Our Reputation Lists

Our intelligence datasets contain information that can be used to filter or tag application data. The information can be used with programs that can check message body web sites against our intelligence, such as SpamAssassin 3 and others mentioned on the links page. But it can also be used to filter data inside DNS firewalls or other application types. We still discover new use cases where our datasets could be applied to. Most of the use cases now day are not related to email. Some datasets are provided to mitigate botnet traffic, hosting providers can use it to find bad actors inside their customerbase.  Or simply use the data to avoid their servers to talk to botnets. The fresh dataset is a very good usecase for that type of data.  Not all new domains are bad but a lot of malicious domains are newly registered.

Here's an overview of the multi lists and their data sources.

• ABUSE - spam and abuse sites
• PH - Phishing sites
• MW - Malware sites
• CR - Cracked sites
• CT - click tracker domains
• DM - Disposable email domains
• MULTI - Combined dataset multi - Our public dataset
• HASHBL - hashed URIs and other malicious data

ABUSE - spam and other abuse sites

This list contains mainly general abused sites (pills, counterfeits, dating, etc.). It also includes data from Internet security, anti-abuse, ISP, ESP and other communities, such as Telenor. Most of the data in ABUSE come from internal, proprietary research by us. The data is sourced in many ways including use of passive dns and handling the zonefile data that we get from the various TLD operators around the globe.

PH - Phishing sites

Phishing data from multiple sources is included in the PH Phishing data source. Phishing data includes PhishTank, PhishLabs, URLAbuse and several other sources, including proprietary research by us.

MW - Malware sites

This list contains data from multiple sources that cover sites hosting malware. This includes abuse.ch, URLAbuse and others. Some cracked hosts are also included in MW since many cracked sites also have malware. Note that the above is only a sampling of many different malware data sources in MW. Malware data also includes significant proprietary research by us.

CR - Cracked sites

This list contains data from multiple sources that cover cracked sites, including internal ones. Criminals steal credentials or abuse vulnerabilities in CMS such as Wordpress or Joomla to break into websites and add malicious content. Often cracked pages will redirect to spam sites or to other cracked sites. Cracked sites usually still contain the original legitimate content and may still be mentioned in legitimate emails, besides the malicious pages referenced in spam.

CT - Click tracker domains

This list contains domains used for tracking clicks in emails. We only list domains used by senders that send emails to mailboxes without confirmed opt-in (e.g. emails also sent to spamtraps).

DM - Disposable mail domains

This list contains domains that classify as disposable email solutions. If someone uses this kind of domain to sign up for your service they most likely are trying to hide their true identity. There might be valid reasons to use disposable email solutions. But for many applications is not a good solution to accept these at all.

MULTI - Our combined dataset multi

All of the our public data sources are combined into a single, bitmasked list: multi.surbl.org. Bitmasking means that there is only one entry per domain name or IP address, but that entry will resolve into an address (DNS A record) whose last octet indicates which lists it belongs to. The bit positions in that last octet for membership in the different lists are:

4 = listed on DM
8 = listed on PH
16 = listed on MW
32 = listed on CT
64 = listed on ABUSE
128 = listed on CR

If an entry belongs to just one list it will have an address where the last octet has that value. For example 127.0.0.8 means it's on the phishing list, while 127.0.0.64 means it's listed on the ABUSE list. An entry on multiple lists gets the sum of those list numbers as the last octet, so 127.0.0.80 means a record is on both MW and ABUSE (comes from: 16 + 64 = 80). In this way, membership in multiple lists is encoded into a single response. Octets other than the first and last one are reserved for future use and should be ignored.

Default TTL for the live data in the multi list is 60 seconds. The MULTI data is highly dynamic and on average gets updated every 30-40 seconds.

Each entry also has a TXT record mentioning which lists it is on, and pointing to this page. While the TXT records are relatively stable, they are meant for human readers (e.g. in non-delivery messages) and not for parsing by software. We highly recommend that automatic processing be based on the A record only.

More information about how to use our datasets can be found in the Implementation Guidelines.

HASHBL

HASHBL enables you to query the reputation of non-domain data via hash codes. The following categories are supported:

• abuse - URIs such as shorteners used in spam or not yet categorized by abuse type
• cracked - URIs of cracked website
• malware - URIs such as shorteners used to host malware
• phish - URIs such as shorteners used for phishing
• email - email addresses of senders or as reply mail drops used for fraud or spam
• crypto - crypto keys such as BTC wallet addresses used in fraud or spam
• phone - phone numbers used in fraud or spam

 

Blocked Result Code 127.0.0.1

If you get a result of 127.0.0.1 when doing a DNS query into the public nameservers, then it means your access is blocked. Please see our Usage Policy and sign up for our Sponsored Data Service (SDS).

Other available datasets

We have various other data feeds are available. Be sure to subscribe to the low-volume Announce mailing list for important updates. Or reach out to us directly to engange in what we can do for you or your organisation.

We operate various datasets (Crypto listings / Abused e-mail sender and reply-to datasets / Phone number lists / Various shortner lists / Fresh) Most of these sets are available with granted access. Fill out the datafeed form for more information about those.

List Removal

To request removal from a reputation set, please start with the the Lookup page and follow the instructions on the removal form.

Before submitting a removal request of the Cracked (CR), Phishing (PH) or Malware (MW) lists, please be sure to remove and secure all phishing sites, cracked accounts, viruses, malware loaders, trojan horses, unpatched operating systems, insecure PHP boards, insecure Wordpress, insecure Joomla, insecure third party plugins, cracked SQL, insecure ftp passwords, password sniffers, etc., from the web site and all computers used to upload content to the web site before contacting us. If you need help, please contact a security expert to do a full security audit on the web site and all computers used to connect to it. Systems that are not properly secured may be broken into again.

Note that there has also been cracking of DNS control panels resulting in malicious subdomains being added to domains. Please also check and fully secure all DNS infrastructure for your domains. Please contact a security expert if you need help with this.

List Performance

We aim for fast updates, minimal false positives and high catch rates. The results can be confirmed here:

• Blacklist Monitor

 

---

lists.html version 2.62 on 2024-10-05