December 24, 2011

Comparison of some DNSBL results

No false positives to report this week, great because email was up to nearly double with all the Xmas communications including contacts so nice that it went smoothly. Use the spare time to put some usage statistics together;

DNSBL

%

Errors

l2.apews.org

95

0.5%

b.barracudacentral.org

94

* uceprotect.net 1,2 & 3

91

<0.2%

zen.spamhaus.org

91

<0.1%

ip.v4bl.org

68

cbl.abuseat.org

68

<0.1%

spam.dnsbl.sorbs.net

65

dnsbl-2.uceprotect.net

63

<0.1%

dnsbl-3.uceprotect.net

63

<0.2%

hostkarma.junkemailfilter.com

62

bl.tiopan.com

61

dnsbl-1.uceprotect.net

51

<0.1%

bl.mailspike.net

45

ix.dnsbl.manitu.net

44

1.5

truncate.gbudb.net

43

bl.spameatingmonkey.net

38

blackholes.five-ten-sg.com

37

bl.spamcop.net

31

<0.1%

psbl.surriel.com

18

<0.1%

db.upbl.info

14

<0.1%

dnsbl.imps.de

8

no-more-funn.moensted.dk

7

<0.1%

bl.spamcannibal.org

3

spam.spamrats.com

2

<0.1%

* does not exist as a single dnsbl, use 3 lists


That accords with our findings too, very respectable error rates before the use of a whitelist. Only Barracuda's system comes close and they require a free registration before you can access their data. You can use a combined result from all 3 lists at UCEProtect.net to achieve similar results though they do have lower error rates.

There are websites that offer a one-stop lookup service, like dnsbl.info, where you can input an IP address and see which blacklists have it listed. In their case, dnsbl.info test 80+ blacklists but do not include l2.apews.org which seems odd when you see the results above. Yet they show the results from other blacklists with more than double the error rate, odd that.

30 comments:

  1. "In their case, dnsbl.info test 80+ blacklists but do not include l2.apews.org which seems odd when you see the results above. Yet they show the results from other blacklists with more than double the error rate, odd that."

    Maybe that's because it's a PITA to get false positives out of APEWS? Heck, I've gone through the 2 year old extra-lengthy FAQ and still don't know who/where to contact! "Your ISP" is not always a viable option, especially when APEWS blatantly blocks ranges wider than they should...

    Example: you're listing 62.28.128.0/21; however, the range that our ISP alloted to us, quite some time ago but only recently did we have to change our mail server and put the there, is ONLY 62.28.132.184/29; since this range falls within your huge range, YOUR site is THE only one of 80+ sites incorrectly listing our server, so that and the fact it's so darn hard to even START getting one's false positives out of your list is what probably makes them ignore it. For starters, whenever we get NDRs attributable to someone using your list we'll be talking them out of simply using it: from the moment you simply don't have, as many (ALL?) other sites have, a form to fill in for review, you're putting in a lousy service.

    The whole concept of "Guilty before proven innocent and make them go through a world of pain to prove their innocence" is *SO* darn wrong!

    Yes, it's probably true, whoever uses your list gets their "money's worth"...

    Sorry for the harsh comment, but as you can tell from the situation above, I'm a bit ****ed off with the way you guys work.

    ReplyDelete
    Replies
    1. I checked your IP address earlier today in order to respond and found it to be listed as you say. Then I got delayed however, on checking again just now I find that it is no longer listed.

      According to the APEWS website, they are are anonymous and an early warning system. They don't have a delisting or any other service probably because they're free to everyone. Their system has saved us a lot of time some of which we have chosen to give back to the internet community via this blog. On the news page of the APEWS website, back in October they asked for evidence of false positives to be published. We saw that as the missing link in using the data even more effectively. Don't shoot the messenger!

      You would do well to get your email servers registered on white lists or trusted senders etc, and try to ensure that your email recipients have you whitelisted on their mail servers, that way it doesn't matter who has your IPs blacklisted.

      The concept of "guilty and innocent" seems over dramatic. IPv4 is about reputation based on profile and risk assessment, look at the "like" buttons on Facebook, Google+ etc. Tons of folks use profiling e.g. crime prevention, health, car insurances etc, credit scoring... Did you stop to think why real estate is worth less in a bad neighborhood? Could it be that it profiles as high risk and therefore is less desirable? Think of restaurant reviewers, in fact anyone that writes reviews about 3rd party products and services.

      Delete
  2. You may want to check out the free Mutli-RBL checking tool provided by Unified eMail, it currently checks about 220 RBLs and does include l2.apews.org.
    http://www.unifiedemail.net/Tools/RBLCheck/Default.aspx

    ReplyDelete
  3. Dear APEWS!

