7         give feedback?
8         implement in exim
9         implement in SA
10         implement in rspamd
11 00_META
12         https://bugs.launchpad.net/ubuntu/+source/amispammer/+bug/835614
13         http://www.blalert.com/dnsbls
14         http://www.dnsbl.info/dnsbl-list.php
15         http://dnsbl.inps.de/index.cgi?lang=en&site=00002
16         http://www.sdsc.edu/~jeff/spam/cbc.html
17         http://moensted.dk/spam/
18         https://whatismyipaddress.com/blacklist-check
19         https://multirbl.valli.org/
20         https://glockapps.com/blacklist/
21         https://docs.hetrixtools.com/monitored-blacklists/
22         https://www.blacklistmaster.com/
23         https://knowledge.validity.com/hc/en-us/sections/204468388-Blocklists
24         https://github.com/zbetcheckin/DNSBLs
25         https://en.wikipedia.org/wiki/Comparison_of_DNS_blacklists
26         https://www.impressionwise.com/kb/threats/rbl-advisories.html
27 00_ELANG
28         http://dnsbl.aspnet.hu/
29                 hungarian?
30         http://spam-rbl.fr/
31                 french
32         https://mav.com.br/
33                 maybe? they have antispam but it’s all portugese? or spanish? no idea
34 00_DEAD
35         http://openrbl.org/
36                 as seems dead
37                         404s
38                         wiki is down
39         http://mailhosts.org/
40                 dead
41                         https://www.blalert.com/dnsbl/shortlist.mailhosts.org
42         blitzed.org
43                 dead since 2006
44                         https://www.dnsbl.com/2007/02/status-of-opmblitzedorg-dead.html
45                                 referenced ML post is 404
46         blackholes.five-ten-sg.com
47                 Offline as of 1/1/2013
48                         https://whatismyipaddress.com/five-ten-sg
49         dynip.rothen.com
50                 On 9/29/2020 the ROTHEN blacklist appears to have started to list the entire internet
51                         https://www.dnsbl.info/dnsbl-details.php?dnsbl=dynip.rothen.com
52         fl.chickenboner.biz
53                 dead since 2011
54                         https://community.spiceworks.com/topic/329762-blacklist-removal
55                         https://bugs.launchpad.net/ubuntu/+source/amispammer/+bug/835614
56                 website contains spam/crap
57         http://cart00ney.surriel.com/
58                 cart00ney.org is dead
59         http://dsbl.org/
60                 points to surriel.com
61         http://csma.biz/
62                 domain is for sale
63                 dead since 2013
64                         https://www.dnsbl.com/2013/02/status-of-blcsmabiz-dead.html
65         http://dnsbl.net.au/
66                 website contains info about living in australia? called "AusBlog"
67                 http://www.dnsbl.com/2009/04/status-of-dnsblnetau-dead.html
68         http://moensted.dk/spam/
69                 dead since 2010
70                 https://moensted.dk/spam/
71         http://rbl.mw-internet.net/
72                 domain was parked
73                 2023: it is an asian(?) gambling(?) website
74         http://www.blackholes.us/
75                 dead since 2009
76                         https://www.dnsbl.com/2009/10/status-of-blackholesus-dead.html
77         http://www.deadbeef.com/
78                 dead, no info
79         spamsources.dnsbl.info
80                 dead since 2011 or so
81                         http://www.dnsbl.info/spamsources-dnsbl-defunct.php
82         http://www.gweep.ca/
83                 domain dead, no other info
84         http://www.njabl.org/
85                 dead since 2013
86                         https://en.wikipedia.org/wiki/Not_Just_Another_Bogus_List
87         http://wytnij.to/
88                 website parked, no other info
89         https://www.transip.nl/
90                 dead since 2013
91                         https://www.blalert.com/dnsbl/proxy.block.transip.nl
92                         https://www.blalert.com/dnsbl/residential.block.transip.nl
93         pss.spambusters.org.ar
94                 NXDOMAIN
95         rbl.snark.net
96                 NXDOMAIN
97                 https://snark.net/ gives access denied
98         whois.rfc-ignorant.org
99                 NXDOMAIN
100                 rfc-ignorant.org registered but no A/AAAA record
101                 dead since 2012
102                         http://www.h-online.com/security/news/item/RFC-Ignorant-org-blacklist-closes-down-1724814.html
103                         https://www.dnsbl.com/2012/09/status-of-rfc-ignorantorg-shutting-down.html
104         will-spam-for-food.eu.org
105                 unmaintained
106                 dead
107                         https://rfc1149.net/blog/2012/01/22/who-did-resurrect-will-spam-for-food/
108         http://proxybl.org/
109                 dead, seemingly written on http://proxybl.org/blog but that’s also dead
110                 https://linuxreviews.org/Mail_Spam_Blacklists
111                 https://community.sophos.com/utm-firewall/f/web-server-security/50273/dnsbl-proxybl-org-offline
112         dev.null.dk
113                 timeout, also on the parent null.dk
114                 effectively dead
115         dnsbl.mags.net
116                 seems dead, no info to be found
117                 domain does not respond
118         http://msrbl.blogspot.ch/
