]> git.netwichtig.de Git - user/henk/docs/dnsbl_notes.git/blob - dnslists.otl
update relaytest.kundenserver.de
[user/henk/docs/dnsbl_notes.git] / dnslists.otl
1 TODO
2         check and link (de)listing policy
3                 NOGO: delisting for money
4         check and link usage policy
5         check and link return codes
6         find newsfeed or mailinglist
7         give feedback?
8         implement in exim
9         implement in SA
10         implement in rspamd
11 00_META
12         https://bugs.launchpad.net/ubuntu/+source/amispammer/+bug/835614
13         http://www.blalert.com/dnsbls
14         http://www.dnsbl.info/dnsbl-list.php
15         http://dnsbl.inps.de/index.cgi?lang=en&site=00002
16         http://www.sdsc.edu/~jeff/spam/cbc.html
17         http://moensted.dk/spam/
18         https://whatismyipaddress.com/blacklist-check
19         https://multirbl.valli.org/
20         https://glockapps.com/blacklist/
21         https://docs.hetrixtools.com/monitored-blacklists/
22         https://www.blacklistmaster.com/
23         https://knowledge.validity.com/hc/en-us/sections/204468388-Blocklists
24         https://github.com/zbetcheckin/DNSBLs
25         https://en.wikipedia.org/wiki/Comparison_of_DNS_blacklists
26 00_ELANG
27         http://dnsbl.aspnet.hu/
28                 hungarian?
29         http://spam-rbl.fr/
30                 french
31         https://mav.com.br/
32                 maybe? they have antispam but it’s all portugese? or spanish? no idea
33 00_DEAD
34         http://openrbl.org/
35                 as seems dead
36                         404s
37                         wiki is down
38         http://mailhosts.org/
39                 dead
40                         https://www.blalert.com/dnsbl/shortlist.mailhosts.org
41         blitzed.org
42                 dead since 2006
43                         https://www.dnsbl.com/2007/02/status-of-opmblitzedorg-dead.html
44                                 referenced ML post is 404
45         blackholes.five-ten-sg.com
46                 Offline as of 1/1/2013
47                         https://whatismyipaddress.com/five-ten-sg
48         dynip.rothen.com
49                 On 9/29/2020 the ROTHEN blacklist appears to have started to list the entire internet
50                         https://www.dnsbl.info/dnsbl-details.php?dnsbl=dynip.rothen.com
51         fl.chickenboner.biz
52                 dead since 2011
53                         https://community.spiceworks.com/topic/329762-blacklist-removal
54                         https://bugs.launchpad.net/ubuntu/+source/amispammer/+bug/835614
55                 website contains spam/crap
56         http://cart00ney.surriel.com/
57                 cart00ney.org is dead
58         http://dsbl.org/
59                 points to surriel.com
60         http://csma.biz/
61                 domain is for sale
62                 dead since 2013
63                         https://www.dnsbl.com/2013/02/status-of-blcsmabiz-dead.html
64         http://dnsbl.net.au/
65                 website contains info about living in australia? called "AusBlog"
66                 http://www.dnsbl.com/2009/04/status-of-dnsblnetau-dead.html
67         http://moensted.dk/spam/
68                 dead since 2010
69                 https://moensted.dk/spam/
70         http://rbl.mw-internet.net/
71                 domain was parked
72                 2023: it is an asian(?) gambling(?) website
73         http://www.blackholes.us/
74                 dead since 2009
75                         https://www.dnsbl.com/2009/10/status-of-blackholesus-dead.html
76         http://www.deadbeef.com/
77                 dead, no info
78         spamsources.dnsbl.info
79                 dead since 2011 or so
80                         http://www.dnsbl.info/spamsources-dnsbl-defunct.php
