About

fmb.la is a composite blocklist made from multiple sources, weighted and only the worst actors are listed.

Supplemental information about ASNs is provided by PeeringDB.

Return Codes

bl.fmb.la

Query Response Name Meaning
domain / ip / ns / email 127.0.0.2 lvl1 Entry is blocked
ip 127.0.1.2 lvl2 Level 2 block
asn 127.0.2.2 lvl3 Level 3 block
ip 127.0.1.24 slash24 Spammy /24
ip 127.0.1.25 slash25 Spammy /25
ip 127.0.1.26 slash26 Spammy /26
ip 127.0.1.27 slash27 Spammy /27
ip 127.0.1.28 slash28 Spammy /28
bitcoin address 127.1.1.2 btcbl Bad bitcoin address
- 127.255.255.255 blocked Your IP has been blocked for too many requests

short.fmb.la

Query Response Name Meaning
domain 127.0.0.2 short Domain hosts a URL shortener
- 127.255.255.255 blocked Your IP has been blocked for too many requests

fresh.fmb.la

Query Response Name Meaning
domain 127.2.0.2 fresh Domain registered in last 7 days
domain 127.2.0.14 fresh14 Domain registered in last 7-14 days
domain 127.2.0.28 fresh28 Domain registered in last 14-28 days
- 127.255.255.255 blocked Your IP has been blocked for too many requests

ix.fmb.la

Query Response Name Meaning
ixhash 127.0.0.2 iXhash iXhash is blocked
- 127.255.255.255 blocked Your IP has been blocked for too many requests
Level 1 - Individual IPs

Level 1 listings are bad actor IPs that have been identified by our weighted composite list. This listing takes into account the characteristics of abuse as well as other heuristics based around the IP identity and trust. We would recommend scoring highly an email relayed directly from a Level 1 listed IP.

Auto-delisting

Once no abuse is seen from your IP for 7 days it will automatically be delisted.

Manual delisting

A manual delist can be performed by an individual confirming their ownership of the FCrDNS domain of the IP. More information can be found below.

FAQ

  • Help, my IP is listed!
    Before requesting a delist, ensure that your IP is truly clean - subsequent re-listings delay the delist eligability. More below.
  • My IP keeps getting re-listed
    Before requesting a delist, ensure that your IP is truly clean - subsequent re-listings delay the delist eligability. More below.
Level 2 Subnets

Level 2 listings are for identifying potentially bad IP ranges as announced by ASNs - for more definitive subnet detection see Neighbourhoods. Scoring on email should be done conservatively.

An ASN announced subnet will become listed when providers fail to react to Level 1 listings by continuing to support abuse. Level 2 listings will automatically be removed when the number of IPs in Level 1 falls below the trigger point. The trigger value can be found on the announcing ASN's page on this website.

If you are sure your IP is clean only your ISP can make steps to get a Level 2 delist - to do this they should suspend and cancel other abusers on your subnet. You can also reqest your ISP move your IP allocation to a clean range not affected by abusers.

To ISPs: Sorry your subnet has been listed. To delist Level 2 subnets please remove the abusers from this subnet. Please get in contact to discuss listed IPs.

Level 3 - ASNs

Out of 10,000's of ASNs only a few get listed here (< 0.5%). Level 3 identifies ASNs with many IPs listed in Level 1. To be listed in Level 3, 0.2% or 100 IPs (whichever is greater) announced by the ASN must be listed in Level 1. This is an indication of an ISP that is open to abuse and/or is reluctant to react. We don't recommend blocking based on a Level 3 listing, but to scrutinise email from these sources closely.

To be delisted from the Level 3 list, the number of Level 1 listings should be below the Level 3 trigger point for that ASN.

To ISPs: Sorry you have been listed. It looks as though a lot of your IPs are used for abuse - please stop listed IPs from abusing. After 7 days of no abuse from said IPs they will be removed from Level 1 - once you are below the trigger point (0.2% or 100 IPs) the Level 3 listing will be automatically removed.

Neighbourhoods

These are bad neighbourhoods - don't slow down here!
Over 30% of the associated subnet is listed in Level 1 listings - for smaller subnets this is a very significant sign of a bad subnet neighbourhood. Because smaller subnets are often handed out to companies from hosting providers the subnets go as low as /28. If you have an IP within a bad neighbourhood the only way to be deslisted is that < 30% of the range is listed in Level 1.

CIDRLengthLimit
/2425677
/2512838
/266419
/273210
/28165
Delisting

Auto Delisting

All Level 1 listings will be automatically removed after 7 days of no abuse.

Level 1 Delist

To delist an IP address the FCrDNS must be confirmed and you must have control over the FCrDNS domain.

To delist you can use the following steps

  • Ensure that your IP has FCrDNS[Wikipedia] to a domain you control
  • Login to the fmb.la website.
  • Lookup your IP address on the website.
  • If delisting is allowed a button will be present. If not a reason will be given.
  • Click to claim the domain associated with the FCrDNS.
  • To claim the domain, you'll need to enter a unique string as a TXT record to _fmbla.yourdomain.com
  • Once you have claimed your domain you will then be able to select to delist the IP from the lookup page.
All IPs delisted should be delisted within the next hour.

Level 2 Delist

End users: You cannot affect the listing of a Level 2 listing. Please contact your ISP.

To ISPs: Sorry your subnet has been listed. To delist Level 2 subnets please remove the abusers from this subnet. Please get in contact to discuss listed IPs.

Level 3 Delist

End users: You cannot affect the listing of a Level 3 listing. Please contact your ISP.

To ISPs: Sorry you have been listed. It looks as though a lot of your IPs are used for abuse - please stop listed IPs from abusing. After 7 days of no abuse from said IPs they will be removed from Level 1 - once you are below the trigger point (0.2% or 100 IPs) the Level 3 listing will be automatically removed.