BOPM / DNSBL's
Moderator: Supporters
BOPM / DNSBL's
I found this BL zones usefull , take a look on their websites ferequently for their dns replies ..
****************************
dnsbl.sorbs.net
127.0.0.2 = "HTTP"
127.0.0.3 = "Socks"
127.0.0.4 = "misc"
****************************
dnsbl.ahbl.org
127.0.0.3 = "Open Proxy"
127.0.0.19 = "Open Proxy"
****************************
dnsbl.njabl.org
127.0.0.9 = "Open proxy"
****************************
bl.spamcop.net
127.0.0.2 = "Blocked"
****************************
dnsbl-1.uceprotect.net
127.0.0.2 = "Black Listed"
there are much more , but use them with care , some listed whole ISP's or they have old IP's in their lists .
if you like just to see who uses Open Proxy/Black Listed IP (in defined channel in conf file) and not Gline/Zline it , in kline part just put " " , e.g:
kline = " ";
there are some other ways , but needs code changing in scan.c dnsbl.c ...
****************************
dnsbl.sorbs.net
127.0.0.2 = "HTTP"
127.0.0.3 = "Socks"
127.0.0.4 = "misc"
****************************
dnsbl.ahbl.org
127.0.0.3 = "Open Proxy"
127.0.0.19 = "Open Proxy"
****************************
dnsbl.njabl.org
127.0.0.9 = "Open proxy"
****************************
bl.spamcop.net
127.0.0.2 = "Blocked"
****************************
dnsbl-1.uceprotect.net
127.0.0.2 = "Black Listed"
there are much more , but use them with care , some listed whole ISP's or they have old IP's in their lists .
if you like just to see who uses Open Proxy/Black Listed IP (in defined channel in conf file) and not Gline/Zline it , in kline part just put " " , e.g:
kline = " ";
there are some other ways , but needs code changing in scan.c dnsbl.c ...
-
- Posts: 65
- Joined: Wed Apr 21, 2004 12:26 am
- Location: irc://irc.winbots.org/Winbots
- Contact:
heh, I did this a while back... http://searchirc.com/boards/viewtopic.php?t=2499
AHBL is said to be ok.
opm.blitzed was good but is dead now, as you might know.
SORBS, NJABL, spamcop are ones I would never run, and probably nobody else should either[*]. Too many false positives (innocent users being banned), as mentioned by pretty much everyone who has used it :P.
The TOR blacklists can be a good addition as well. Haven't tried them. Be sure you use the correct replies though (see documentation of the blacklist), because some have the option to mark the whole subnet a TOR server is on as blacklisted, which is IMO a bad idea (server at 1.2.3.4 would also tag 1.2.3.5 as bad).
[*] You can still make BOPM send a notice or whatever instead of klining, if it matches such blacklists.
opm.blitzed was good but is dead now, as you might know.
SORBS, NJABL, spamcop are ones I would never run, and probably nobody else should either[*]. Too many false positives (innocent users being banned), as mentioned by pretty much everyone who has used it :P.
The TOR blacklists can be a good addition as well. Haven't tried them. Be sure you use the correct replies though (see documentation of the blacklist), because some have the option to mark the whole subnet a TOR server is on as blacklisted, which is IMO a bad idea (server at 1.2.3.4 would also tag 1.2.3.5 as bad).
[*] You can still make BOPM send a notice or whatever instead of klining, if it matches such blacklists.
If you want information on the Tor black lists have a look at this thread: http://forums.unrealircd.com/viewtopic. ... =tor+dnsbl
-
- Posts: 44
- Joined: Wed Mar 10, 2004 5:30 am
- Location: irc.majestic-liaisons.com
- Contact:
personally i've found ABHL to give way more positives that real proxies, and have stopped using it, as they don't seem to do anything about dynamic ip addresses.
tor.dnsbl.sectoor.de also has exitnodes.tor.dnsbl.sectoor.de which just lists the exit nodes themselves without responding for the whole subnet/class
tor.dnsbl.sectoor.de also has exitnodes.tor.dnsbl.sectoor.de which just lists the exit nodes themselves without responding for the whole subnet/class
Majestic Liaisons Adult Chat - [url=irc://irc.majestic-liaisons.com:6667]IRC[/url] , Java
Re: BOPM / DNSBL's
I stopped using sectoor.de BL today.... 98% of lookups were timed out.
Now switching to another one for testing.
Now switching to another one for testing.
-
- Head of Support
- Posts: 2085
- Joined: Tue Jun 15, 2004 8:50 pm
- Location: Chino Hills, CA, US
- Contact:
Re: BOPM / DNSBL's
A list of DNSBLs I found the other day http://rbl.efnet.org
Re:
JanisB wrote:
cbl.abuseat.org - vewy-vewy good BlockList.
What are the responses for this one?
Re: Re:
Goto http://cbl.abuseat.org/faq.html then scroll down to "DNSBL Setup Recommendations"Oyarsa wrote:What are the responses for this one?
Your IP:
Your Country:
Your Country:
Re: BOPM / DNSBL's
This one looks like its meant more for email than for IRC though. Any false positives on this for those that are using it?