How to remove your IP from CBL (Abuseat)

The CBL is now part of the Spamhaus XBL. Here is what a cbl.abuseat.org listing means, and how to get off it.

Check your domain free → CBL (Abuseat) removal tool ↗

What it is

The list, in plain terms.

The Composite Blocking List (CBL) was an IP blocklist that detected machines behaving like spam-sending bots — infected, compromised or misconfigured hosts caught by mail-traffic analysis. It listed IP addresses only, never domains.

The CBL was retired in early 2021. Its data and detection were absorbed into the Spamhaus Exploits Blocklist (XBL), and Spamhaus now manages all CBL listings, lookups and removals. The legacy zone cbl.abuseat.org still answers queries for now, but abuseat.org itself redirects to Spamhaus, and the old lookup page at abuseat.org/lookup.cgi sends you to check.spamhaus.org.

In practice a cbl.abuseat.org listing today is an XBL listing. It means a machine on that IP looks compromised or is emitting bot-like mail — not that you deliberately sent spam. You fix it through Spamhaus.

Why you get listed

What a listing on CBL (Abuseat) means.

A compromised or infected host Malware, a bot or a hijacked device on the IP is sending mail directly. This is the classic CBL and XBL trigger — the machine is being abused, often without the owner knowing.

Bot-like sending behaviour Mail traffic from the IP matches the fingerprints of automated spam engines: direct-to-MX delivery, malformed sessions, or patterns Spamhaus associates with spambots.

An open proxy or relay A misconfigured server on the IP accepts and forwards mail for anyone, so spammers route through it. Closing the relay is part of the fix.

Brute-force or exploit activity The IP has been seen attacking other machines, connecting to malware sinkholes, or otherwise showing signs of being insecure or infected.

How to get removed

Delisting, in order.

Removal is free. Fix the cause first — a listing you clear without a fix comes straight back.

1 Look the IP up at Spamhaus. Enter the IP at check.spamhaus.org. Because the CBL is now the XBL, the checker is where a cbl.abuseat.org listing is confirmed and explained. It tells you why the IP is listed and whether self-service removal is available.
2 Find and clean the compromised machine. Identify the host behind the IP. Scan for and remove malware, close any open proxy or relay, patch the vulnerability, and secure any abused mail account or web form. If several devices share the IP behind NAT, check each one.
3 Fix the cause before you request removal. Removal only sticks once the abuse has stopped. If you delist while the machine is still infected or the relay is still open, the automated detection re-lists the IP almost immediately.
4 Request removal through the checker. On the check.spamhaus.org result page for your IP, follow the removal option. Self-service removal is free. It is blocked while abuse is still being detected on the IP, which is why cleaning up first matters.
5 Re-check before you resume sending. Allow a short time for DNS to propagate, then confirm the IP is clear at check.spamhaus.org before ramping your sending back up.

The official route

Straight to the source.

Removal happens on CBL (Abuseat)'s own tool — never through a paid service.

CBL (Abuseat) removal tool ↗

Return codes

127.0.0.2 Listed on the legacy cbl.abuseat.org zone (compromised or bot-like host)

127.0.0.4 Equivalent XBL listing when queried via Spamhaus (xbl.spamhaus.org / zen.spamhaus.org)

How long it takes

Self-service removal takes effect within minutes once the abuse is no longer detected — allow roughly 15 minutes for DNS to propagate before re-testing. There is no manual queue to wait on, but removal is refused while the machine still shows signs of compromise, so the real timeline is however long the clean-up takes.

Common questions

About CBL (Abuseat), specifically.

Is the CBL still active, or did it shut down? The CBL was retired in early 2021 and merged into the Spamhaus XBL. The cbl.abuseat.org zone still answers queries as a legacy service, but listings, lookups and removals are all handled by Spamhaus at check.spamhaus.org now.

Does it cost anything to remove my IP from the CBL? No. Removal through check.spamhaus.org is free. Any service offering to remove a CBL or Spamhaus listing for a fee is a scam — no third party can influence or speed up the process.

How do I delist my IP from cbl.abuseat.org? Look the IP up at check.spamhaus.org, clean the compromised machine or close the open relay behind it, then use the self-service removal option on the result page. Removal is blocked until the abuse stops being detected.

Why was I listed if I never sent spam? The CBL and XBL flag machines that behave like bots, not just deliberate spammers. A malware infection, a hijacked mail account, or an open relay on your IP can send mail without your knowledge. Find and fix that host before requesting removal.

I removed my IP but it got listed again — why? The underlying cause was still there. The detection re-lists an IP as soon as bot-like or compromised behaviour reappears. Removal is not a fix: clean the machine, close the relay, and secure the account first, then delist.

Should I query cbl.abuseat.org or xbl.spamhaus.org now? Query xbl.spamhaus.org (or zen.spamhaus.org, which bundles it). The cbl.abuseat.org zone still resolves for now, but it is legacy and Spamhaus advises receivers to move to the XBL zone.

The bounce behind the listing.

554 5.7.1 message rejected → The permanent bounce a listing most often triggers — what it means and how to clear it. 550 5.7.1 blocked → A rejection on reputation grounds — usually the same listing, seen from the sender side. Blacklist checker → Re-check your domain and every sending IP once the cause is fixed.

Do not fix it blind.

See every list you are on and every authentication problem behind the listing in one 40-second check — then let monitoring tell you the day a listing comes back.

Check your domain free → See monitoring