|1||IP has been reported|
Meaning: The ip has been reported from a third party application, honeypot, but may not necessarily be confirmed by our local sweepers (this is for proxies)
As there may be SMTP-servers amongst our hosts, this bit value may be unsafe to use and in the case of SMTP, there is no available confirmation.
|2||IP has been confirmed as working proxy|
From June 2016: When FraudBL is used, this mask confirms the host as fraudible (Servers used for phishing, fraud, etc)
|8||IP was tested, but was never returning anything|
Meaning: The ip may be fixed by the owner and therefore it's not working anymore
This is the former field for failed connections, which has been taken over by bit value 8
|32||IP is tested and is fully functional but there is a second entry point (meaning this ip is not the same as the one that has been used by the user"), or the address is an exit node in TOR-network|
|64||IP is marked as "abusive". Primary used to point out spam or attacks through webforms, forum, telnet, etc.|
June 2016: When FraudBL is used, this mask are also added, which means that - for example - if there is a phishing case (mail) the bit will be set to over 64 (64+4).
|128||IP has a different anonymous-state (web-based proxies, like anonymouse, etc)|
May be deprecated soon
|dnsbl.tornevall.org is the default zone (opm.tornevall.org removed 130630) to use on lookups. Future zones will also reported here.|