119                 http://msrbl.blogspot.com/ says "no updates" since 2010 but supposed to be reactivated
120                 effectively dead
121         http://www.olsentech.net/
122                 strange content on web
123                 effectively dead
124         rbl.orbitrbl.com
125                 http://www.orbitrbl.com/
126                 timeout
127         rbl.polarcomm.net
128                 NXDOMAIN
129                 registered but no A/AAAA record
130         cidr.bl.mcafee.com
131                 https://kc.mcafee.com/corporate/index?page=content&id=KB53783
132                         404
133                 no info to be found
134                 dead?
135         http://anti-spam.org.cn/?locale=en_US
136                 unreachable DNS
137         rbl.talkactive.net
138                 seems dead
139                 talkactive.net redirects twice to some hosting company
140                 last listings in 2017
141                         https://multirbl.valli.org/detail/rbl.talkactive.net.html
142                         https://www.blacklistmaster.com/blacklists?view=details&blacklist=rbl.talkactive.net
143         dnsbl.ipocalypse.net
144                 no policies published
145                 dead
146                         was a private list of an irc network
147                         network was renamed idlechat.net in 2014
148                         became a discord chat in 2022(?)
149         http://blakjak.net/RBL
150                 external access disabled
151                 2023: seems dead, website is a weird error
152                 https://www.blalert.com/dnsbl/rbl.blakjak.net
153                         This is a private list that we do not monitor as the maintainer has explicity announced that the list is for his personal use
154         http://cyberlogic.net/
155                 french (canada)
156                 https://www.dnsbl.info/dnsbl-details.php?dnsbl=dnsbl.cyberlogic.net
157                         On or about 5/21/2018 the cyberlogic DNSBL ceased functioning properly.
158                 https://www.dnsbl.com/2018/05/
159                         As reported on the mailop mailing list on Friday May 25, 2018, the blocking list at dnsbl.cyberlogic.net now contains a "wildcard" DNS entry, effectively listing the entire internet
160         http://www.rbl.jp/allrbl-e.html
161                 website asks for login or just errors
162         http://www.spamhauswhitelist.com/en/
163                 looks like a parked domain with ads
164         http://stopspam.org/rblcheck/index.php
165                 aka dul.pacifier.net
166                 http://www.stopspam.org/rbl-info/
167                         stopped in 2013
168         http://countries.nerd.dk/
169                 unable to connect, also for nerd.dk
170         http://dul.ru/dul.en.html
171                 DEAD for sale
172         http://dns.measurement-factory.com/surveys/openresolvers.html
173                 dead
174                         »The following text describes past open DNS resolver surveys and an associated DNS lookup service that has been long shut down«
175         http://www.sectoor.de/tor.php
176                 timeouts
177         http://anticaptcha.net/
178                 for sale
179         http://blacklist.lashback.com/
180                 query zone: ubl.unsubscore.com
181                 provider’s website https://lashback.com/ seems alive and active (news entries from 2023) but does not link to the blacklist
182                 rsync URLs seem dead, so does the download url
183         http://blacklist.woody.ch/
184                 no entries in the displayed "top 100"
185                 may have been absorbed into the swinog blacklists, see antispam.imp.ch
186         http://cbl.abuseat.org/
187                 https://www.abuseat.org/
188                         changes to the CBL that occured in January 2021. In short, the CBL infrastructure was replaced by the Spamhaus XBL structure
189         http://dnsbl.burnt-tech.com/
190                 domain is for sale
191         http://rbl.dns-servicios.com/rbl.php
192                 website can not be found
193         http://spamcannibal.org/
194                 dead, as of at least 2018
195 00_NEEDS_RECHECK
196         https://antispam.imp.ch/
197                 no usage policy
198                 no return code info
199                 no good listing policy
200                 information received from inquiry to provider
201                         website will be updated
202                         return codes
203                                 dnsrbl.swinog.ch and uribl.swinog.ch (holding time increases with hits)
204                                         127.0.1.8 = default
205                                         127.0.0.10 => TRAP (Email sent to a spamtrap)
206                                         127.0.0.11 => REPO (Email reported as Spam by customer)
207                                 spamrbl.imp.ch (3 days holding time)
208                                         IPs are listed when trying to send mail to the spamtrap mailserver
209                                         MD5 hash: attachment sent to the swinog blacklist
210                                 wormrbl.imp.ch
211                                         DEAD
212         http://blacklist.woody.ch/rblcheck.php3
213                 dead?
