the Carrot and the Stick Project - NMSBL

NOTE: the rsync set up is not yet functional, but the list of IP addresses [88,238] is available currently at http://tcats.stop-spam.org/nmsbl/nmsbl.txt.

This is a list of machines that are exploited and have sent spam to us or our clients. The machines on this list should NOT be sending any email at all. These are home computers and servers with viruses or that have been rooted or otherwise send spam.

The methodology for creating the NMSBL

1. We receive "a" spam.
2. We retrieved all the received lines.
3. The server IP connecting to our server are properly reverse DNSed but are not properly designated as email servers.
4. The servers that are not properly reverse DNSed and are not properly designated as email servers are listed in the Bot Net Blacklist
5. The spam from servers that are properly designated email servers that are sending spam are listed in the Temporary Blacklist and they are not necessarily compromised machines but might just be mismanaged and/or allow spam to be sent.
6. The Temporary Blacklist [TBL] will not have IP addresses for the Snow Shoe spammers, the Snow Shoe Blacklist contains most of the spammer for hire IP addresses and has various listing levels and some of the lists contain the IP addresses of those that hire the Snow Shoe spammers to send their spam.
7. We and/or our clients have to receive spam before any IP address is ever entered into any list.
8. For this list the criteria is specific and is used to isolate machines that are more than likely to be compromised and can be home computers and/or servers with malware on them.

The IP address must conform to requirements above to be listed in this list. Each of the list has specific criteria so there are no unexpected/unpleasant surprises.

IMPLIMENTING THE LISTS

Currently the list is available only as an ASCII file located here