== Looking at whether (some) IP addresses persist in zen.spamhaus.org

After writing [[my entry on the shifting SBL ShiftingSBL]] I started
to wonder how many IP addresses we reject for being SBL listed stop
being SBL listed after a (moderate) while. I can't answer that
directly, because we actually use the combined [[Zen Spamhaus list
http://www.spamhaus.org/zen/]] and we don't log the specific return
codes, but I can answer a related question: how many Zen-listed IP
addresses seem to stay in the Zen lists?

To check this, I pulled 10 days of records from January 18th through
January 27th, extracted all of the distinct IPs that we found listed
in zen.spamhaus.org, and re-queried Zen now to see how many of them
are still there. Over that ten day period we had 613 Zen-listed IP
addresses; today, 534 of them are still in the Zen. So a fairly decent
number stay present for 30 days or more.

(Technically some of them could have disappeared and then reappeared.)

I also pulled specific return codes for all of those IP addresses,
so I can now give you a breakdown of why those 534 addresses are
still present:

* 420 of them are in Spamhaus-maintained PBL data. There's no single
  really big source, but 46 of them are from Beltelecom in Belarus
  ([[AS6697 http://bgp.potaroo.net/cgi-bin/as-report?as=AS6697]])
  and 23 are from Chinanet ([[AS4134
  http://bgp.potaroo.net/cgi-bin/as-report?as=AS4134]]).

* 70 of them are in the XBL, specifically in the CBL.

* 56 are in the SBL. There's no really big source, but five IPs are
  from 177.47.102.0/24 aka [[SBL136747
  http://www.spamhaus.org/sbl/query/SBL136747]], four are from
  5.135.106.0/27 aka [[SBL173923
  http://www.spamhaus.org/sbl/query/SBL173923]], and two are
  from 212.174.85.0/24 aka [[SBL107558
  http://www.spamhaus.org/sbl/query/SBL107558]].

  (Two of those SBL listings are depressingly old, not that I am
  really surprised by long-term SBL listings by this point.)

* 47 of them are in ISP-maintained PBL data.
* 9 of them are in the [[SBL CSS http://www.spamhaus.org/css/]],
  which is pretty impressive and depressing because SBL CSS listings
  expire fairly fast.

An equally interesting question is how many of those 79 now-unlisted
IPs are listed in some other DNS blocklist. The answer turns out to be
a fair number; 60 are still listed on some DNS blocklist that I have in
my program to check IPs against a big collection of DNSBls. Many but not
all of the hits are for b.barracudacentral.org (which is not a DNSBl
that I consider to be really high quality; it seems to be more of a
hair-trigger lister).

(I'm out of touch with what's considered a high-quality DNSBl versus
lower-quality ones so I'm not going to offer further reporting or
opinions.)