214                 waiting for feedback
215         http://dnsbl.iip.lu/
216                 https://docs.hetrixtools.com/lookup-dnsbl-iip-lu-false-positive-removed/
217                         in 2016: lookup.dnsbl.iip.lu blacklist started issuing false positive responses and upon further investigation looks to be abandoned/dead.
218                 https://www.blalert.com/dnsbl/lookup.dnsbl.iip.lu
219                         This blacklist is marked as "shut down" and non-operational as of 2017-12-31.
220         http://dnsbl.inps.de/
221                 timeout
222                 https://www.dnsbl.com/search/label/dnsbl.inps.de
223                         Today, May 25, 2020, he has announced that it is shutting down, due to concerns around GDPR and personal challenges brought on by the coronavirus pandemic.
224                 https://docs.hetrixtools.com/dnsbl-inps-de-removed-from-our-system/
225                         [May 29,2018] IPv4 RBL dnsbl.inps.de has been removed from our system, as they have decided to discontinue the RBL project for the time being.
226                 https://glockapps.com/blacklist/dnsbl-inps-de/
227                         Today, May 25, 2020, he has announced that it is shutting down, due to concerns around GDPR and personal challenges brought on by the coronavirus pandemic.
228                 https://www.dnsbl.info/dnsbl-details.php?dnsbl=dnsbl.inps.de
229                         This blacklist is offline as of May 1, 2020.
230                 https://web.archive.org/web/20220428013500/http://www.inps.de/
231 00_NEEDS_RESEARCH
232         bl.tiopan.com
233         blocked.hilli.dk
234         dialups.visi.com
235         dnsbl.antispam.or.id
236         dob.sibl.support-intelligence.net
237         intruders.docs.uu.se
238         map.spam-rbl.com
239         rbl.triumf.ca
240         all.s5h.net
241                 http://www.usenix.org.uk/content/rbl.html
242         torexit.dan.me.uk
243         http://pedantic.org/
244                 as of 20140701
245         rbl.fasthosts.co.uk
246                 https://help.fasthosts.co.uk/app/answers/detail/a_id/140/kw/rbl
247                 seems dead?
248                 https://antispam.fasthosts.co.uk/
249 00_ALIVE
250         00_RECONSIDER
251                 http://barracudacentral.org/rbl
252                         requires account with extensive information (more than spamhaus e.g.):
253                                 your name.
254                                 your company name.
255                                 your phone number.
256                                 your address.
257                                 your city name.
258                                 your state/province name.
259                                 your zip/postal code.
260                                 the name of the alternate contact.
261                                 the phone number of the alternate contact.
262                                 the email address of the alternate contact.
263                         seems well documented
264         00_E_EVIL
265                 sbl.nszones.com
266                         http://www.spamhaus.org/organization/statement/008/fake-dnsbl-uncovered-nszones.com
267         00_E_INFORMATION
268                 blacklist.sci.kun.nl
269                         https://cncz.science.ru.nl/en/howto/email-spam/
270                         not really its own DNSBL?