    Remove the black list the IP address of the following:
    Joker.com.tr
    212.109.99.7
    212.109.99.5

    Your IP re-check our terms.


    Sincerely,

    FOREIGN TRADE ATM PAZ.A.Ş.

    ReplyDelete
  4. Dear APEWS!

    Remove the black list the IP address of the following:
    AIEP.CL

    190.96.93.82
    190.54.60.4

    the infection is block internaly.

    ReplyDelete
  5. Dear APEWS!

    Remove the black list the IP address of the following:
    203.85.24.46

    Your IP re-check our terms.

    ReplyDelete
  6. I just ordered a new server and my main ip 50.115.126.76
    is blacklisted, why ?
    In the server there isnt any domain.
    This is not correct way to black list ips and when the scum goes away reputation and history to follow the ip , what legitime users should do ?

    ReplyDelete
  7. Esta ip es legitima: 46.105.7.10


    y aparece en ip.v4bl.org



    mal mal mal

    ReplyDelete
  8. Dear APEWS!

    Remove the black list the IP address of the following:
    abdel-malek.com
    80.79.157.248

    ReplyDelete
  9. Dear APEWS!

    Please remove 196.45.145.163 which is currently listed in APEWS :-(
    Entry matching your Query: E-259539
    196.45.128.0/19

    ReplyDelete
  10. Remove the black list the IP address 115.31.155.82 thailand Please

    ReplyDelete
  11. Dear APEWS!

    Please remove 91.121.220.0 which is currently listed in APEWS :-(
    Query: E-439445
    IP: 91.121.220.0/23

    CASE: C-17
    Spambots, zombies, contaminated CIDR, bad reputation provider

    Thank you very much!

    ReplyDelete
  12. Hello Our IP has been blacklisted at apews.org.
    Please remove IP address 107.218.38.11

    ReplyDelete
  13. Please remove IP 200.62.140.30
    Hiper.com.pe
    I'm not Spammer

    ReplyDelete
  14. Please removal IP 200.62.140.32
    Hiper.com.pe.
    I am not Spammer.

    ReplyDelete
  15. Please remove IP 200.62.140.30
    Hiper.com.pe
    I'm not Spammer

    ReplyDelete
  16. Dear APEWS!

    Please remove 181.193.84.150 which is currently listed in APEWS :-(
    E-1300962
    181.192.0.0/14
    CASE: C-17
    I'm not Spammer

    Thank you very much!

    ReplyDelete
  17. Please remove IP 200.62.140.30
    Hiper.com.pe
    I'm not Spammer

    ReplyDelete
  18. Please remove IP 200.62.140.30
    Hiper.com.pe
    I'm not Spammer

    ReplyDelete
  19. Please remove IP 200.62.140.30
    Hiper.com.pe
    I'm not Spammer

    ReplyDelete
  20. Rodolfo Campos TJuly 13, 2015 at 5:19 PM
    Please remove IP 200.62.140.30
    Hiper.com.pe
    I'm not Spammer

    ReplyDelete
  21. They say im not a spammer, while spamming a blog.

    ReplyDelete
  22. Rodolfo Campos TJuly 13, 2015 at 5:19 PM
    Please remove IP 200.62.140.30
    Hiper.com.pe
    I'm not Spammer

    ReplyDelete
  23. Please remove IP 200.62.140.30
    Hiper.com.pe
    I'm not Spammer

    ReplyDelete
  24. Please remove IP address 74.219.160.54
    We are not spammers. A bank website is blocking our IP address making it difficult to check our accounts online.

    ReplyDelete
  25. Buenos Dias compaƱero
    le escribo para solicitarles que remuevan mi ip de lista negra ya que es un servidor valido con un dominio valido mi es 201.248.69.230 mail.conatel.gob.ve
    Gracias.

    ReplyDelete
  26. Dear,
    I need help please to remove the Ip of your Black list.

    Oooops 196.32.199.198 is currently listed in APEWS :-(
    Entry matching your Query: E-632631
    196.32.192.0/21CASE: C-258
    Spambots, zombies, contaminated CIDR, bad reputation providerHistory:
    Entry created 2013-06-18

    ReplyDelete
  27. My device ip adress been used
    And my apps been controlled
    Am not on Yahoo but on Gmail
    Whoever using my IP or who copied my device need to trace
    And remove from the web or legal action need to be taken rite now please

    ReplyDelete
  28. Dear,
    I need help please to remove the Ip of your Black list.

    Oooops 186.67.23.125 is currently listed in APEWS :-(
    Entry matching your Query: E-413609
    186.64.0.0/14CASE: C-41
    Spambots / zombies / spammers / scanners within CIDRHistory:
    Entry created 2010-09-19

    ReplyDelete