81         http://www.gweep.ca/
82                 domain dead, no other info
83         http://www.njabl.org/
84                 dead since 2013
85                         https://en.wikipedia.org/wiki/Not_Just_Another_Bogus_List
86         http://wytnij.to/
87                 website parked, no other info
88         https://www.transip.nl/
89                 dead since 2013
90                         https://www.blalert.com/dnsbl/proxy.block.transip.nl
91                         https://www.blalert.com/dnsbl/residential.block.transip.nl
92         pss.spambusters.org.ar
93                 NXDOMAIN
94         rbl.snark.net
95                 NXDOMAIN
96                 https://snark.net/ gives access denied
97         whois.rfc-ignorant.org
98                 NXDOMAIN
99                 rfc-ignorant.org registered but no A/AAAA record
100                 dead since 2012
101                         http://www.h-online.com/security/news/item/RFC-Ignorant-org-blacklist-closes-down-1724814.html
102                         https://www.dnsbl.com/2012/09/status-of-rfc-ignorantorg-shutting-down.html
103         will-spam-for-food.eu.org
104                 unmaintained
105                 dead
106                         https://rfc1149.net/blog/2012/01/22/who-did-resurrect-will-spam-for-food/
107         http://proxybl.org/
108                 dead, seemingly written on http://proxybl.org/blog but that’s also dead
109                 https://linuxreviews.org/Mail_Spam_Blacklists
110                 https://community.sophos.com/utm-firewall/f/web-server-security/50273/dnsbl-proxybl-org-offline
111         dev.null.dk
112                 timeout, also on the parent null.dk
113                 effectively dead
114         dnsbl.mags.net
115                 seems dead, no info to be found
116                 domain does not respond
117         http://msrbl.blogspot.ch/
118                 http://msrbl.blogspot.com/ says "no updates" since 2010 but supposed to be reactivated
119                 effectively dead
120         http://www.olsentech.net/
121                 strange content on web
122                 effectively dead
123         rbl.orbitrbl.com
124                 http://www.orbitrbl.com/
125                 timeout
126         rbl.polarcomm.net
127                 NXDOMAIN
128                 registered but no A/AAAA record
129         cidr.bl.mcafee.com
130                 https://kc.mcafee.com/corporate/index?page=content&id=KB53783
131                         404
132                 no info to be found
133                 dead?
134         http://anti-spam.org.cn/?locale=en_US
135                 unreachable DNS
136         rbl.talkactive.net
137                 seems dead
138                 talkactive.net redirects twice to some hosting company
139                 last listings in 2017
140                         https://multirbl.valli.org/detail/rbl.talkactive.net.html
141                         https://www.blacklistmaster.com/blacklists?view=details&blacklist=rbl.talkactive.net
142         dnsbl.ipocalypse.net
143                 no policies published
144                 dead
145                         was a private list of an irc network
146                         network was renamed idlechat.net in 2014
147                         became a discord chat in 2022(?)
148         http://blakjak.net/RBL
149                 external access disabled
150                 2023: seems dead, website is a weird error
151                 https://www.blalert.com/dnsbl/rbl.blakjak.net
152                         This is a private list that we do not monitor as the maintainer has explicity announced that the list is for his personal use
153         http://cyberlogic.net/
154                 french (canada)
155                 https://www.dnsbl.info/dnsbl-details.php?dnsbl=dnsbl.cyberlogic.net