271                         no usage information
272                         no usage policy
273                 http://anonmails.de/
274                         seems serious but missing necessary info
275                                 usage policy
276                                 listing policy
277                 http://blacklist.jippg.org/
278                         no usage policy
279                         no listing policy
280                         no return code info
281                 bip.virusfree.cz
282                         used by rspamd
283                         https://www.virusfree.cz/en/help is the only place I can find any official reference to this list at all but no policies or usage information
284                 https://www.nixspam.net/
285                         previously http://www.dnsbl.manitu.net/
286                         query zone: ix.dnsbl.manitu.net
287                         provided by the reputable german publisher 'heise' which makes the high quality c’t, iX, and telepolis magacines
288                         difficult to find info regarding listing policy
289                         asked for more information to be added
290                                 https://www.heise.de/forum/iX/Kommentare/Gemeinsam-stark/Nutzungsbedingungen-Return-Codes-sonstige-Infos/posting-42669177/show/
291                 access.redhawk.org
292                         website works but barely any info, not even how to query it
293                         https://www.redhawk.org/?p=64
294                         https://www.redhawk.org/SpamHawk/index.php
295                 https://senderscore.org/
296                         requires registration?
297                         Scam? http://www.complaintsboard.com/complaints/buyer-beware-senderscoreorg-is-a-scam-c276871.html
298                         https://senderscore.org/assess/blocklist-lookup/
299                         FAQ: https://knowledge.validity.com/hc/en-us/articles/360006992592-Return-Path-Blocklist-RPBL-FAQ-
300                         no information how to query found
301                 mail-abuse.org
302                         https://ers.trendmicro.com/
303                         trendmicro paid service
304                         https://docs.trendmicro.com/en-us/enterprise/email-reputation-services-online-help/getting-started_001/configuring-email-re/creating-an-account.aspx
305                                 »If you don’t create an account, you can still query the reputation of an IP address«
306                         I don’t find any pricing or usage information
307                 http://dnsbl.tornevall.org/
308                         https://www.tornevall.net/
309                         related to https://www.fraudbl.org/
310                         seems a bit unstructured and not very well documented
311                                 I can’t be arsed to deal with confluence slowing my browser to a halt repeatedly and it’s really hard to navigate but there seems to be some information on https://docs.tornevall.net/display/TORNEVALL/Endpoint%3A+dnsbl+-+DNSBL+v5+with+API+v3
312                         seems active
313                 http://rbl.schulte.org/
314                         seems active
315                         listing policy seems to be: they received spam from an IP
316                         usage policy: Anyone can use this RBL list [sic]
317                         return codes: probably boolean, i.e. either listed or not
318                 http://relaytest.kundenserver.de/
319                         by 1und1 (now ionos?), used internally
320                         https://www.blalert.com/dnsbl/relays.bl.kundenserver.de
321                         no usage policy found
322                         no listing policy found
323                         no return code explanation found
324         00_E_PAID
325         00_E_PRIVATE
326                 88.blacklist.zap
327                         http://blogs.technet.com/b/fss/archive/2009/05/08/forefront-dnsbl-yeah-or-nay.aspx
328                         https://web.archive.org/web/20150812003556/http://blogs.technet.com/b/fss/archive/2009/05/08/forefront-dnsbl-yeah-or-nay.aspx
329                         https://www.blalert.com/dnsbl/88.blacklist.zap
330                                 88.blacklist.zap is an internal blacklist maintained by Microsoft's Forefront
331                         https://www.dnsbl.com/search/label/frontbridge
332                 http://drmx.org/
333                         »Use of any DrMX.ORG DNS Zone is by request and by contract only.«
334                 rbl.tdk.net
335                         tdk.net seems dead on http(s)
336                         private
337                                 https://www.blalert.com/dnsbl/rbl.tdk.net
338                         old link: http://postmaster.tdc.dk/publish.php?id=31787
339                                 tdc.dk redirects to yousee.dk
340                                 https://web.archive.org/web/20170703084224/http://postmaster.tdc.dk/publish.php?id=31787
341                 rbl.zenon.net
342                         private
343                                 https://www.blalert.com/dnsbl/rbl.zenon.net
344                         http://www.noc.zenon.net/rbl/
345                         russian(?)
