IP Blacklist & Reputation Check

A DNS blocklist (DNSBL) is a zone where listed addresses have a record. Mail servers query it for every connection: if 203.0.113.25 is listed, 25.113.0.203.list.example returns 127.0.0.2, and the server rejects or scores the mail. Each list has its own rules for what gets an address listed and how it comes off.

Threat feeds are similar but track more than spam: command-and-control servers, malware hosting, compromised machines and Tor exit nodes. Frabs collects several every hour, so this check uses the same data Frabs sensors act on.

Find out why before asking for removal, or it will be listed again within hours. On a server that sends mail, check for a compromised account, an open relay or a contact form being abused. On a VM that should not send mail at all, the usual cause is malware or a customer running a spam tool.

Most lists remove addresses automatically once the bad traffic stops (SpamCop after 24 hours, UCEPROTECT Level 1 after 7 days). Others have a removal form. Never pay for removal.

Some lists escalate: UCEPROTECT Level 2 and 3 list whole ranges and networks when enough individual addresses misbehave, so one abusive VM can hurt every customer in the block. Catching the traffic as it leaves is far cheaper than cleaning up afterwards.