Listing policy

How addresses get on rbldb, and how they get off.

What we list

Public IPv4 addresses observed by OpenEFA sensors performing:

• SMTP AUTH / IMAP / POP password spraying and brute force
• Exploit attempts and vulnerability probing against mail and web servers
• Web shell access and post-exploitation activity
• Confirmed spam, phishing or malware delivery (analyst-reviewed)

Every listing comes from our own sensors or analysts. We do not republish third-party blocklists.

What we never list

• Private, reserved and special-purpose ranges (RFC 1918, loopback, CGNAT, multicast, etc.)
• 127.0.0.1, per RFC 5782
• Ranges larger than a /22 from automatic sources

How long listings last

Automatic listings expire 14 days after the last observed activity. Repeat activity renews the listing. Analyst listings may last longer and are reviewed periodically.

Removal

Look up the address on the lookup page and submit a removal request describing what was fixed. Requests are reviewed by a person. An address that resumes the same activity will be listed again.

Using rbldb responsibly

rbldb is designed for blocking authentication attacks and exploit traffic. If you use it to score inbound mail, use it as one signal among several rather than as a sole reason to reject.

Query limits

The public zone is free for reasonable use. Heavy commercial users should contact us. Queries arriving through large public resolvers may be refused in future; run a local caching resolver.

Contact

Abuse: [email protected] · Removal: lookup page