346                 https://ahbl.org/
347                         was public until 2015
348                         now private, invite-only
349         http://rfc-clueless.org/
350                 lists domains
351                         that do not adhere to common best practices or requirements
352                 does NOT list spammers!
353                 listing criteria are explained well
354                         http://rfc-clueless.org/pages/listing_policy
355                 return codes are explained
356                         http://rfc-clueless.org/
357                 usage policy is not so clear but the FAQ implies that it’s just free to use for everyone
358                 many timeouts
359                         first noticed in 2014 and deactivated
360                         retried in 2023 and still the case
361         http://spameatingmonkey.com/
362                 lists IPs
363                         that sent backscatter
364                         that sent to spamtrap
365                         added by policy
366                                 this includes dial-up!
367                                 https://spameatingmonkey.com/faq/policy-based-listing
368                 lists domains/URIs
369                         by age
370                         in spam bodies
371                 usage policy seems clear
372                         https://spameatingmonkey.com/faq/query-limits
373                 listing policy seems clear
374                         https://spameatingmonkey.com/services
375                 return codes documented
376                         https://spameatingmonkey.com/services
377                 http://blogspambl.com/
378                         redirects to spameatingmonkey.com
379         http://uribl.com/
380                 lists domains/URIs
381                         that appear in spam bodies
382                         has whitelist
383                 lists IPs
384                         that URIs in spam bodies resolve to
385                 return codes are documented
386                         https://uribl.com/about.shtml#implementation
387                         bitmasked
388                         127.0.0.1 is used to signal abusive query behaviour
389         http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists
390                 called "hostkarma"
391                 lists domains/URIs
392                 lists IPs
393                 usage policy is relatively clear that it’s free, except maybe for big for-profit oranizations
394                 listing policy is documented
395                 return codes are documented
396                 seems very trustworthy
397         http://www.sorbs.net/
398                 good reputation
399                 lists domains/URIs
400                 lists IPs
401                 usage policy is clear that it’s free
402                 listing policy is documented
403                 return codes are documented
404                 seems trustworthy
405         http://www.spamhaus.org/
406                 good reputation
407                 very well done
408                 seems very professional
409                 lists domains/URIs
410                 lists IPs
411                 usage policy is clear
412                         https://www.spamhaus.org/organization/dnsblusage/
413                 listing policies are clearly documented
414                 return codes are clearly documented
415         http://www.surbl.org/
416                 good reputation
417                 lists domains/URIs
418                 usage policy is clear
419                         https://surbl.org/usage-policy
420                 listing policy is documented
421                 return codes are documented
422                         bitmasked
423                         127.0.0.1 means blocked
424         http://zapbl.net/
425                 lists domains/URIs
426                 lists IPs
427                 listing policy seems clear
428                         https://zapbl.net/policy
429                 usage policy seems clearly free for everyone
430                         https://zapbl.net/using
431                 return codes are documented
432                 seems well done
433         https://rbl.foobar.hu/
434                 lists domains/URIs
435                 lists IPs
436                 listing policy seems clear
437                 usage policy seems clearly free for everyone
438                 return codes are documented
439                 possibly unmaintained or dead
440                         footer says: ©2013-14
441         http://apews.org/?page=filter
442                 questionable
443                         https://www.dnsbl.com/search/label/apews
444                         https://whatismyipaddress.com/apews
445                 dead?
446                         no news on http://apews-user.blogspot.com/ since 2014
447                 not further looked into because of the above
448         https://www.dnswl.org/
449                 seems to be run with best intentions but has had issues from what I have heard from some users
450                 IRC channel has some activity
451                 usage policy relatively clear
452                         free within certain limits
453                 listing policy
454                         self-service
455                 return codes are documented
456         00_E_FOCUS
457                 https://www.dnsblchile.org/index.en.html
458                         chilenian spam so not interesting for me
459                         seems alive
460         00_LISTS_BLOGSPAMMERS
461                 https://www.madavi.de/madavibl/
462                         »This blacklist should only be used to block comment spammer (on blogs and websites). Don’t use it for mail.«
463                 http://bsb.empty.us/
464                         does not exist anymore
465                         empty.us returns »Nothing here, obviously.«
466         00_LISTS_COUNTRIES
467                 korea
468                         http://korea.services.net/
469         00_LISTS_DIALUPS
470         00_LISTS_OPENRESOLVERS
471         00_LISTS_TORNODES
472                 https://www.dan.me.uk/dnsbl
473         https://0spam.org/
474                 clear information on usage policy
475                         Nothing. The 0Spam Project is absolutely free for email providers, IT professionals and general removal request.
