IP labels make it much easier for you to organize your IP addresses. This feature comes extremely handy to people who use our services to monitor a large number of IPs.

Upon adding a new IP address, our system now allows you to add the respective label. If you enter a hostname instead of an IP address, the system will automatically discover the corresponding IP address, and the hostname you entered will be automatically put in as a label. You can manage your IP labels through the “IP Addresses” section of RBLmon’s user interface.

We truly hope that you’ll enjoy this new addition to the RBLmon’s set of tools.

If you have any questions, comments and/or ideas to support our efforts to continuously improve our service, please do not hesitate to share them with us.

As we are now officially no longer in beta testing, we are introducing:

• a brand new website
• a new and improved user interface
• paid subscriptions (Basic, Advanced and Premium), respectively allowing for the monitoring of 5, 15 or 50 IP addresses
• substantial discounts for subscribing for 6 or 12 months of service

We will continue to provide FREE services to the community, but with an increased (48-hour) period between the automatic RBL checks. Everyone is still free to run a manual RBL scan on every 24 hours through the user interface.

All paid subscriptions will come with a 24-hour RBL check frequency by default.

We would like to thank all of our current subscribers for the support and constructive feedback during our months of beta testing, and we assure you that we will continue to improve and add new features to RBLmon.

Please take a moment to look at what we now have to offer and feel free to upgrade to our very inexpensive paid packages (the Basic RBLmon package would cost you just $2.95 per month if you subscribe for a full year of service). This would be a great way to support this project and help us in our efforts to make RBLmon the best RBL monitoring service there is, while still continuing to provide FREE services to the community.

Note: As this is our first official version, and there have been major changes to both the back-end and the front-end systems, there is a slight possibility that you may run into some bugs. If you find any, please kindly contact us and report them, so that we can get everything fixed ASAP.

Thank you!

At 14:00 UTC tomorrow (Thursday, October 14th, 2010), all RBLmon systems will be taken offline for major software maintenance and upgrades. We expect several hours of downtime, during which we’ll be working on deploying the first official version of RBLmon.

We are going to introduce:

• a brand new website
• a new and improved user interface
• paid subscriptions (Basic, Advanced and Premium), respectively allowing for the monitoring of 5, 15 or 50 IP addresses
• substantial discounts for subscribing for 6 or 12 months of service

We will continue to provide FREE services, but with an increased (48-hour) period between the automatic RBL checks. All paid subscriptions will come with a 24-hour RBL check frequency by default.

If you have any questions, please do not hesitate to contact us at team@rblmon.com.

The CBL operates in an entirely automated way designed to avoid listings of spam trap hits due to bounces of forged spam, virus bounces, and “real” mail servers emitting the occasional spam (unless the server itself appears to be infected). It tries very hard to avoid listing legitimate mail sources. It does not attempt to list every possible spam source.

The CBL also lists certain portions of SpamBot infrastructure, such as virus infector download web sites and other web sites or name servers exclusively dedicated to the use of SpamBots. Considerable care is taken to avoid listing IP addresses that have, are or are likely to be shared with legitimate use, except in the case of infector download websites.

There is no supporting data or “evidence” record available for any given listing, and no mechanism to ask why any given listing took place. To counteract this, there is an automated no-questions-asked removals procedure allowing any affected party to delist a specific IP address rapidly. However, delisted IPs are relisted if new evidence of spam activity is subsequently detected.

Entries automatically expire after a period of time. The approximate detection time of a specific entry can be obtained from the web interface.

TECHNICAL DETAILS:

Website: http://cbl.abuseat.org

DNS look-up: cbl.abuseat.org

Here are the officially announced criteria (currently listed on Fiveten’s website):

• Individual spam sources – These are generally taken from spam samples that have arrived here, and from discussions on news.admin.net-abuse.email.
• Providers of bulk emailing services that do not require a closed-loop confirmation opt-in from their customers, or that have allowed known spammers to become their clients.
• Output servers from multi-stage open relay chains that have sent spam.
• Single-stage open relays.
• Networks that provide services to spammers.
• Web servers running vulnerable versions of formmail.pl or other exploitable web-to-mail gateways. This may also include machines acting as smarthosts for such web servers.
• Providers of free mail providers.
• Systems that send virus notifications (klez, sobig, etc.) to the supposed sender. This refers to a specific type of backscattering.

