To be listed in the level 1 list your IP address or network will have sent at least 500 messages to our spamtraps within the last 24 hours. The IP addresses of all hosts that send messages to our spamtraps are recorded and the list is parsed at the end of the day by network blocks of /24 in size (for example searching the iplist for '127.0.0.*' to return all IP addresses between 127.0.0.0 and 127.0.0.255). If more than 500 messages are spotted from these resulting netblocks the netblock is examined in detail.
The IP addresses are scanned to locate the highest IP in the netblock as well as the lowest IP, the nearest network boundary is then calculated along with the appropriate mask to encompass all the IP addresses. For example, if the addresses 127.0.0.2 and 127.0.0.8 are found within 127.0.0.* then the resulting network listed would be 127.0.0.0/28.
To be listed in the level 2 list your IP address or network will have been listed in the level 1 zone during the last 7 days, or multiple networks within the class c sized network (/24) your address is in will have been listed in the Level 1 list. This is probably best explained by example. Consider yourself as having the IP address 127.0.0.14 as part of your network 127.0.0.8/29. There is a spammer using all addresses in the network 127.0.0.128/29 and alternating daily to 127.0.0.64/27 for their spam runs. The first day only 127.0.0.128/29 is listed in Level 1 and Level 2 zones, the second day 127.0.0.64/27 is listed in the Level 1 zone and 127.0.0.0/24 is listed in the Level 2 zone.
The 127.0.0.0/24 Level 2 listing will stay active until the spammer stops spamming from any address or network within 127.0.0.0/24 for 7 consecutive days.
To be listed in the level 3 list your IP address or network will have sent at least 10 messages to our spamtraps within the last 24 hours. The IP addresses of all hosts that send messages to our spamtraps are recorded and the list is parsed at the end of the day by network blocks of /24 in size (for example searching the iplist for '127.0.0.*' to return all IP addresses between 127.0.0.0 and 127.0.0.255). Any IP address found in the DNS Whitelist will be removed from the compiled list**. If more than 500 messages are spotted from these resulting netblocks the netblock is examined in detail.
The IP addresses are scanned to locate the highest IP in the netblock as well as the lowest IP, the nearest network boundary is then calculated along with the appropriate mask to encompass all the IP addresses. For example, if the addresses 127.0.0.2 and 127.0.0.8 are found within 127.0.0.* then the resulting network listed would be 127.0.0.0/28.
To be listed in the level 4 list your IP address or network will have been listed in the level 3 zone during the last 7 days, or multiple networks with in the class c sized network (/24) your address is in will have been listed in the Level 3 list. This is probably best explained by example. Consider yourself as having the IP address 127.0.0.14 as part of your network 127.0.0.8/29. There is a spammer using all addresses in the network 127.0.0.128/29 and alternating daily to 127.0.0.64/27 for their spam runs. The first day only 127.0.0.128/29 is listed in Level 3 and Level 4 zones, the second day 127.0.0.64/27 is listed in the Level 3 zone and 127.0.0.0/24 is listed in the Level 4 zone.
The 127.0.0.0/24 Level 4 listing will stay active until the spammer stops spamming from any address or network within 127.0.0.0/24 for 7 consecutive days.
The spamtraps are prefiltered against a number of publicly available free DNS Based Lists these are: