Page tree

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

RBL Bitmasking Data

1IP has been reported
Meaning: The ip has been reported from a third party application, honeypot, but may not necessarily be confirmed by our local sweepers (this is for proxies)
As there may be SMTP-servers amongst our hosts, this bit value may be unsafe to use and in the case of SMTP, there is no available confirmation.
2IP has been confirmed as working proxy
4

Phishing flag

From June 2016: When FraudBL is used, this mask confirms the host as fraudible (Servers used for phishing, fraud, etc)

8IP was tested, but was never returning anything
Meaning: The ip may be fixed by the owner and therefore it's not working anymore
16-Coming soon-
This is the former field for failed connections, which has been taken over by bit value 8
32IP is tested and is fully functional but there is a second entry point (meaning this ip is not the same as the one that has been used by the user"), or the address is an exit node in TOR-network
64IP is marked as "abusive". Primary used to point out spam or attacks through webforms, forum, telnet, etc
128IP has a different anonymous-state (web-based proxies, like anonymouse, etc)
May be deprecated soon
  
dnsbl.tornevall.org is the default zone (opm.tornevall.org removed 130630) to use on lookups. Future zones will also reported here.

...