EvilNET IRC Network blocklist · since 2019

Is your IP listed on EvilNET DNSBL?

EvilNET DNSBL is a collection of compromised ips obtained using different sources with the purpose of maintaining a black list of unwanted clients in our network.

Your IP is 216.73.217.109

830,588IPs in the blocklist

5,077Added in the last 30 days

rbl.evilnet.orgDNS zone for IRCd & scriptsChecking…

api.evilnet.orgFree JSON APIChecking…

Listed?

Three steps to get delisted

Most listings come from infected machines, open proxies or shared shells. Fix the cause first, then ask for removal.

Check your IP

See if the IP is listed, in which class, when it was added and the attack notes.

IP Search

Clean the machine

Look for drones, trojans, backdoors and misconfigured proxies. On a shell, talk to your shell admin.

Why was I listed?

Request removal

Fill in the removal form properly. Forms that have not been decently filled in will be trashed.

Request Removal

Reply codes

Listing classes

When an IP is listed, rbl.evilnet.org answers with 127.0.0.X. The last number tells you why.

127.0.0.3

Join/Part

Join/part flooding on the network.

Listed IPs78

127.0.0.5

Compromised HOST/IP

A host that has been taken over and used for abuse.

Listed IPs585,979

127.0.0.6

IRC Spam Drone

A client sending spam to channels or users.

Listed IPs108,150

127.0.0.7

DDoS Drone

A machine taking part in denial-of-service attacks.

Listed IPs1,539

127.0.0.8

Open Proxy/HTTP Proxy

An open or misconfigured proxy anyone can use.

Listed IPs122,080

127.0.0.10

Abused VPN Services

A VPN exit that is being used for abuse.

Listed IPs12,667

127.0.0.17

Auto determined botnet IPsdefault

Detected automatically as part of a botnet.

Listed IPs91

127.0.0.18

Compromised DNS/MX type hostname

A DNS or mail server hostname that has been compromised.

Listed IPs4

For IRC admins & developers

Use it on your server

Protect your own IRC network or scripts with the same blocklist EvilNET uses.

DNS zone rbl.evilnet.org for charybdis, InspIRCd and other IRCds
Fast web lookup for eggdrops: /your?ipaddress=IP
JSON API at api.evilnet.org and an npm package

Read the docs

ircd.conf

blacklist {
    host = "rbl.evilnet.org";
    reject_reason = "You have a host listed in the DNSBL EvilNET. For more information, visit https://dnsbl.evilnet.org/your?ipaddress=${ip}";
};

[bl:rbl.evilnet.org]
ban_unknown=false
default_ban_message=Your host is listed in the EvilNet DNSBL (%reason%). https://dnsbl.evilnet.org/your?ipaddress=%ip% for info.
reply:3=Join/Part
reply:5=Compromised HOST/IP
reply:6=IRC Spam Drone
reply:7=DDOS Drone
reply:8=Open Proxy/HTTP Proxy
reply:10=Abused VPN Services
reply:17=Auto determined botnet IPs
reply:18=Compromised DNS/MX type hostname

# Check 1.2.3.4 (the IP goes reversed)
dig +short 4.3.2.1.rbl.evilnet.org
127.0.0.6   # listed: IRC Spam Drone

# Or with the EvilIP script
git clone https://github.com/unixfool/EvilIP.git
cd EvilIP && sh evilip.sh 1.2.3.4

import axios from 'axios';

axios.get("https://api.evilnet.org/rbl/ip/Your-IPAddress-Here")
    .then((result) => console.log(result.data))
    .catch((err) => console.log(err));

// { ipaddress, dateadded, reportedby, iptype,
//   attacknotes, email, location, id }

EvilNET IRC Network

Welcome to EvilNet DNSBL

We want to tell you that we who love IRC find this social network as it is a way of communicating where we prioritize pure text over any other existing format on the internet.

We believe in respect and fun without disturbing anyone. The possibility of chatting on multiple channels and privately between us, makes it our choice.

We affirm the concept of privacy and for that reason, your conversations will always be kept that way, for you, when you choose to chat with someone in a private window.

You should know that in public channels (a main window) we treat each other kindly and respectfully. We hope that you have a good time at Evilnet and of course, we thank you for being part of our network.

What you can't do:

a)Not to damage in any way the network resources or any of its services.
b)Do not carry out or spread illegal or prohibited activities by local and/or international laws.
c)Do not hit/attack any user or Evilnet staff.

We reserve the right to cease any conduct that we detect in the previous points and report it to the authorities that we consider.

What you can do:

Everything else, have a good time, fun and above all, make friends :)

EvilNet DNSBL – What is it?

EvilNET DNSBL is a collection of compromised ips obtained using different sources with the purpose of maintaining a black list of unwanted clients in our network.

Why having a DNSBL on EvilNet?

As we have said, we have DNSBL to take care of the resources of our network and prevent new attacks from the IPs involved in previous attacks. It helps us protect our resources and prevent damage to both our equipment and users or staff. In addition to this, a registry is very useful to facilitate it to the competent authorities when required.

Listed and you think it's a mistake?

Dynamic IPs and shared shells get caught too. Read the notes and send us a removal request.

Request Removal