How to remove your IP from IMP Worm

IMP Worm lists IPs caught spreading worms or viruses. Here is what a listing means, and how to clear it.

Check your domain free → IMP Worm removal tool ↗

What it is

The list, in plain terms.

IMP Worm is a DNS blocklist published in the zone wormrbl.imp.ch by ImproWare AG, a Swiss ISP based in Pratteln. It is one of a small family of anti-spam lists the company runs alongside its spam and URI lists, and it is fed automatically from spamtraps rather than by manual reports.

The list contains every IP address caught sending worm or virus traffic over the last three days. It is a rolling window: entries are added automatically when malware activity is seen from an IP, and they age out on their own once that activity stops. This is a compromised-machine listing, not an accusation that you deliberately sent spam.

IMP Worm is a niche list with modest deployment compared with the major blocklists, so a listing here rarely blocks mail on its own. Treat it as a reliable signal that a machine on your IP is infected and needs cleaning, which is worth fixing regardless of how many receivers consult the list.

Why you get listed

What a listing on IMP Worm means.

A worm or virus on your network A machine on or behind the listed IP is infected with malware that generates worm or virus traffic. The IP is flagged for that behaviour, not for the content of any legitimate mail you send.

A compromised or abused host An exploited server, hijacked account or infected workstation on the same public IP can trigger the listing, even if your mail server itself is clean.

Shared or NAT egress If several devices leave your network through one public IP, any single infected device is enough to list that address. Identify which host is emitting the traffic.

How to get removed

Delisting, in order.

Removal is free. Fix the cause first — a listing you clear without a fix comes straight back.

1 Confirm the listing. Check the IP against wormrbl.imp.ch, or use the IPv4 lookup form on antispam.imp.ch. Confirm it is the Worm list and not the operator's separate spam or URI list, since only your own sending IP is relevant here.
2 Find and clean the infected machine. Trace which host behind the IP is generating worm or virus traffic — a compromised server, a hijacked mail account or an infected workstation. Remove the malware, patch the machine and close any open relay or proxy before you request removal.
3 Request removal for free. Use the IPv4 removal form on antispam.imp.ch to submit the cleaned IP. Removal is 100% free. Only submit if you own or manage the mail server on that IP; if you do not run a mail server, you should never need to delist manually.
4 Wait for processing. Most removal requests are processed within 48 hours. You cannot submit a removal for the same IP more than once every week, so make sure the machine is genuinely clean before you send the request.
5 Re-check before resuming. Once processed, look the IP up again to confirm it has cleared. If the infection returns, the automated spamtraps relist the IP, so verify the malware is gone rather than delisting repeatedly.

The official route

Straight to the source.

Removal happens on IMP Worm's own tool — never through a paid service.

IMP Worm removal tool ↗

How long it takes

The list holds only the last three days of detections, so a listing ages out on its own within about three days once the worm activity stops. A manual removal request submitted through antispam.imp.ch is usually processed within 48 hours. You can submit a removal for a given IP at most once every week.

Common questions

About IMP Worm, specifically.

What is wormrbl.imp.ch? It is the DNS zone for the IMP Worm blocklist, run by ImproWare AG in Switzerland. It lists IP addresses caught sending worm or virus traffic over the previous three days, fed automatically from spamtraps.

Why is my IP on the IMP Worm list? Because a machine on or behind that IP was seen emitting worm or virus traffic. It usually means a device on your network is infected with malware or has been compromised — not that you deliberately sent spam.

How do I remove my IP from wormrbl.imp.ch? Clean the infected machine first, then submit the IP through the IPv4 removal form on antispam.imp.ch. Removal is free. Only do this if you own or manage the mail server on that IP.

How long does IMP Worm removal take? Most removal requests are processed within 48 hours. Because the list only holds the last three days of detections, a listing also ages out by itself within roughly three days once the malware activity stops.

Does ImproWare charge to delist? No. Removal from the ImproWare DNS blocklist services is 100% free. Any third party offering to remove an IMP Worm listing for a fee is best avoided; you can do it yourself at no cost.

I delisted but got listed again — why? The listing is automatic, so if the infected machine is still emitting worm or virus traffic the spamtraps relist the IP. Removal is not a fix: find and clean the compromised host first. You can also only resubmit a removal once per week.

The bounce behind the listing.

554 5.7.1 message rejected → The permanent bounce a listing most often triggers — what it means and how to clear it. 550 5.7.1 blocked → A rejection on reputation grounds — usually the same listing, seen from the sender side. Blacklist checker → Re-check your domain and every sending IP once the cause is fixed.

Do not fix it blind.

See every list you are on and every authentication problem behind the listing in one 40-second check — then let monitoring tell you the day a listing comes back.

Check your domain free → See monitoring