intellexapps / blcheck Goto Github PK

I'm trying to make this script compatible with IPv6, so I just need to understand one last thing, what is the purpose of the -d option?

Hi,

I ran the script on a domain and it concluded with 2 blacklisted.

1. Does 2 blacklisted refer to the 2 lines of gremlin.ru?
2. Are the 2 lines of gremlin.ru: 127.0.0.2 considered valid?
3. What are the 2 lines trying to say actually?

vote.drbl.gremlin.ru : 127.0.0.2
work.drbl.gremlin.ru : 127.0.0.2

----------------------------------------------------------
Results for xxxxxxxx

Tested:        117
Passed:        114
Invalid:       1
Blacklisted:   2
----------------------------------------------------------

would be nice to run multiple digs at once, to the capacity of the server. the loop for the blacklist would need to be functionized and then passed to either parallel or xargs

I have couple of /22 ip block. Would it be possible to modify it to support ip block and then dump a summary?

Hi,
the result we have for BL hostkarma.junkemailfilter.com is the follow:
hostkarma.junkemailfilter.com blacklisted (127.0.1.1)

In this doc:
http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists#No_Blacklist_List

127.0.1.1 means no BL (nobl listed - not a spam source - do not blacklist - maybe whitelist)
So seems that blcheck returns the wrong value.
You can check with:
blcheck -p 185.152.70.137

regards
emiliano

Shellcheck is a linter for shell scripts, that helps avoid undesired behaviours.

Here's the output against master.
https://gist.github.com/vsviridov/da9a253f214bf25923a3

Hi,

I have got one IP which are yellow listed, but blcheck give a false blacklist reply :

xx.xx.xx.xx.xx is Yellow listed - This is a good listing. It keeps you from being blacklisted.
Yellow means that your IP contains no information as to whether or not it is spam. Yahoo, Google, and Hotmail are Yellow Listed.

----------------------------------------------------------
hostkarma.junkemailfilter.com : 127.0.0.3                 
                                                    
----------------------------------------------------------
Results for smtp-04.xxx.xxx.xxx.xxx.fr

Tested:        117
Passed:        116
Invalid:       0
Blacklisted:   1

Hi !

Thanks for this great tool, it does exactly what I was looking for :)

Would there be any way to implement IPv6 support ?

I'm not too worried about the detection itself (we can find/make a decent regex to detect IPv6 inputs), more about the blacklists themselves :

• Do they maintain IPv6 blacklists ?
• Is the querying mechanism different ?
• It this gonna make some of them consider the input as invalid ?

Anybody has any thoughts, or even tried it so far ?

Hello,

Simply runnig your script and have 3 warnings :

./blcheck: 176: ./blcheck: [[: not found
./blcheck: 321: ./blcheck: shopt: not found
./blcheck: 327: ./blcheck: [[: not found
Warning: PTR record does not match supplied domain: test1.net != ns.test1.net

---

Results for test1.net

Tested: 117
Passed: 117
Invalid: 0
Blacklisted: 0

error 321 related to shopt binary, but I've got it in my path.

Regards

some syntax in the script is incompatible with /bin/sh, e.g. ${} or $()

shebang has to be something like /bin/bash

--- a/blcheck
+++ b/blcheck
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash

Hey!

Firstly, thank you for maintaining this awesome tool... it saves me a hell of a hard time...

Lately I've been seeing this (ever since the update of 17th this month i believe):

[ \ 100% ] checking... 1 / 1 /usr/bin/dig: '81.200.248.178.0spam-killlist.fusionzero.com\n0spam.fusionzero.com\naccess.redhawk.org\nall.rbl.jp\nall.spam-rbl.fr\nall.spamrats.com\naspews.ext.sorbs.net\nb.barracudacentral.org\nbackscatter.spameatingmonkey.net\nbadnets.spameatingmonkey.net\nbb.barracudacentral.org\nbl.drmx.org\nbl.konstant.no\nbl.nszones.com\nbl.spamcannibal.org\nbl.spameatingmonkey.net\nbl.spamstinks.com\nblack.junkemailfilter.com\nblackholes.five-ten-sg.com\nblacklist.sci.kun.nl\nblacklist.woody.ch\nbogons.cymru.com\nbsb.empty.us\nbsb.spamlookup.net\ncart00ney.surriel.com\ncbl.abuseat.org\ncbl.anti-spam.org.cn\ncblless.anti-spam.org.cn\ncblplus.anti-spam.org.cn\ncdl.anti-spam.org.cn\ncidr.bl.mcafee.com\ncombined.rbl.msrbl.net\ndb.wpbl.info\ndev.null.dk\ndialups.visi.com\ndnsbl-0.uceprotect.net\ndnsbl-1.uceprotect.net\ndnsbl-2.uceprotect.net\ndnsbl-3.uceprotect.net\ndnsbl.anticaptcha.net\ndnsbl.aspnet.hu\ndnsbl.inps.de\ndnsbl.justspam.org\ndnsbl.kempt.net\ndnsbl.madavi.de\ndnsbl.rizon.net\ndnsbl.rv-soft.info\ndnsbl.rymsho.ru\ndnsbl.sorb' is not a legal name (ran out of space)

and that's it nothing else is done...

system is Centos 7, fully upgraded...

Cheers!

hello, how about implementing the option to send email when an ip is found blacklisted or not?
and how about set the script to run once per week with a cronjob or something..?

It seems the script consider the whole black list as only one entry...
I'm using bash 4.4.19 if that matters, on a fairly uptodate gentoo/linux computer. Really nothing special there.

(i got the same error if forcing the script to use 'host' instead of 'dig')

orzel@berlioz orzel/clones/blcheck% ./blcheck xxxx
[ \ 100% ] checking... 1 / 1 /usr/bin/dig: '244.38.64.82.0spam-killlist.fusionzero.com\n0spam.fusionzero.com\naccess.redhawk.org\nall.rbl.jp\nall.spam-rbl.fr\nall.spamrats.com\naspews.ext.sorbs.net\nb.barracudacentral.org\nbackscatter.spameatingmonkey.net\nbadnets.spameatingmonkey.net\nbb.barracudacentral.org\nbl.drmx.org\nbl.konstant.no\nbl.nszones.com\nbl.spamcannibal.org\nbl.spameatingmonkey.net\nbl.spamstinks.com\nblack.junkemailfilter.com\nblackholes.five-ten-sg.com\nblacklist.sci.kun.nl\nblacklist.woody.ch\nbogons.cymru.com\nbsb.empty.us\nbsb.spamlookup.net\ncart00ney.surriel.com\ncbl.abuseat.org\ncbl.anti-spam.org.cn\ncblless.anti-spam.org.cn\ncblplus.anti-spam.org.cn\ncdl.anti-spam.org.cn\ncidr.bl.mcafee.com\ncombined.rbl.msrbl.net\ndb.wpbl.info\ndev.null.dk\ndialups.visi.com\ndnsbl-0.uceprotect.net\ndnsbl-1.uceprotect.net\ndnsbl-2.uceprotect.net\ndnsbl-3.uceprotect.net\ndnsbl.anticaptcha.net\ndnsbl.aspnet.hu\ndnsbl.inps.de\ndnsbl.justspam.org\ndnsbl.kempt.net\ndnsbl.madavi.de\ndnsbl.rizon.net\ndnsbl.rv-soft.info\ndnsbl.rymsho.ru\ndnsbl.sorbs.' is not a legal name (ran out of space)

Results for xxx

Tested: 1
Passed: 1
Invalid: 0
Blacklisted: 0

Hi,

What is the license of blcheck ?

Best regards

please see https://www.spamhaus.org/organization/statement/008/fake-dnsbl-uncovered-nszones.com

https://www.spamhaus.org/news/article/807/using-our-public-mirrors-check-your-return-codes-now.

The following results indicate an error:

• 127.255.255.252
• 127.255.255.254
• 127.255.255.255

These should not be treated as if the input IP is on the blacklist.