# SORBS dynamic IP listing: what 127.0.0.10 meant > SORBS answered 127.0.0.10 when an IP sat in a home ISP's range, so a residential proxy got listed for being residential. Read the code first. Source: https://mosaicbrowser.com/blog/sorbs-dynamic-range-listing ## A blocklist that lists home connections for being home SORBS answered 127.0.0.10 when an IP sat in a home ISP's range, so a residential proxy got listed for being residential. Read the code first. ![Listed for being exactly what you paid for](https://mosaicbrowser.com/covers/sorbs-dynamic-range-listing.webp) SORBS had a return code for an address whose only offence was being a home connection. Ask its combined zone, `dnsbl.sorbs.net`, about an IP inside a range SORBS believed an ISP handed out dynamically, and the answer was `127.0.0.10`. A residential exit (the proxy people pay extra for because it is somebody's home line) could come back listed for exactly that. So a `.10` hit describes the exit rather than accusing it, and a reputation check that scores it as a strike has read the answer and skipped the code. ## How a DNS blocklist says why A DNS blocklist is queried with `dig`, or with the resolver every mail server already has. For `203.0.113.45` you flip the octets and tack on the zone, `45.113.0.203.dnsbl.sorbs.net`, then ask for its A record. `NXDOMAIN` comes back if the address is not listed. If it is, you get something like `127.0.0.10`, which nobody would ever connect to; the last octet is a reason code, looked up in a table the list operator publishes. SORBS ran many sub-lists (proxies, relays, spam traps, the DUHL) and served them all from `dnsbl.sorbs.net`, with the last octet saying which one had fired. The table in our proxy check, with the wording the report uses: | Answer | Meaning | | --- | --- | | `127.0.0.2` | Open HTTP proxy | | `127.0.0.3` | Open SOCKS proxy | | `127.0.0.4` | Open proxy of another kind | | `127.0.0.5` | Open relay | | `127.0.0.6` | Spam source | | `127.0.0.7` | Vulnerable web server | | `127.0.0.9` | Hijacked network range | | `127.0.0.10` | Dynamic or residential range | | `127.0.0.11` | Badly configured host | | `127.0.0.12` | Does not accept mail | Most of those rows record behaviour: somebody relayed mail through the box, received spam from it, found a SOCKS port open on it. Row `.10` records a category. It came from the DUHL, the Dynamic User and Host List, which was built from ranges ISPs declared dynamic and from reverse DNS names that look like home lines (`pool-71-…`, `dyn-…`, `…dsl…`). Nobody reported the address. It was listed because of whose network it sat on. Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: Provider minting](https://mosaicbrowser.com/features/proxy-providers) ## Why a mail list cared about home addresses The DUHL answered one question for mail servers. A laptop on a cable line should hand outgoing mail to its ISP's relay; one that opens port 25 to Gmail itself is the classic sign of an infected machine sending spam. A mail server that refused every DUHL address lost almost no real mail. Websites ask the opposite question. A shop or an ad dashboard gets most of its visits from exactly those `pool-` hostnames. For browsing, a `.10` listing is the normal case, and a "residential" proxy that failed to match a home-line pattern would be the odder find. ## Why the hit is not the finding A checker that stops at "did the name resolve" gets this backwards. Under that rule a home exit carrying one `.10` and an address caught sending spam (`.6`) both get one strike, and the report can't tell a household from an abuser. A row reading "Listed on SORBS" sends you off to replace a perfectly good exit. A row reading "SORBS: Dynamic or residential range" tells you the seller delivered a home line, which is what you paid for. ## What our own check does with it Mosaic's proxy check, `checkReputation` in `src/main/proxy/reputation.ts`, asks six public lists through `1.1.1.1` and `8.8.8.8` (so an ISP resolver that filters DNSBL zones cannot change the answer), and SORBS is one of the six. Each A record goes through that list's table before anything is shown. A code missing from the table is printed raw, `127.0.0.8` and all, so an unknown answer looks strange instead of clean. The score is blunter than the report, and we would rather say so here than have someone find it. `Math.min(60, listings.length * 25)`: 25 per list that answered, capped at 60. Another 20 if any meaning matches `/proxy|relay/i`. Another 25 if the reverse DNS, ISP or ASN looks like a datacentre, and 5 if there is no reverse DNS at all. Below 25 is `clean`, 25 to 59 `caution`, 60 or more `risky`. "Dynamic or residential range" does not match the proxy pattern, but it is still a listing, so a home exit with no PTR record that sat only on the DUHL would score 30 and come back `caution`. The meaning printed next to it is the part to believe. Weighting by code, starting from the table above, is the version of this check we want and have not shipped. There is a catch in the SORBS row itself. Proofpoint, which owned SORBS, has since shut it down, and `dnsbl.sorbs.net` no longer answers. `checkList` returns `null` for `NXDOMAIN` and for a timeout alike, so a dead zone is indistinguishable from a clean one, and the report's `listsChecked` still counts six lists when SORBS, one of them, cannot reply. That row ought to be dropped or marked as dead, and so far it has been neither. We made the same trade the other way round when we [left Spamhaus out](https://mosaicbrowser.com/blog/spamhaus-public-resolver): Spamhaus refuses public resolvers with an error code that looks like a listing, and a list that cannot answer honestly from an ordinary computer does more harm than a missing one. A clean row means nothing we asked said otherwise. It is not proof. ## How to read a SORBS dynamic IP listing on your exit If a checker you use flags a residential proxy, look for the code or the list name before you look at the colour. 