How Do You Get Listed?
An IP address or domain is added to the AbuseBL blocklist when our systems detect spam or abuse activity originating from or associated with it. Listings happen automatically — there is no human approval step. There are three primary sources that trigger a listing:
1. Spam to Honeypot Addresses
We operate a large network of email addresses (honeypots) that have never been used to send or receive legitimate email. These addresses are seeded across the internet in locations typically harvested by spam bots.
Any email sent to one of our honeypot addresses is, by definition, unsolicited. The originating IP address and sending domain are immediately logged and added to the blocklist. There is no grace period — a single hit on a honeypot address is sufficient to trigger a listing.
2. Direct Spam to Our Domains
AbuseBL manages a number of domains for the sole purpose of abuse detection. These domains do not belong to any organisation and are not used for any legitimate email communication.
Any email directed to addresses under these domains is treated as spam. Our systems automatically extract the originating IP address and the sender's domain and add them to the blocklist.
3. Reports from Our Clients
Our network of partner organisations and clients submit verified spam reports to us. Each report undergoes automated cross-referencing and validation before it is used to generate a listing.
Client reports are weighted — a high volume of reports from multiple independent clients against the same IP or domain results in a faster and potentially longer listing. Reports from a single source undergo stricter validation before being actioned.
How Does Delisting Work?
There is no manual delisting process. All listings expire on their own after the penalty period has elapsed. You do not need to submit a request to be removed from the blocklist — simply stop the abuse activity and wait for the listing to expire.
Escalation Policy: Longer Blocks for Repeat Offences
The length of a listing is not fixed. It depends on the history of abuse associated with the IP address or domain in question. Our escalation policy works as follows:
| Offence | Block Duration | Notes |
|---|---|---|
| 1st listing | 24 hours | Short block; opportunity to identify and fix the issue. |
| 2nd listing | 7 days | The issue was not resolved after the first block. |
| 3rd listing | 30 days | Persistent abuse pattern detected. |
| 4th listing+ | 90 days | Severe or repeated abuse. |
| Permanent | Indefinite | Persistent, high-volume, or malicious abuse with no remediation. Does not expire automatically — manual review required. |
The offence counter resets only after a significant clean period following the expiry of the previous listing. If a new listing occurs before the counter resets, the next escalation level applies automatically.
What You Should Do
- Investigate the source of abuse. Check your sending infrastructure for compromised accounts, open relays, malware infections, or misconfigurations.
- Stop the abuse activity. Fix the underlying problem. Blocking port 25 for the affected IP and reviewing your email authentication (SPF, DKIM, DMARC) is a good start.
- Wait for the listing to expire. Once the abuse has stopped, do nothing. Your listing will expire automatically at the end of the block period.
Communication Policy
AbuseBL does not communicate with third parties, intermediaries, delisting services, or individuals who do not demonstrate ownership or administrative control over the listed resource.
If you contact us regarding a listing, you must be able to demonstrate that you are:
- The registered holder of the IP address or IP range (as shown in WHOIS / RIR records), or
- The administrative contact for the domain listed in WHOIS records, or
- A designated abuse contact registered with the appropriate Regional Internet Registry (RIR).
Emails from hosting customers, end users, resellers, or anyone other than the direct IP holder or domain registrant will not receive a substantive response regarding listings.