156                         On or about 5/21/2018 the cyberlogic DNSBL ceased functioning properly.
157                 https://www.dnsbl.com/2018/05/
158                         As reported on the mailop mailing list on Friday May 25, 2018, the blocking list at dnsbl.cyberlogic.net now contains a "wildcard" DNS entry, effectively listing the entire internet
159         http://www.rbl.jp/allrbl-e.html
160                 website asks for login or just errors
161         http://www.spamhauswhitelist.com/en/
162                 looks like a parked domain with ads
163         http://stopspam.org/rblcheck/index.php
164                 aka dul.pacifier.net
165                 http://www.stopspam.org/rbl-info/
166                         stopped in 2013
167         http://countries.nerd.dk/
168                 unable to connect, also for nerd.dk
169         http://dul.ru/dul.en.html
170                 DEAD for sale
171         http://dns.measurement-factory.com/surveys/openresolvers.html
172                 dead
173                         »The following text describes past open DNS resolver surveys and an associated DNS lookup service that has been long shut down«
174         http://www.sectoor.de/tor.php
175                 timeouts
176         http://anticaptcha.net/
177                 for sale
178         http://blacklist.lashback.com/
179                 query zone: ubl.unsubscore.com
180                 provider’s website https://lashback.com/ seems alive and active (news entries from 2023) but does not link to the blacklist
181                 rsync URLs seem dead, so does the download url
182         http://blacklist.woody.ch/
183                 no entries in the displayed "top 100"
184                 may have been absorbed into the swinog blacklists, see antispam.imp.ch
185         http://cbl.abuseat.org/
186                 https://www.abuseat.org/
187                         changes to the CBL that occured in January 2021. In short, the CBL infrastructure was replaced by the Spamhaus XBL structure
188         http://dnsbl.burnt-tech.com/
189                 domain is for sale
190         http://rbl.dns-servicios.com/rbl.php
191                 website can not be found
192 00_NEEDS_RECHECK
193         https://antispam.imp.ch/
194                 no usage policy
195                 no return code info
196                 no good listing policy
197                 information received from inquiry to provider
198                         website will be updated
199                         return codes
200                                 dnsrbl.swinog.ch and uribl.swinog.ch (holding time increases with hits)
201                                         127.0.1.8 = default
202                                         127.0.0.10 => TRAP (Email sent to a spamtrap)
203                                         127.0.0.11 => REPO (Email reported as Spam by customer)
204                                 spamrbl.imp.ch (3 days holding time)
205                                         IPs are listed when trying to send mail to the spamtrap mailserver
206                                         MD5 hash: attachment sent to the swinog blacklist
207                                 wormrbl.imp.ch
208                                         DEAD
209         http://blacklist.woody.ch/rblcheck.php3
210                 dead?
211                 waiting for feedback
212         http://dnsbl.iip.lu/
213                 https://docs.hetrixtools.com/lookup-dnsbl-iip-lu-false-positive-removed/
214                         in 2016: lookup.dnsbl.iip.lu blacklist started issuing false positive responses and upon further investigation looks to be abandoned/dead.
215                 https://www.blalert.com/dnsbl/lookup.dnsbl.iip.lu
216                         This blacklist is marked as "shut down" and non-operational as of 2017-12-31.
217         http://dnsbl.inps.de/
218                 timeout
219                 https://www.dnsbl.com/search/label/dnsbl.inps.de
220                         Today, May 25, 2020, he has announced that it is shutting down, due to concerns around GDPR and personal challenges brought on by the coronavirus pandemic.
221                 https://docs.hetrixtools.com/dnsbl-inps-de-removed-from-our-system/
222                         [May 29,2018] IPv4 RBL dnsbl.inps.de has been removed from our system, as they have decided to discontinue the RBL project for the time being.
223                 https://glockapps.com/blacklist/dnsbl-inps-de/
224                         Today, May 25, 2020, he has announced that it is shutting down, due to concerns around GDPR and personal challenges brought on by the coronavirus pandemic.
225                 https://www.dnsbl.info/dnsbl-details.php?dnsbl=dnsbl.inps.de
226                         This blacklist is offline as of May 1, 2020.
227                 https://web.archive.org/web/20220428013500/http://www.inps.de/
228 00_NEEDS_RESEARCH
229         bl.tiopan.com
230         blocked.hilli.dk
231         dialups.visi.com
232         dnsbl.antispam.or.id
233         dob.sibl.support-intelligence.net
234         intruders.docs.uu.se
235         map.spam-rbl.com
236         rbl.triumf.ca
237         all.s5h.net
238                 http://www.usenix.org.uk/content/rbl.html
239         torexit.dan.me.uk
240         http://pedantic.org/
241                 as of 20140701
242         rbl.fasthosts.co.uk
243                 https://help.fasthosts.co.uk/app/answers/detail/a_id/140/kw/rbl
244                 seems dead?
245                 https://antispam.fasthosts.co.uk/
246 00_ALIVE
247         00_RECONSIDER
248                 http://barracudacentral.org/rbl
249                         requires account with extensive information (more than spamhaus e.g.):
250                                 your name.
251                                 your company name.
252                                 your phone number.
253                                 your address.
254                                 your city name.
255                                 your state/province name.
256                                 your zip/postal code.
257                                 the name of the alternate contact.
258                                 the phone number of the alternate contact.
259                                 the email address of the alternate contact.
