TornevallNET Proxy and Abuse-filtering Project

Visitors right now: 0

Using the DNSBL

Anyone can query our DNSBL through normal DNS means. Just reverse the octets and do a name lookup. For example, to check if 192.168.1.100 is present in dnsbl.tornevall.org, do a DNS lookup on 100.1.168.192.dnsbl.tornevall.org. Each entry in the DNSBL has an A record. In dnsbl.tornevall.org, the A record has an IP address of 127.0.0.x
where x is a bitmask of the types of proxy that have been reported to be running on the host. The values of the bitmask are the following...

What does OPM mean?

Opm is the first word used when this service started. Back in the times when Blitzed was alive, we used their IRC-monitor, called Open Proxy Monitor. It's as simple as that. The subdomain opm.tornevall.org still works, but since some sites started to use dnsbl.tornevall.org we have all hosts in duplicated form, to support them both.

Need more help?

You can get more information and help by visiting Tornevalls Forum (a mixed language - swedish/english - forum).

RBL Bitmasking Data for dnsbl.tornevall.org (still supporting opm.tornevall.org)
1	Proxy has been scanned
2	Proxy is working
4	Will be changed!-- Tagged as proxy from Blitzed (R.I.P) See SFS for more information
8	Proxy was tested, but timed out on connection
16	Deprecated - Will be changed Proxy was tested but failed at connection
32	Proxy was tested but the IP was different to the one connected at (Including TOR)
64	IP marked as "abusive host". Primary target is web-form spamming (Includes dnsbl_remote)
128	Proxy has a different anonymous-state (web-based proxies, like anonymouse, etc)

*dnsbl.tornevall.org is the default zone to use on lookups. Future zones will also reported here.*