NiX Spam DNSBL and blacklist for download

An up-to-date collection of spam emitting IP addresses

Suspicious Sources

The blacklist of the iX email filter

The iX blacklist is made of over 500,000 automatically generated entries per day without distinguishing open proxies from relays, dialup gateways, and so on. After 12 hours the IP address will be removed if there is no new spam from there (Informationen auf Deutsch ).

The downloadable blacklist digest is being updated every 15 minutes and contains 40,000 IP addresses from about the last hour. Even more addresses are available as a DNSBL (zone name ix.dnsbl.manitu.net) with a lifetime of 12 hours (DNSBLs are often called RBL which is a trademark of Trend Micro). 

Spam infrastructure isn't unlimited – but blacklists have to be very large or really fast.

Our filter detects over 200,000 spam emails per hour. Maybe that's only 1/1,000,000th of worldwide spam traffic. But the blacklist covers more than 50 percent of that traffic. So it seems that spammers use some 100,000 IP addresses at any given moment. But most of them are dynamically assigned and change daily. Therefore an effective blacklist has to list millions of addresses that may be assigned eventually. Or it lists any active address instantly whilst removing older entries. That's the idea of the iX blacklist.

To minimize the risk of false positives we take further measures: Our internal whitelist contains thousands of mail servers that can't make it on the list even if they send spam occasionally (e. g. mail servers – not dialups – from Google or Yahoo). And in most cases our filter has to detect more than one unwanted email from the same IP address or a known spam email from an unknown IP address to enter it here. However recipients of desired mass mailings like newsletters should use an own whitelist for the corresponding IP addresses. This precaution is generally recommended if you use anti-spam solutions.

If your mail server is affected by our blacklist please send an email using that server to speed up the delisting process. Emails not sent from a host on our list will be rejected. If someone blocks your emails using our blacklist please read the reject messages. You should find information on the time of receiving the latest spam email from your IP address and about the host which received it. Locate them in your log data to find the spam source.

German project homepage: www.nixspam.org . Further hints and discussions to be found in the German web forum. NiX Spam on Twitter: http://twitter.com/nixspam