MX Toolbox blacklist check of speed tests

TL;DR

One third of the speed tests tested use an IP address that is on an email blacklist.

To use a speed test, it is usually not necessary to provide an email address. Sometimes your email address is requested to enable additional services (such as consulting your speed test history). We advise never to provide your email address for "free" services.

 

Contents

  1. Introduction
  2. Method of measurement
  3. Speed tests to test
  4. The measurements
  5. Conclusions
 

Introduction

Safety is the end result of all security and privacy measures. It is therefore a derivative, but not unimportant, feature of any website, including online speed tests.

This is one of many tests we run to get an idea of the safety of speed tests.

 

Method of measurement

We know MX Toolbox from their excellent DNS lookup tool. Until now we didn't know that MX Toolbox also offers a Blacklist checker.

Please note, we are talking about email blacklists here. These email blacklists are used to reduce the amount of email spam.

Hence for this test we visit the homepage of the speed test and check the speed test with the MX Toolbox Blacklist checker.

 

Speed tests to test

Because this is a relative simple test, all speed test used in earlier tests (the unique speed tests as collected at ZOMDir) will be tested.

Due to the subject we also test TestMyInternetSpeed. This is a crappy website which, under the guise of -we offer a speed test- only wants to obtain as many page views as possible.

 

The measurements

  1. Astound speedtest 2 times listed (UCEPROTECTL2 and UCEPROTECTL3) with 1 timeout in 72 known blacklists
  2. Bandwidth Place 0 times listed with 1 timeout in 72 known blacklists
  3. Bredbandskollen 1 time listed (BARRACUDA) with 1 timeout in 72 known blacklists
  4. Broadband Speed Checker 0 times listed with 1 timeout in 72 known blacklists
  5. Cloudflare 0 times listed with 1 timeout in 72 known blacklists
  6. Comparitech 0 times listed with 1 timeout in 72 known blacklists
  7. DSLReports 0 times listed with 1 timeout in 72 known blacklists
  8. Fast 0 times listed with 1 timeout in 72 known blacklists
  9. Fireprobe 0 times listed with 1 timeout in 72 known blacklists
  10. Google Fiber 1 time listed (UCEPROTECTL3) with 1 timeout in 72 known blacklists
  11. Internet Speed at a Glance 0 times listed with 1 timeout in 72 known blacklists
  12. LibreSpeed 1 time listed (FABELSOURCES) with 1 timeout in 72 known blacklists
  13. M-Lab 0 times listed with 1 timeout in 72 known blacklists
  14. Meter.net 0 times listed with 1 timeout in 72 known blacklists
  15. N Perf 1 time listed (UCEPROTECTL3) with 1 timeout in 72 known blacklists
  16. Ookla Speedtest 0 times listed with 1 timeout in 72 known blacklists
  17. Open Speed Test 1 time listed (UCEPROTECTL3) with 1 timeout in 72 known blacklists
  18. SamKnows 1 time listed (UCEPROTECTL3) with 1 timeout in 72 known blacklists
  19. SpeedCheck 0 times listed with 1 timeout in 72 known blacklists
  20. SpeedOf.me 0 times listed with 1 timeout in 72 known blacklists
  21. SpeedOf.me API Sample Page 0 times listed with 1 timeout in 72 known blacklists
  22. SpeedSmart 0 times listed with 1 timeout in 72 known blacklists
  23. Speedtest4.PHP 1 time listed (UCEPROTECTL3) with 1 timeout in 72 known blacklists
  24. TestMyInternetSpeed 1 time listed (UCEPROTECTL3) with 1 timeout in 72 known blacklists
  25. TestMy.net 0 times listed with 1 timeout in 72 known blacklists
  26. Toast 0 times listed with 1 timeout in 72 known blacklists
  27. Which Broadband Speed Test 1 time listed (UCEPROTECTL3) with 1 timeout in 72 known blacklists
  28. Xfinity xFi Speed Test 0 times listed with 1 timeout in 72 known blacklists

Some examples

Some examples of test results are:

