People tend to just think that lists from sites like SpamHaus are only good for blocking spam from coming into your servers but that's just the tip of the iceberg if you're open to some creative thinking.
Since Google penalizes sites that link out to bad neighborhoods one potential use for SpamHaus ZEN is to help automatically identify bad sites and remove them. For people that run directories or have massive amounts of outbound links this means you can protect your visitors, as well as your reputation in Google and other places, via zen.spamhaus.org and eliminate links to IPs associated with spammers, 3rd party exploits, proxies, worms and trojans!
How's that for a kick ass way to clean up your site?
Keep in mind that on a shared server that a single IP address may represent multiple domains on a server. That means any domain on a server either spamming or otherwise compromised will impact all domains associated with that IP so many people may be effected that don't know there's a problem. However, since that server can be a hazard to the general population at large, it's best to err on the side of caution and suspend your association with all sites on that server until the problem is resolved.
Since most sites don't even know that they've been infected I merely quarantine those links until they are no longer being reported as hostile and then enable them again after they have been confirmed to be clean.
Not that everything will be listed in SpamHaus ZEN as much of the malicious activity I see isn't in their index, but it's a good reference for known bad sites.
Here's an example of how to check an IP address in SpamHaus using a spammers IP currently in the DNSBL.
Take the IP address 64.151.120.13 and reverse it to 13.120.151.64 and then combine the IP address to zen.spamhaus.org like this: 13.120.151.64.zen.spamhaus.org.
Using any DNS checking tool, query the DNSBL for the existence of 13.120.151.64.zen.spamhaus.org.
The IP is currently in the DNSBL you'll get a result like this:
host 13.120.151.64.zen.spamhaus.orgIf the IP address is not in the DNSBL you'll get a response like this:
13.120.151.64.zen.spamhaus.org has address 127.0.0.2
host 13.120.151.123.zen.spamhaus.orgThe result codes from SpamHaus are as follows:
Host 13.120.151.123.zen.spamhaus.org not found: 3(NXDOMAIN)
127.0.0.2 - SpamHaus Block List (SBL)The last list, the PBL, is probably something I wouldn't auto-block with a link checker or any other use (except anti-spam) unless I reviewed what it was blocking first so those errors, if they ever come up, are only set as "warnings" in my current implementation.
127.0.0.4-8 - Exploits Block List (XBL)
127.0.0.10-11 - Policy Block List (PBL)
