Description:

The streamlined blackhole list server is a real-time,
machine-automated blackhole server designed to blacklist network
addresses which exceed a threshold of network spread - that is,
abuse from an address which has been reported by a number of
participating networks (as opposed to how most other blacklists
function, based on total number of reports). The SBL server
blacklists addresses until they have cleared a minimum duration
(an hour by default) without any additional reports. The SBL is
designed to function via automated machine-learning spam filters,
such as Bayesian filters. Each participating network is granted
write authentication in the SBL, to prevent abuse. A client tool
is also provided.

Machine automation is performed by any statistical filter capable
of dynamically identifying spam, its source network address, and
using the SBL. This doesn't mean, however, that the SBL server
should be limited to tracking only spammers. The DSPAM SBL can
easily be adapted to track any kind of network-based phenomenon
over a large spread or even redesigned to track viruses.

There are two ways to query the SBL. The first is via DNS. The SBL
supports the same DNS nomenclature most other blackhole lists
support. The second is via TCP stream, which allows very
lightweight, high-speed and high-volume queries. The protocol can
be found in the example client.