Level 1: 80689 IP's, Level 2: 9878 Allocations, Level 3: 539 ASN's. Last Updated: 20.09.2021 22:06 CEST
for Level 1
for Level 2
for Level 3
Help for ISPs
How to use
UCEPROTECT Blacklist Policy LEVEL 1
We would like to offer the best available blacklist to users of the entire Internet, which contains zero or as few errors as possible, so that it will cause the rejection of as much spam as possible yet leave solicited, normal legal email unaffected.
In order to achieve this goal, to be the number 1 blacklist, our Level 1 policy only contains single IP addresses [ /32], which were used by spammers / abusers.Level 1 includes both automatic and manual listings.
IP's get listed in Level 1 automatically if they either try to deliver e-mails to spamtraps or if they try to break an SPF Record by forwarding mail that is forbidden by the SPF-Record or if they falsify senders with SRS while no SPF is set for the sender domain or if they are involved in port scans or probes or any kind of attacks against our servers.
To prevent mail servers of responsible providers get Level 1 listed by their customers either intentionally or negligently, we have implemented appropriate protective measures.
Therefore it depends on several factors how many incidents are needed to trigger a Level 1 listing.
Especially if the affected IP has either no or a wrong or a generic reverse DNS, or is in a network area, which emanates abuse regularly, then it is at highest risk to get listed in Level 1 because of a single incident.
If 50 or more spamtraps get hit from a single IP address, we always assume it belongs to a spammer or the computer is compromised.
Finally every member of the UCEPROTECT-Orga can list any IP address manually, if it successfully delivered at least one spam email or if the IP was involved in fraudulent or libelous actions against the UCEPROTECT-Network or if the IP is under control of a well known spammer or spam-supporter.
Since the Level 1 blacklist only contains single IP addresses, it is very unlikely to adversely affect innocent internet users when your system uses Level 1 blocking.
Use of the Level 1 blacklist for blocking is therefore recommended for systems where delivery of regular emails is more important than spam defense.If you are a true BOFH you would logically block using all of our levels.
To get an idea how UCEPROTECT-Level 1 and other blacklists did perform within the last 4 weeks see the statistics measured at the real mailflow of several authorities in Germany, Austria and Switzerland.
Since 28 th June 2007 UCEPROTECT Level 1 does no longer list backscatterer and sender callout abusers. A new list was established to deal with those:
Details see: http://www.backscatterer.org