TECHNICAL DETAILS:

Website: http://www.five-ten-sg.com/blackhole.php

DNS look-up: blackholes.five-ten-sg.com

The SCBL aims to block spam with minimal blocking or misidentification of wanted email. Given the power of the SCBL, SpamCop encourages users to also actively maintain a whitelist of wanted senders of email. SpamCop also encourages SCBL users to tag and divert email, rather than block it outright. In the end, most SCBL users find that the amount of unwanted email successfully filtered makes the risks and additional efforts worthwhile.

SCBL Rules

The system currently operates based on these rules:

• SCBL lists IP addresses with a large number of reports relative to reputation points. The SpamCop team manually balances the threshold in an effort to make the list as accurate as possible.
• The SCBL weights reports depending on how recently the mail was received (or “freshness”):
  1. The SCBL counts the most recently received reports 4:1.
  2. The SCBL counts reports for email 48 hours and older 1:1, with a linear sliding scale between the most recent and 48 hours past.
  3. The SCBL ignores reports for email received more than one week ago.
• The SCBL uses Spamtrap reports to weight total reports. For spamtrap scores less than 6, the SCBL multiplies by 5 the quantity of spamtrap reports and adds this to the report score. For larger spamtrap scores, the SCBL squares the quantity. Examples:
  1. If an IP address has 2 spamtrap reports and 3 SpamCop user-reported reports, its weighted score is 13: (2 * 5) + 3 = 13.
  2. If a host has 7 spamtrap reports and 3 manual reports, its weighted score is 52: (7 * 7) + 3 = 52.
• The SCBL does not count reports regarding URLs or addresses in the body of the email. Therefore, the SCBL does not list websites or email addresses used to receive replies in reported email, unless that IP is also used to send the mail.
• The SCBL will not list an IP address with only one report filed.
• With only two reports against an IP address, the SCBL will list the IP address for a maximum of 12 hours after the most recent reported mail was sent.
• The SCBL will not list an IP address if there are no reports against it within 24 hours.
• If a server sends bounces to an SCBL spamtrap in sufficient quantity to meet the listing criteria, the SCBL will list that server. This situation results as some mailservers do not reject mail during the SMTP transaction, but rather accept the mail and then send a bounce message later. (These servers usually run qmail or postfix). Viruses and spam often contain a forged From: line. If email is rejected or blocked during the SMTP transaction, the bounce will go to the connecting IP. If the bounce comes after the mail is accepted for delivery, then the bounce will go to the address in the From: field. Viruses and spam often use addresses from the list of recipients to populate the From: field. Sometimes, these addresses are spamtraps.

TECHNICAL DETAILS:

Website: http://www.spamcop.net/bl.shtml

DNS look-up: bl.spamcop.net

SpamCannibal does not block email access except for IP addresses and ranges that have sent or relayed what the blacklist administrators believe to be spam or other unsolicited email.

SpamCannibal does not scan remote hosts or otherwise test remote sites.

TECHNICAL DETAILS:

Website: http://www.spamcannibal.org

DNS look-up: bl.spamcannibal.org

On September 13th, 2010, its creator Jeremy Bettis announced on his blog that the blacklist is no longer maintained and urges all ISPs to stop querying its DNS database.

Click here to see the original post.

If possible, RBLmon will continue to monitor the Deadbeef blacklist until December 31st, 2010, as there is still a tiny chance for some email messages to get rejected.

TECHNICAL DETAILS:

Website: http://www.deadbeef.com/anti-spam/bl-spam-deadbeef-com/ (used to be spam.deadbeef.com/bl/)

DNS look-up: bl.deadbeef.com

Your business and private correspondence depends heavily on whether your messages are being duly delivered to their intended recipients.

On many occasions, you wouldn’t be able to reach your recipients because the IP address of your mail server is blacklisted. Often times, you may receive bounce-backs (delivery failure reports) informing you that your messages didn’t reach their recipients. Depending on the policy of the recipient’s ISP, your messages may even be dropped silently because your IP address is found on a blacklist. Then you will never know if you’ve actually been able to make contact.

More than 30% of email marketing messages are not delivered to their recipients either. Many of them get rejected because the IP address of your mail server is on a blacklist. For example, AOL blocks more than 80% of the messages it receives to its members. In many cases the reason for it is that your IP belongs to a network range that has spammed or your IP address itself has somehow been involved in spam operations.

Sometimes you may be blocked because your mail server acts as an open-relay proxy or because its IP address lacks a PTR record.

You need to know when and where your emails are being blocked and how to remedy the situation. The RBLmon will tell you where you are blacklisted and how to begin the blacklist removal process.