Looking at whether (some) IP addresses persist in zen.spamhaus.org
After writing my entry on the shifting SBL I started to wonder how many IP addresses we reject for being SBL listed stop being SBL listed after a (moderate) while. I can't answer that directly, because we actually use the combined Zen Spamhaus list and we don't log the specific return codes, but I can answer a related question: how many Zen-listed IP addresses seem to stay in the Zen lists?
To check this, I pulled 10 days of records from January 18th through January 27th, extracted all of the distinct IPs that we found listed in zen.spamhaus.org, and re-queried Zen now to see how many of them are still there. Over that ten day period we had 613 Zen-listed IP addresses; today, 534 of them are still in the Zen. So a fairly decent number stay present for 30 days or more.
(Technically some of them could have disappeared and then reappeared.)
I also pulled specific return codes for all of those IP addresses, so I can now give you a breakdown of why those 534 addresses are still present:
- 420 of them are in Spamhaus-maintained PBL data. There's no single
really big source, but 46 of them are from Beltelecom in Belarus
and 23 are from Chinanet (AS4134).
- 70 of them are in the XBL, specifically in the CBL.
- 56 are in the SBL. There's no really big source, but five IPs are
from 220.127.116.11/24 aka SBL136747, four are from
18.104.22.168/27 aka SBL173923, and two are
from 22.214.171.124/24 aka SBL107558.
(Two of those SBL listings are depressingly old, not that I am really surprised by long-term SBL listings by this point.)
- 47 of them are in ISP-maintained PBL data.
- 9 of them are in the SBL CSS, which is pretty impressive and depressing because SBL CSS listings expire fairly fast.
An equally interesting question is how many of those 79 now-unlisted IPs are listed in some other DNS blocklist. The answer turns out to be a fair number; 60 are still listed on some DNS blocklist that I have in my program to check IPs against a big collection of DNSBls. Many but not all of the hits are for b.barracudacentral.org (which is not a DNSBl that I consider to be really high quality; it seems to be more of a hair-trigger lister).
(I'm out of touch with what's considered a high-quality DNSBl versus lower-quality ones so I'm not going to offer further reporting or opinions.)