Cloud DNS: <key>.nod.mail.abusix.zone.
Rsync File: lists/nod.zone
Return Codes: 127.0.1.2
Test Points: *.test
Listing duration: 25 hours
This list is built from data provided by our partner Farsight Security using their massive real-time Passive DNS sensor network and is not reliant on any data from WHOIS. This has the advantage that it works across every single TLD and ccTLD, it also means that a domain could have been registered months previously, but not used until now.
This list contains all of the newly observed domains that we received from Farsight within the last 25 hours, with each domain wildcarded - it does not mean the domain is bad, but knowing a domain is new can be useful for other things like scoring or meta rules.
Our domain blacklist (dblack) already contains any newly observed domains that have been seen sending mail to any of our traps or partner transaction feeds.
NOTE: as this list uses wildcard domains, it lists the parent domain and any sub-domains, so you do not need to normalize the domain name in anyway before querying it.