1. A policy list (SORBS's DUHL in its day, or any list whose description says dynamic, residential or end-user ranges) means the address is a home connection. For browsing, that is expected. 2. A behaviour listing (spam source, open proxy, open relay, hijacked range) means somebody has seen the address misbehave. On a shared residential pool that can be another customer's doing, and minting a new session is the usual way to get a different exit. 3. A SORBS hit of any kind today comes from a stale checker or a misread error, because the list no longer answers. A blocklist is only one input. The sold databases that track proxy pools are not public, so a clean result from public lists does not mean a detector's vendor has never seen the address; we met a case of that in [a residential IP several detectors already knew](https://mosaicbrowser.com/blog/residential-ip-detected-as-proxy). What makes an address residential in the first place is in the [residential proxy glossary entry](https://mosaicbrowser.com/glossary/residential-proxy), and the full set of checks we run on an exit, by hand or in the app, is in [how to check a proxy before you use it](https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it). ## Questions ### What was a SORBS dynamic IP listing? SORBS kept a Dynamic User and Host List of address ranges it believed were handed out to home and mobile customers. An address in one of those ranges was listed whether or not it had ever sent spam, and the combined zone answered 127.0.0.10 for it. ### Can I still get delisted from SORBS? No. Proofpoint, which owned SORBS, shut it down and the zones went quiet, so there is no list left to be removed from. If a checker still shows you a SORBS hit, it is working from a cached copy or reading a lookup error as a listing. ### Does a dynamic or residential listing mean my proxy is bad? Not for browsing. A policy list of that kind exists so mail servers refuse mail sent straight from home connections. A residential exit is on it because it is residential. Listings for spam, open proxies or hijacked ranges are the ones that describe what an address has done. ### How does Mosaic score a blocklist hit? It prints the list's own meaning for the code beside the hit, and adds 25 risk points per listing up to 60, plus 20 more when the meaning names an open proxy or relay. The points do not yet tell a policy listing from a behaviour one, which is why we print the meaning. ## Related [Why our reputation check doesn't ask Spamhaus](https://mosaicbrowser.com/blog/spamhaus-public-resolver): Spamhaus refuses queries that arrive through public resolvers, so asking it from an ordinary computer returns a confident wrong answer. We left it out instead. [The residential IP several detectors already knew](https://mosaicbrowser.com/blog/residential-ip-detected-as-proxy): A residential proxy can be detected as a proxy because it is one. On one Wichita exit, FingerprintJS and incolumitas never loaded in three rounds. [How to check a proxy before you use it](https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it): Check that a proxy answers and tunnels, where its exit really is, whether the address is residential or blocklisted, and that the browser stays behind it. [Residential proxy: an exit on a home internet connection](https://mosaicbrowser.com/glossary/residential-proxy): A residential proxy sends your traffic out through an address an ISP assigned to a home connection, so sites see a household rather than a data center. [Detecting a proxy with two clocks](https://mosaicbrowser.com/blog/proxy-detection-by-latency): A server times the TCP handshake to the exit and a round trip to the browser. Behind a proxy the second is longer, and the gap is the tunnel. ["Unlimited bandwidth" proxies and where the limit really is](https://mosaicbrowser.com/blog/unlimited-bandwidth-proxies): An unlimited bandwidth residential proxy still has a limit. It moves to threads, ports, speed or a fair-use clause, and the terms say which one. [The proxy bill is usually bigger than the browser bill](https://mosaicbrowser.com/blog/proxy-bill-bigger-than-browser): Past a couple of dozen profiles, the exits cost more each month than the anti-detect browser. That is why we price per month, not per profile. [Through a proxy, your TCP fingerprint is the exit's](https://mosaicbrowser.com/blog/tcp-fingerprint-belongs-to-the-exit): A proxy's exit opens its own TCP connection, so the TTL, window and options a site reads come from the exit's system, not your browser or your computer. ## Mosaic, on your own computer The browser this blog is about: its own Chromium, fingerprints from real machines and a proxy exit per profile. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.