All blacklists
Reference · Domain blacklist

SURBL

Domain reputation list focused on URLs found in unsolicited mail. SURBL is one of the most widely deployed domain blocklists at receivers.

DNS zone
multi.surbl.org
Published by
SURBL.org
Established
2004
Scope
Domain

What it detects

Domains hosting spam landing pages, phishing kits, malware payloads, or scam content. SURBL ingests data from multiple feeds — SpamCop URL reports, AbuseButler, jwSpamSpy — and combines them into a multi-list response.

Listing categories

127.0.1.2 (SpamCop URL spam), 127.0.1.4 (website spam — primarily ads), 127.0.1.8 (AbuseButler abuse), 127.0.1.16 (phishing), 127.0.1.32 (malware), 127.0.1.64 (jwSpamSpy spam). Multiple categories may apply to a single domain; the response is bitwise OR of all matching codes.

How to check a listing yourself

Query the A record of `<domain>.multi.surbl.org`. A 127.0.1.x response indicates a listing. SURBL also publishes a public lookup form on their website.

How to get delisted

Most SURBL feeds expire listings automatically as evidence ages. For active listings, submit a removal request via the operator's contact form with proof that the abuse has been fixed (e.g., spam URLs removed, phishing kit deleted, compromised hosting cleaned). Expect 24–72 hour turnaround.

SURBL.org delist portal

Other blacklists DomainCare monitors

  • URIBL Real-time domain blacklist focused on URIs that appear in spam. Common at receivers using SpamAssassin and similar filters.
  • SpamCop SCBL SpamCop Blocking List — IP blacklist driven by reports submitted by mail recipients.
  • DroneBL IP blacklist focused on compromised hosts — drones, open proxies, brute-force attackers — rather than spam senders.
  • Blocklist.de Community-driven IP blacklist aggregating fail2ban-style attack reports from operators worldwide.