SORBS had a return code for an address whose only offence was being a home connection. Ask its combined zone, dnsbl.sorbs.net, about an IP inside a range SORBS believed an ISP handed out dynamically, and the answer was 127.0.0.10. A residential exit (the proxy people pay extra for because it is somebody's home line) could come back listed for exactly that. So a .10 hit describes the exit rather than accusing it, and a reputation check that scores it as a strike has read the answer and skipped the code.
How a DNS blocklist says why
A DNS blocklist is queried with dig, or with the resolver every mail server already has. For 203.0.113.45 you flip the octets and tack on the zone, 45.113.0.203.dnsbl.sorbs.net, then ask for its A record. NXDOMAIN comes back if the address is not listed. If it is, you get something like 127.0.0.10, which nobody would ever connect to; the last octet is a reason code, looked up in a table the list operator publishes.
SORBS ran many sub-lists (proxies, relays, spam traps, the DUHL) and served them all from dnsbl.sorbs.net, with the last octet saying which one had fired. The table in our proxy check, with the wording the report uses:
| Answer | Meaning |
|---|---|
127.0.0.2 | Open HTTP proxy |
127.0.0.3 | Open SOCKS proxy |
127.0.0.4 | Open proxy of another kind |
127.0.0.5 | Open relay |
127.0.0.6 | Spam source |
127.0.0.7 | Vulnerable web server |
127.0.0.9 | Hijacked network range |
127.0.0.10 | Dynamic or residential range |
127.0.0.11 | Badly configured host |
127.0.0.12 | Does not accept mail |
Most of those rows record behaviour: somebody relayed mail through the box, received spam from it, found a SOCKS port open on it. Row .10 records a category. It came from the DUHL, the Dynamic User and Host List, which was built from ranges ISPs declared dynamic and from reverse DNS names that look like home lines (pool-71-…, dyn-…, …dsl…). Nobody reported the address. It was listed because of whose network it sat on.
Paste one gateway line. Every profile mints its own exitIn Mosaic: Provider minting. One gateway line, a separate exit for every profile. Free holds 3 profiles. Pro is $49 a month for any number.
Mosaic is a desktop app
Email yourself the link and open it on your computer.
How it works: Provider minting
Why a mail list cared about home addresses
The DUHL answered one question for mail servers. A laptop on a cable line should hand outgoing mail to its ISP's relay; one that opens port 25 to Gmail itself is the classic sign of an infected machine sending spam. A mail server that refused every DUHL address lost almost no real mail.
Websites ask the opposite question. A shop or an ad dashboard gets most of its visits from exactly those pool- hostnames. For browsing, a .10 listing is the normal case, and a "residential" proxy that failed to match a home-line pattern would be the odder find.
Why the hit is not the finding
A checker that stops at "did the name resolve" gets this backwards. Under that rule a home exit carrying one .10 and an address caught sending spam (.6) both get one strike, and the report can't tell a household from an abuser.
A row reading "Listed on SORBS" sends you off to replace a perfectly good exit. A row reading "SORBS: Dynamic or residential range" tells you the seller delivered a home line, which is what you paid for.
What our own check does with it
Mosaic's proxy check, checkReputation in src/main/proxy/reputation.ts, asks six public lists through 1.1.1.1 and 8.8.8.8 (so an ISP resolver that filters DNSBL zones cannot change the answer), and SORBS is one of the six. Each A record goes through that list's table before anything is shown. A code missing from the table is printed raw, 127.0.0.8 and all, so an unknown answer looks strange instead of clean.
The score is blunter than the report, and we would rather say so here than have someone find it. Math.min(60, listings.length * 25): 25 per list that answered, capped at 60. Another 20 if any meaning matches /proxy|relay/i. Another 25 if the reverse DNS, ISP or ASN looks like a datacentre, and 5 if there is no reverse DNS at all. Below 25 is clean, 25 to 59 caution, 60 or more risky. "Dynamic or residential range" does not match the proxy pattern, but it is still a listing, so a home exit with no PTR record that sat only on the DUHL would score 30 and come back caution. The meaning printed next to it is the part to believe. Weighting by code, starting from the table above, is the version of this check we want and have not shipped.
There is a catch in the SORBS row itself. Proofpoint, which owned SORBS, has since shut it down, and dnsbl.sorbs.net no longer answers. checkList returns null for NXDOMAIN and for a timeout alike, so a dead zone is indistinguishable from a clean one, and the report's listsChecked still counts six lists when SORBS, one of them, cannot reply. That row ought to be dropped or marked as dead, and so far it has been neither. We made the same trade the other way round when we left Spamhaus out: Spamhaus refuses public resolvers with an error code that looks like a listing, and a list that cannot answer honestly from an ordinary computer does more harm than a missing one. A clean row means nothing we asked said otherwise. It is not proof.
How to read a SORBS dynamic IP listing on your exit
If a checker you use flags a residential proxy, look for the code or the list name before you look at the colour.
- A policy list (SORBS's DUHL in its day, or any list whose description says dynamic, residential or end-user ranges) means the address is a home connection. For browsing, that is expected.
- A behaviour listing (spam source, open proxy, open relay, hijacked range) means somebody has seen the address misbehave. On a shared residential pool that can be another customer's doing, and minting a new session is the usual way to get a different exit.
- A SORBS hit of any kind today comes from a stale checker or a misread error, because the list no longer answers.
A blocklist is only one input. The sold databases that track proxy pools are not public, so a clean result from public lists does not mean a detector's vendor has never seen the address; we met a case of that in a residential IP several detectors already knew. What makes an address residential in the first place is in the residential proxy glossary entry, and the full set of checks we run on an exit, by hand or in the app, is in how to check a proxy before you use it.
