Skip to content

Instantly share code, notes, and snippets.

@mitchellurgero
Created October 4, 2017 20:28
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save mitchellurgero/44ef76123e33bea88ffeabcd53f0cd71 to your computer and use it in GitHub Desktop.
Save mitchellurgero/44ef76123e33bea88ffeabcd53f0cd71 to your computer and use it in GitHub Desktop.
<?php
/*
RBL checker tool for Windows & Linux
By Mitchell Urgero
Code based off of https://gist.github.com/kamermans/1548922 just with *slight* modifications and a proper RBL list.
*/
$mail_server = "111.222.333.444"; // or: trim(exec("curl icanhazip.com")); to get the WAN IP of the current server.
$rbls = array(
'b.barracudacentral.org',
'spam.rbl.msrbl.net',
'zen.spamhaus.org',
'bl.deadbeef.com',
'bl.emailbasura.org',
'bl.spamcannibal.org',
'bl.spamcop.net',
'blackholes.five-ten-sg.com',
'blacklist.woody.ch',
'bogons.cymru.com',
'cbl.abuseat.org',
'cdl.anti-spam.org.cn',
'combined.abuse.ch',
'combined.rbl.msrbl.net',
'db.wpbl.info',
'dnsbl-1.uceprotect.net',
'dnsbl-2.uceprotect.net',
'dnsbl-3.uceprotect.net',
'dnsbl.cyberlogic.net',
'dnsbl.inps.de',
'dnsbl.njabl.org',
'dnsbl.sorbs.net',
'drone.abuse.ch',
'drone.abuse.ch',
'duinv.aupads.org',
'dul.dnsbl.sorbs.net',
'dul.ru',
'dyna.spamrats.com',
'dynip.rothen.com',
'http.dnsbl.sorbs.net',
'images.rbl.msrbl.net',
'ips.backscatterer.org',
'ix.dnsbl.manitu.net',
'korea.services.net',
'misc.dnsbl.sorbs.net',
'noptr.spamrats.com',
'ohps.dnsbl.net.au',
'omrs.dnsbl.net.au',
'orvedb.aupads.org',
'osps.dnsbl.net.au',
'osrs.dnsbl.net.au',
'owfs.dnsbl.net.au',
'owps.dnsbl.net.au',
'pbl.spamhaus.org',
'phishing.rbl.msrbl.net',
'probes.dnsbl.net.au',
'proxy.bl.gweep.ca',
'proxy.block.transip.nl',
'psbl.surriel.com',
'rbl.interserver.net',
'rdts.dnsbl.net.au',
'relays.bl.gweep.ca',
'relays.bl.kundenserver.de',
'relays.nether.net',
'residential.block.transip.nl',
'ricn.dnsbl.net.au',
'rmst.dnsbl.net.au',
'sbl.spamhaus.org',
'short.rbl.jp',
'smtp.dnsbl.sorbs.net',
'socks.dnsbl.sorbs.net',
'spam.abuse.ch',
'spam.dnsbl.sorbs.net',
'spam.spamrats.com',
'spamlist.or.kr',
'spamrbl.imp.ch',
't3direct.dnsbl.net.au',
'tor.dnsbl.sectoor.de',
'torserver.tor.dnsbl.sectoor.de',
'ubl.lashback.com',
'ubl.unsubscore.com',
'virbl.bit.nl',
'virus.rbl.jp',
'virus.rbl.msrbl.net',
'web.dnsbl.sorbs.net',
'wormrbl.imp.ch',
'xbl.spamhaus.org',
'zombie.dnsbl.sorbs.net',
'tor.ahbl.org'
);
if(php_sapi_name() === 'cli'){
$rblOn = array();
foreach($rbls as $rbl){
echo "Checking $rbl\n";
if(ipInDnsBlacklist($mail_server, $rbl)){
echo "$mail_server found on $rbl!\n";
array_push($rblOn, $rbl); //Add to BL return list
} else {
echo "$mail_server not found on $rbl!\n";
}
}
echo "\n";
echo "Server is currently on ".count($rblOn)." blacklists.";
echo "\n";
echo "\n";
$return = json_encode($rblOn);
echo $return."\n\n";
}
function ipInDnsBlacklist($ip, $server, $timeout=1) {
$response = array();
$host = implode(".", array_reverse(explode('.', $ip))).'.'.$server.'.';
$cmd = sprintf('nslookup -type=A -timeout=%d %s 2>&1', $timeout, escapeshellarg($host));
@exec($cmd, $response);
// The first 3 lines (0-2) of output are not the DNS response
for ($i=3; $i<count($response); $i++) {
if (strpos(trim($response[$i]), 'Name:') === 0) {
return true;
}
}
return false;
}
?>
@ntimo
Copy link

ntimo commented Oct 15, 2018

When I access the php page it only returns a white page. Is this the intended behavior?

@mitchellurgero
Copy link
Author

When I access the php page it only returns a white page. Is this the intended behavior?

@ntimo this is intended behavior. Run the script using php-cli (php rbl_check.php via SSH or on server console.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment