Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Table of Contents
outlinetrue
stylesquare

Contact / Removal

Removal requests are for the moment available but manually handled. Just send a mail to dnsbl@tornevall.org (or support@tornevall.net) with the address you want to have unlisted.

DNSBL v5.0

Check the bottom of this page to get more information about migrations to version 5 or here to view the DNSBL Project dashboard.

API

See the section for API v2.0 and DNSBL API

What is a DNSBL?

A DNS-based Blackhole List (DNSBL, Real-time Blackhole List or RBL), is a means by which an Internet site may publish a list of IP addresses, in a format which can be easily queried by computer programs on the Internet. As the name suggests, the technology is built on top of the Internet DNS or Domain Name System. DNSBLs are chiefly used to publish lists of addresses linked to spamming. Most mail transport agent (mail server) software can be configured to reject or flag messages which have been sent from a site listed on one or more such lists (Source)

We are regularly scanning new proxies that are reported to us and we're also trying to keep updated with the "Tor"-network proxies, a network that forgets that anonymity can be a problem when we are speaking abuse.

Resolving

dnsbl.tornevall.org: Default zone
opm.tornevall.org: Added 1 june 2016 (Deprecation as of 30 june 2013 was reverted)
bl.fraudbl.org: Added 22 june 2016

RBL Bitmasking Data

dnsbl.tornevall.org

1

Status
colourRed
titledeprecated

IP address has been reported (As this bit has no real actual effect and rather is a false positive, it will be deprecated in short)

Meaning: The ip has been reported from a third party application, honeypot, but may not necessarily be confirmed by our local sweepers (this is for proxies)
As there may be SMTP-servers amongst our hosts, this bit value may be unsafe to use and in the case of SMTP, there is no available confirmation.

Deprecating from march 2017

2

Status
colourGreen
titleConfirmed proxy

IP has been confirmed as working proxy.

4June 2016:

Status
colourGreen
titlephishing

When FraudBL is used, this mask confirms the host as fraudible (Servers used for phishing, fraud, etc) 

Active since June 2016

8

Status
colourBlue
titlechanging

Will update soon

As this bitvalue has no meaning (since it only flags that nothing happens while trying to connect to it, this will change shape soon

.

(Deprecated: timeout)

16

Status
colourGreen
titleemail spam

June 2016: E-Mail spammer
This is the former field for failed connections, which there is no interest in

Active since June 2016

32

Status
colourGreen
titleHas second entry

IP is tested and is fully functional but there is a second entry point (meaning this ip is not the same as the one that has been used by the user"), or the address is an exit node in TOR-network

64

Status
colourGreen
titleabuse

IP is marked as "abusive". Primary used to point out spam or attacks through webforms, forum, telnet, etc.
Updated since June 2016: When FraudBL is used, this mask are also added, which means that - for example - if there is a phishing case (mail) the bit will be set to over 64 (4+16+64).

128

Status
colourGreen
titleanonymous

IP has a different anonymous-state (web-based proxies, like anonymouse, etc)

  

bl.fraudbl.org

Follows all bitmasks as dnsbl.tornevall.org generates.

 

The FraudBL Project

Fraudalent/phishing-tagged e-mail

FraudBL has just been started as a separate project - for the moment you can reach the site at https://fraudbl.orgFraudBL - Explained has been added here at the docs (from fraudbl.org), for your convenience.

Tip
titletornevall.org covers both

FraudBL is a separate project, which lists mail that contains all kinds of phising. However, dnsbl.tornevall.org is covering FraudBL too so you actually don't need to resolve against both domains unless you don't want another scoring on the FraudBL content. Since dnsbl.tornevall.org collects all kinds of spam, the scoring is normally lower rated than the phising mail.

More information about the scoring can be found at DNSBL for Spamfilters.

 

Links

API References

Project status

We are currently working on a complete migration to a new system. Here, you can find the status of that project.
Older versions from 2006 are following TornevallWEB versioning (1.x-4.x).

Check out our project pages here!

Why does the project take time?

The complexity of some of our functions are described in 

JIRA
serverTornevall Networks
serverIdef1f2374-e58a-319f-9d38-10348dbac859
keyDNSBL-9
. However, the project is being made on spare time, so if something else happens in the private life of Tornevall, it will get higher priority. However, if there are disruptions in the services, such cases will also have higher priority.

JIRA
serverTornevall Networks
columnssummary,updated,status
maximumIssues1000
jqlQuerysprint = 18 OR Project = DNSBL ORDER BY status DESC, "Internal priority", priority DESC, updated DESC
serverIdef1f2374-e58a-319f-9d38-10348dbac859

Project status chart

JIRA Charts
bordertrue
showinfortrue
serverTornevall Networks
jqlsprint%20%3D%2018%20OR%20Project%20%3D%20DNSBL%20%20ORDER%20BY%20resolution%20DESC%2C%20%22Internal%20priority%22%2C%20priority%20DESC%2C%20updated%20DESC%20
statTypestatuses
chartTypepie
width
isAuthenticatedtrue
serverIdef1f2374-e58a-319f-9d38-10348dbac859

JIRA Charts
bordertrue
showinfortrue
serverTornevall Networks
jqlsprint%20%3D%2018%20OR%20Project%20%3D%20DNSBL%20%20ORDER%20BY%20resolution%20DESC%2C%20%22Internal%20priority%22%2C%20priority%20DESC%2C%20updated%20DESC%20
statTyperesolution
chartTypepie
width
isAuthenticatedtrue
serverIdef1f2374-e58a-319f-9d38-10348dbac859

JIRA Charts
bordertrue
showinfortrue
serverTornevall Networks
jqlsprint%20%3D%2018%20OR%20Project%20%3D%20DNSBL%20%20ORDER%20BY%20resolution%20DESC%2C%20%22Internal%20priority%22%2C%20priority%20DESC%2C%20updated%20DESC%20
statTypecomponents
chartTypepie
width
isAuthenticatedtrue
serverIdef1f2374-e58a-319f-9d38-10348dbac859