Skip to content

Instantly share code, notes, and snippets.

@dandanio
Last active May 8, 2023 19:11
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save dandanio/49f1f5b3cef20be8b978b41abe2670fc to your computer and use it in GitHub Desktop.
Save dandanio/49f1f5b3cef20be8b978b41abe2670fc to your computer and use it in GitHub Desktop.
RBL lookup script written in python3 with threading for speed
#!/usr/bin/env python3
import argparse
import socket
import threading
rbls = [
'access.redhawk.org',
'all.s5h.net',
'all.spamblock.unit.liu.se',
'b.barracudacentral.org',
'bl.deadbeef.com',
'bl.emailbasura.org',
'bl.mailspike.net',
'bl.spamcannibal.org',
'bl.spamcop.net',
'bl.tiopan.com',
'black.junkemailfilter.com',
'black.uribl.com',
'blackholes.five-ten-sg.com',
'blackholes.mail-abuse.org',
'blackholes.wirehub.net',
'blacklist.sci.kun.nl',
'blacklist.woody.ch',
'block.dnsbl.sorbs.net',
'blocked.hilli.dk',
'bogons.cymru.com',
'bsb.spamlookup.net',
'bsb.spamloup.net',
'cbl.abuseat.org',
'cbl.anti-spam.org.cn',
'cblless.anti-spam.org.cn',
'cblplus.anti-spam.org.cn',
'cdl.anti-spam.org.cn',
'combined.njabl.org',
'combined.rbl.msrbl.net',
'csi.cloudmark.com',
'db.wpbl.info',
'dev.null.dk',
'dialup.blacklist.jippg.org',
'dialups.mail-abuse.org',
'dialups.visi.com',
'dnsbl-1.uceprotect.net',
'dnsbl-2.uceprotect.net',
'dnsbl-3.uceprotect.net',
'dnsbl.abuse.ch',
'dnsbl.anticaptcha.net',
'dnsbl.antispam.or.id',
'dnsbl.dronebl.org',
'dnsbl.inps.de',
'dnsbl.justspam.org',
'dnsbl.kempt.net',
'dnsbl.njabl.org',
'dnsbl.sorbs.net',
'dnsbl.tornevall.org',
'dob.sibl.support-intelligence.net',
'drone.abuse.ch',
'dsn.rfc-ignorant.org',
'duinv.aupads.org',
'dul.blackhole.cantv.net',
'dul.dnsbl.sorbs.net',
'dul.ru',
'dyna.spamrats.com',
'dynablock.sorbs.net',
'dyndns.rbl.jp',
'dynip.rothen.com',
'escalations.dnsbl.sorbs.net',
'forbidden.icm.edu.pl',
'hil.habeas.com',
'http.dnsbl.sorbs.net',
'httpbl.abuse.ch',
'images.rbl.msrbl.net',
'intruders.docs.uu.se',
'ips.backscatterer.org',
'ix.dnsbl.manitu.net',
'korea.services.net',
'ksi.dnsbl.net.au',
'mail-abuse.blacklist.jippg.org',
'mail.people.it',
'misc.dnsbl.sorbs.net',
'msgid.bl.gweep.ca',
'multi.surbl.org',
'multi.uribl.com',
'netblock.pedantic.org',
'new.dnsbl.sorbs.net',
'no-more-funn.moensted.dk',
'noptr.spamrats.com',
'old.dnsbl.sorbs.net',
'omrs.dnsbl.net.au',
'opm.tornevall.org',
'orvedb.aupads.org',
'osrs.dnsbl.net.au',
'pbl.spamhaus.org',
'phishing.rbl.msrbl.net',
'probes.dnsbl.net.au',
'proxy.bl.gweep.ca',
'psbl.surriel.com',
'pss.spambusters.org.ar',
'query.senderbase.org',
'rbl-plus.mail-abuse.org',
'rbl.efnetrbl.org',
'rbl.interserver.net',
'rbl.schulte.org',
'rbl.snark.net',
'rbl.spamlab.com',
'rbl.suresupport.com',
'rdts.dnsbl.net.au',
'recent.dnsbl.sorbs.net',
'relays.bl.gweep.ca',
'relays.bl.kundenserver.de',
'relays.mail-abuse.org',
'relays.nether.net',
'residential.block.transip.nl',
'ricn.dnsbl.net.au',
'rmst.dnsbl.net.au',
'rot.blackhole.cantv.net',
'rsbl.aupads.org',
'sbl.spamhaus.org',
'short.rbl.jp',
'smtp.dnsbl.sorbs.net',
'socks.dnsbl.sorbs.net',
'sorbs.dnsbl.net.au',
'spam.dnsbl.sorbs.net',
'spam.olsentech.net',
'spam.rbl.msrbl.net',
'spam.spamrats.com',
'spamguard.leadmon.net',
'spamlist.or.kr',
'spamrbl.imp.ch',
'spamsources.fabel.dk',
'tor.dan.me.uk',
'truncate.gbudb.net',
'ubl.lashback.com',
'ubl.unsubscore.com',
'uribl.swinog.ch',
'url.rbl.jp',
'virbl.bit.nl',
'virus.rbl.jp',
'virus.rbl.msrbl.net',
'web.dnsbl.sorbs.net',
'wormrbl.imp.ch',
'xbl.spamhaus.org',
'zen.spamhaus.org',
'zombie.dnsbl.sorbs.net'
]
def check_rbl(ip, rev, rbl, verbose):
lookup = f'{rev}.{rbl}'
try:
listed = socket.gethostbyname(lookup) != lookup
except socket.gaierror:
listed = False
if verbose:
print(f'Checking {lookup}... [{ "LISTED" if listed else "OK" }]')
else:
print('.', end='', flush=True)
if listed:
return rbl
else:
return None
if __name__ == '__main__':
parser = argparse.ArgumentParser(description='Check if an IP address is listed on any of RBL blacklists.')
parser.add_argument('ip_or_hostname', help='the IP address or hostname to check')
parser.add_argument('-v', '--verbose', action='store_true', help='display each lookup as it is')
args = parser.parse_args()
try:
# Try to convert argument to an IP address
ip = socket.gethostbyname(args.ip_or_hostname)
except socket.gaierror:
# Assume argument is already an IP address
ip = args.ip_or_hostname
rev = '.'.join(reversed(ip.split('.')))
rbl_count = len(rbls)
listed_rbls = []
threads = []
for rbl in rbls:
thread = threading.Thread(target=check_rbl, args=(ip, rev, rbl, args.verbose))
threads.append(thread)
thread.start()
for thread in threads:
rbl = thread.join()
if rbl:
listed_rbls.append(rbl)
if not args.verbose:
print()
print(f'{ip} listed on {len(listed_rbls)} of {rbl_count} known blacklists')
if listed_rbls:
print(f'{ip} listed on {", ".join(listed_rbls)}')
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment