Overview
IMP Worm RBL is a Swiss-operated blacklist maintained by the IMP project, specifically targeting IP addresses whose sending behavior indicates worm or malware infection. Unlike general spam blacklists, Worm RBL focuses on the automated, high-volume sending patterns characteristic of malware-infected machines.
It operates as a sister list to IMP Spam RBL β the two lists complement each other, with Spam RBL covering human-directed spam and Worm RBL targeting machine-generated malicious traffic. Both draw on the same trap infrastructure.
How It Works
IMP operates a network of spam trap mailboxes. When an IP sends emails with patterns consistent with worm propagation or malware payloads β such as mass-mailed executable attachments, probing multiple addresses in rapid succession, or sending known malware signatures β it gets listed in the Worm RBL. Detection is largely automated and updates frequently.
How to Get Delisted
If listed in IMP Worm RBL, the first step is to scan and clean the affected host thoroughly for malware. Check for any processes making unauthorized outbound SMTP connections. After remediation, listings typically expire automatically once the malicious sending stops. IMP does not provide a public self-service removal portal.
This blacklist does not support manual removal. Listings expire automatically once the underlying issue is resolved.