The MX Toolbox blacklist checker finds 0 listings for Cloudflare

The MX Toolbox blacklist checker concludes that Google Fiber is listed at the UCEPROTECTL3 blacklist

The MX Toolbox blacklist checker concludes that LibreSpeed is listed at the FABELSOURCES blacklist

The MX Toolbox blacklist checker concludes that Bredbandskollen is listed at the BARRACUDA blacklist

Blacklists

The following blacklists contains one or more of the tested speed tests:

  1. BARRACUDA (occurs 1 time)
  2. FABELSOURCES (occurs 1 time)
  3. UCEPROTECTL2 (occurs 1 time)
  4. UCEPROTECTL3 (occurs 8 times)

BARRACUDA

Barracuda Central maintains a history of IP addresses for both known spammers as well as senders with good email practices. This information contributes to the Barracuda Reputation System, which gives the Barracuda Spam & Virus Firewall the ability to block or allow a message based on the sender's IP address.

When we recheck the domain name www.bredbandskollen.se at Barracuda Central it turns out that The domain name www.bredbandskollen.se is not listed on Barracuda's Intent Block List.

Barracuda Central: The domain name www.bredbandskollen.se is not listed on Barracuda's Intent Block List

FABELSOURCES

Fabel Spamsources is a list of potential spam sources. Fabel Spamsources (...) only lists IP addresses, never domains and not web sites (...).

If a website uses a cheap "shared hosting" provider, then there is a big chance that spam mails are sent from another domain, but with the same (shared) IP address. Because Fabel Spamsources only looks at the IP address, it seems that all websites hosted there send spam.

Hence Fabel Spamsources states that Many inexpensive "shared hosting" providers are struggling keeping abuse and spam off their networks. This leads to their IP addresses getting listed as potential spam sources.

When we lookup the IP address of LibreSpeed and we use the lookup page of Fabel Spamsources then the result is: 78.46.162.45 is listed in spamsources.fabel.dk.

The logical next step is to use a reverse IP lookup tool to see which domains correspond to this IP address.

For this, we used of course MX Toolbox's Reverse Lookup and as doublecheck also Reverse IP Lookup of DomainTools.

As you can see below, this IP address seems to be used only by LibreSpeed. However, the only conclusion we can conclude is that spam was once sent from this IP address.

The reverse lookup with MX Toolbox gives librespeed.org as result

The reverse lookup with DomainTools gives librespeed.net and librespeed.org as result

UCEPROTECTL2 & UCEPROTECTL3

UCEPROTECT has 3 different blacklist levels.

Level 2 is almost always an indicator, that providers don't act fast enough on abusers.

Level 3 will mostly block "learning-resistant" service providers or carriers and their customers.

UCEPROTECT offers the option to check IP addresses with their Spam Database Query tool.

We used the DNS Lookup Tool from MX Toolbox to find the IP addresses of Astound (208.59.202.197), Google Fiber (192.119.20.37), N Perf (176.31.195.20), Open Speed Test (23.239.29.5), SamKnows (23.239.5.57), Speedtest4.PHP (87.98.255.4), TestMyInternetSpeed (198.54.115.76) and Which Broadband Speed Test (212.71.236.220) and checked these IP addresses against the Spam Database Query.

Astound, Google Fiber, Open Speed Test, SamKnows, Speedtest4.PHP, TestMyInternetSpeed and Which Broadband Speed Test are indeed listed as mentioned above. N Perf is listed at level 2 and level 3.

An example of the UCEPROTECT Spam Database Query

Again, the only conclusion we can conclude is that spam was once sent from these IP addresses.

 

Conclusions

There are:

  1. 18 speed tests that aren't mentioned in the used blacklists
  2. 9 speed tests are mentioned 1 time in the used blacklists
  3. 1 speed test is mentioned 2 times in the used blacklists

It appears that bredbandskollen was wrongly assumed to be on Barracuda Central's blacklist, hence 9 of the 28 speed test tested -say one third- uses IP addresses that are blacklisted.

To use a speed test, it is usually not necessary to provide an email address. Sometimes your email address is requested to enable additional services (such as consulting your speed test history). We advise never to provide your email address for "free" services.