260                         seems well documented
261         00_E_EVIL
262                 sbl.nszones.com
263                         http://www.spamhaus.org/organization/statement/008/fake-dnsbl-uncovered-nszones.com
264         00_E_INFORMATION
265                 blacklist.sci.kun.nl
266                         https://cncz.science.ru.nl/en/howto/email-spam/
267                         not really its own DNSBL?
268                         no usage information
269                         no usage policy
270                 http://anonmails.de/
271                         seems serious but missing necessary info
272                                 usage policy
273                                 listing policy
274                 http://blacklist.jippg.org/
275                         no usage policy
276                         no listing policy
277                         no return code info
278                 bip.virusfree.cz
279                         used by rspamd
280                         https://www.virusfree.cz/en/help is the only place I can find any official reference to this list at all but no policies or usage information
281                 https://www.nixspam.net/
282                         previously http://www.dnsbl.manitu.net/
283                         query zone: ix.dnsbl.manitu.net
284                         provided by the reputable german publisher 'heise' which makes the high quality c’t, iX, and telepolis magacines
285                         difficult to find info regarding listing policy
286                         asked for more information to be added
287                                 https://www.heise.de/forum/iX/Kommentare/Gemeinsam-stark/Nutzungsbedingungen-Return-Codes-sonstige-Infos/posting-42669177/show/
288                 access.redhawk.org
289                         website works but barely any info, not even how to query it
290                         https://www.redhawk.org/?p=64
291                         https://www.redhawk.org/SpamHawk/index.php
292                 https://senderscore.org/
293                         requires registration?
294                         Scam? http://www.complaintsboard.com/complaints/buyer-beware-senderscoreorg-is-a-scam-c276871.html
295                         https://senderscore.org/assess/blocklist-lookup/
296                         FAQ: https://knowledge.validity.com/hc/en-us/articles/360006992592-Return-Path-Blocklist-RPBL-FAQ-
297                         no information how to query found
298                 mail-abuse.org
299                         https://ers.trendmicro.com/
300                         trendmicro paid service
301                         https://docs.trendmicro.com/en-us/enterprise/email-reputation-services-online-help/getting-started_001/configuring-email-re/creating-an-account.aspx
302                                 »If you don’t create an account, you can still query the reputation of an IP address«
303                         I don’t find any pricing or usage information
304                 http://dnsbl.tornevall.org/
305                         https://www.tornevall.net/
306                         related to https://www.fraudbl.org/
307                         seems a bit unstructured and not very well documented
308                                 I can’t be arsed to deal with confluence slowing my browser to a halt repeatedly and it’s really hard to navigate but there seems to be some information on https://docs.tornevall.net/display/TORNEVALL/Endpoint%3A+dnsbl+-+DNSBL+v5+with+API+v3
309                         seems active
310                 http://rbl.schulte.org/
311                         seems active
312                         listing policy seems to be: they received spam from an IP
313                         usage policy: Anyone can use this RBL list [sic]
314                         return codes: probably boolean, i.e. either listed or not
315                 http://relaytest.kundenserver.de/
316                         by 1und1 (now ionos?), used internally
317                         https://www.blalert.com/dnsbl/relays.bl.kundenserver.de
318                         no usage policy found
319                         no listing policy found
320                         no return code explanation found
321         00_E_PAID
322         00_E_PRIVATE
323                 88.blacklist.zap
324                         http://blogs.technet.com/b/fss/archive/2009/05/08/forefront-dnsbl-yeah-or-nay.aspx
325                         https://web.archive.org/web/20150812003556/http://blogs.technet.com/b/fss/archive/2009/05/08/forefront-dnsbl-yeah-or-nay.aspx
326                         https://www.blalert.com/dnsbl/88.blacklist.zap
327                                 88.blacklist.zap is an internal blacklist maintained by Microsoft's Forefront
328                         https://www.dnsbl.com/search/label/frontbridge
329                 http://drmx.org/
330                         »Use of any DrMX.ORG DNS Zone is by request and by contract only.«
331                 rbl.tdk.net
332                         tdk.net seems dead on http(s)
333                         private
334                                 https://www.blalert.com/dnsbl/rbl.tdk.net
335                         old link: http://postmaster.tdc.dk/publish.php?id=31787
336                                 tdc.dk redirects to yousee.dk
337                                 https://web.archive.org/web/20170703084224/http://postmaster.tdc.dk/publish.php?id=31787
338                 rbl.zenon.net
339                         private
340                                 https://www.blalert.com/dnsbl/rbl.zenon.net
341                         http://www.noc.zenon.net/rbl/
342                         russian(?)