476                         DNSBL service and removals are 100% for free for all uses; commercial, non profit and personal.
477                 seems serious
478                 listing policies are a little less clear
479                         bl.0spam.org DNSBL | 0spam Spam Trap Primary Database
480                         nbl.0spam.org Network Black List | Spam Source Networks, high volume of spam trap hits in a Class C block will result in network listings in this DNSBL.
481                         url.0spam.org URL Black List | This list contains the IP address of domains found to be in the source of spam emails found in our traps.
482                 return codes not very clear
483         https://abuse.ro/
484                 policy
485                         spamtraps
486                         The last IP address before destination in the email headers is listed into rbl.abuse.ro list.
487                         Sender domains are analyzed and if confirmed to be not spoofed, are listed into dbl.abuse.ro list
488                         Spamvertized domains (including those indirectly linked through services like bit.ly) are listed into uribl.abuse.ro list
489         http://dronebl.org/
490                 usage policy is clear: free for whatever
491                 listing policy is not quite so clear
492                         can be mostly inferred from the classes but not entirely clear IMHO
493                 has an IRC channel
494                 return codes
495                         not explicitly mentioned but it’s 127.0.0.X where X is the class from https://dronebl.org/classes
496         http://psbl.org/
497                 query zone: psbl.surriel.com
498                 no usage policy, but seems implied that usage is free
499                 listing policy
500                         no explicit, complete policy given but sending to spamtraps is mentioned to get you listed and seems the exclusive mechanism
501                 return codes
502                         not documented, probably only boolean
503         http://rbldata.interserver.net/
504                 listing policy more or less clear
505                 usage policy not given but since usage is explained it’s probably free for all
506                 return codes seem to be binary, i.e. either listed or not
507                 lists IPs
508                 lists domains/URIs
509         http://rv-soft.info/
510                 usage policy not explicit but seems to be free
511                 listing policy also not explicit but can be inferred from return code explanation
512                 return codes are explained
513         http://spamrats.com/
514         http://spamstinks.com/
515         http://st.technovision.dk/
516         http://tor.efnet.org/
517                 http://rbl.efnetrbl.org/ MIRROR
518         http://v4bl.org/
519         http://virbl.bit.nl/
520         http://wpbl.info/
521         http://www.aupads.org/
522         http://www.backscatterer.org/
523                 fragwuerdige policy - bezahlen fuer schnelleres delisting
524         http://www.blockedservers.com/
525         http://www.blocklist.de/en/index.html
526         http://www.emailbasura.org/cgi-bin/emailbasura-ini.pl?lang=eng
527         http://www.gbudb.com/truncate/
528         http://www.justspam.org/
529         http://www.kempt.net/dnsbl/
530         http://www.leadmon.net/spamguard/
531         http://www.spamcop.net/
532                 good policy
533                 good reputation
534         http://www.spamsources.fabel.dk/
535                 sensible policy
536         http://www.srntools.com/blacklist/
537         http://www.uceprotect.net/en/index.php
538         https://bl.konstant.no/
539         https://choon.net/rbl.php
540         https://www.abuse.ch/
541                 https://www.abuse.ch/?tag=httpbl
542         https://www.kisarbl.or.kr/
543         https://www.megarbl.net/
544         https://www.team-cymru.org/Services/Bogons/dns.html
545         http://mailspike.net/usage.html
546                 reputation-based
547         http://www.whitelisted.org/
548                 paid subscription
549                 policy on site
550         https://puck.nether.net/or/
551                 policies on website
552         http://www.isipp.com/email-accreditation/iadb-query-instruction/
553                 requires signup
554                 not quite a usage policy, but seems ok
555                 strange split of ipv4 and ipv6
556                 seems dead?