343                 https://ahbl.org/
344                         was public until 2015
345                         now private, invite-only
346         http://rfc-clueless.org/
347                 lists domains
348                         that do not adhere to common best practices or requirements
349                 does NOT list spammers!
350                 listing criteria are explained well
351                         http://rfc-clueless.org/pages/listing_policy
352                 return codes are explained
353                         http://rfc-clueless.org/
354                 usage policy is not so clear but the FAQ implies that it’s just free to use for everyone
355                 many timeouts
356                         first noticed in 2014 and deactivated
357                         retried in 2023 and still the case
358         http://spameatingmonkey.com/
359                 lists IPs
360                         that sent backscatter
361                         that sent to spamtrap
362                         added by policy
363                                 this includes dial-up!
364                                 https://spameatingmonkey.com/faq/policy-based-listing
365                 lists domains/URIs
366                         by age
367                         in spam bodies
368                 usage policy seems clear
369                         https://spameatingmonkey.com/faq/query-limits
370                 listing policy seems clear
371                         https://spameatingmonkey.com/services
372                 return codes documented
373                         https://spameatingmonkey.com/services
374                 http://blogspambl.com/
375                         redirects to spameatingmonkey.com
376         http://uribl.com/
377                 lists domains/URIs
378                         that appear in spam bodies
379                         has whitelist
380                 lists IPs
381                         that URIs in spam bodies resolve to
382                 return codes are documented
383                         https://uribl.com/about.shtml#implementation
384                         bitmasked
385                         127.0.0.1 is used to signal abusive query behaviour
386         http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists
387                 called "hostkarma"
388                 lists domains/URIs
389                 lists IPs
390                 usage policy is relatively clear that it’s free, except maybe for big for-profit oranizations
391                 listing policy is documented
392                 return codes are documented
393                 seems very trustworthy
394         http://www.sorbs.net/
395                 good reputation
396                 lists domains/URIs
397                 lists IPs
398                 usage policy is clear that it’s free
399                 listing policy is documented
400                 return codes are documented
401                 seems trustworthy
402         http://www.spamhaus.org/
403                 good reputation
404                 very well done
405                 seems very professional
406                 lists domains/URIs
407                 lists IPs
408                 usage policy is clear
409                         https://www.spamhaus.org/organization/dnsblusage/
410                 listing policies are clearly documented
411                 return codes are clearly documented
412         http://www.surbl.org/
413                 good reputation
414                 lists domains/URIs
415                 usage policy is clear
416                         https://surbl.org/usage-policy
417                 listing policy is documented
418                 return codes are documented
419                         bitmasked
420                         127.0.0.1 means blocked
421         http://zapbl.net/
422                 lists domains/URIs
423                 lists IPs
424                 listing policy seems clear
425                         https://zapbl.net/policy
426                 usage policy seems clearly free for everyone
427                         https://zapbl.net/using
428                 return codes are documented
429                 seems well done
430         https://rbl.foobar.hu/
431                 lists domains/URIs
432                 lists IPs
433                 listing policy seems clear
434                 usage policy seems clearly free for everyone
435                 return codes are documented
436                 possibly unmaintained or dead
437                         footer says: ©2013-14
438         http://apews.org/?page=filter
439                 questionable
440                         https://www.dnsbl.com/search/label/apews
441                         https://whatismyipaddress.com/apews
442                 dead?
443                         no news on http://apews-user.blogspot.com/ since 2014
444                 not further looked into because of the above
445         https://www.dnswl.org/
446                 seems to be run with best intentions but has had issues from what I have heard from some users
447                 IRC channel has some activity
448                 usage policy relatively clear
449                         free within certain limits
450                 listing policy
451                         self-service
452                 return codes are documented
453         00_E_FOCUS
454                 https://www.dnsblchile.org/index.en.html
455                         chilenian spam so not interesting for me
456                         seems alive
457         00_LISTS_BLOGSPAMMERS
458                 https://www.madavi.de/madavibl/
459                         »This blacklist should only be used to block comment spammer (on blogs and websites). Don’t use it for mail.«
460                 http://bsb.empty.us/
461                         does not exist anymore
462                         empty.us returns »Nothing here, obviously.«
463         00_LISTS_COUNTRIES
464                 korea
465                         http://korea.services.net/
466         00_LISTS_DIALUPS
467         00_LISTS_OPENRESOLVERS
468         00_LISTS_TORNODES
469                 https://www.dan.me.uk/dnsbl
470         https://0spam.org/
471                 clear information on usage policy
472                         Nothing. The 0Spam Project is absolutely free for email providers, IT professionals and general removal request.
473                         DNSBL service and removals are 100% for free for all uses; commercial, non profit and personal.
474                 seems serious
475                 listing policies are a little less clear
476                         bl.0spam.org DNSBL | 0spam Spam Trap Primary Database
477                         nbl.0spam.org Network Black List | Spam Source Networks, high volume of spam trap hits in a Class C block will result in network listings in this DNSBL.
478                         url.0spam.org URL Black List | This list contains the IP address of domains found to be in the source of spam emails found in our traps.
479                 return codes not very clear
480         https://abuse.ro/
481                 policy
482                         spamtraps
483                         The last IP address before destination in the email headers is listed into rbl.abuse.ro list.
484                         Sender domains are analyzed and if confirmed to be not spoofed, are listed into dbl.abuse.ro list
485                         Spamvertized domains (including those indirectly linked through services like bit.ly) are listed into uribl.abuse.ro list
486         http://dronebl.org/
487                 usage policy is clear: free for whatever
488                 listing policy is not quite so clear
489                         can be mostly inferred from the classes but not entirely clear IMHO
490                 has an IRC channel
491                 return codes
492                         not explicitly mentioned but it’s 127.0.0.X where X is the class from https://dronebl.org/classes
493         http://psbl.org/
494                 query zone: psbl.surriel.com
495                 no usage policy, but seems implied that usage is free
496                 listing policy
497                         no explicit, complete policy given but sending to spamtraps is mentioned to get you listed and seems the exclusive mechanism
498                 return codes
499                         not documented, probably only boolean
500         http://rbldata.interserver.net/
501                 listing policy more or less clear
502                 usage policy not given but since usage is explained it’s probably free for all
503                 return codes seem to be binary, i.e. either listed or not
504                 lists IPs
505                 lists domains/URIs
506         http://rv-soft.info/
507         http://spamcannibal.org/dnsbl_check.shtml
508         http://spamrats.com/
509         http://spamstinks.com/
510         http://st.technovision.dk/
511         http://tor.efnet.org/
512                 http://rbl.efnetrbl.org/ MIRROR
513         http://v4bl.org/
514         http://virbl.bit.nl/
515         http://wpbl.info/
516         http://www.aupads.org/
517         http://www.backscatterer.org/
518                 fragwuerdige policy - bezahlen fuer schnelleres delisting
519         http://www.blockedservers.com/
520         http://www.blocklist.de/en/index.html
521         http://www.emailbasura.org/cgi-bin/emailbasura-ini.pl?lang=eng
522         http://www.gbudb.com/truncate/
523         http://www.justspam.org/
524         http://www.kempt.net/dnsbl/
525         http://www.leadmon.net/spamguard/
526         http://www.spamcop.net/
527                 good policy
528                 good reputation
529         http://www.spamsources.fabel.dk/
530                 sensible policy
531         http://www.srntools.com/blacklist/
532         http://www.uceprotect.net/en/index.php
533         https://bl.konstant.no/
534         https://choon.net/rbl.php
535         https://www.abuse.ch/
536                 https://www.abuse.ch/?tag=httpbl
537         https://www.kisarbl.or.kr/
538         https://www.megarbl.net/
539         https://www.team-cymru.org/Services/Bogons/dns.html
540         http://mailspike.net/usage.html
541                 reputation-based
542         http://www.whitelisted.org/
543                 paid subscription
544                 policy on site
545         https://puck.nether.net/or/
546                 policies on website
547         http://www.isipp.com/email-accreditation/iadb-query-instruction/
548                 requires signup
549                 not quite a usage policy, but seems ok
550                 strange split of ipv4 and ipv6
551                 seems dead?