List Information

Public URIBL Lists:

• black.uribl.com - This lists contains domain names belonging to and used by spammers, including but not restricted to those that appear in URIs found in Unsolicited Bulk and/or Commercial Email (UBE/UCE). This list has a goal of zero False Positives. This zone rebuilds frequently as new data is added.
• grey.uribl.com - This lists contains domains found in UBE/UCE, and possibly honour opt-out requests. It may include ESPs which allow customers to import their recipient lists and may have no control over the subscription methods. This list can and probably will cause False Positives depending on your definition of UBE/UCE. This zone rebuilds several times a day as necessary.
• red.uribl.com - This list contains domains that actively show up in mail flow, are not listed on URIBL black, and are either very young (domain age via whois), or use whois privacy features to protect their identity. This list is automated in nature, so please use at your own risk.
• white.uribl.com - This list contains legit domain names that we do not want to show up on any other URIBL lists. This list is pretty static, with only a handful of changes per day. URIBL white is not currently bitmasked into multi.uribl.com. If you want to query it, you have to send a seperate query. This zone rebuilds as needed.
• multi.uribl.com - Which checks to see if a domain is on any of our lists. This zone rebuilds if any of the above zones are rebuilt, with the exception of white.

Private URIBL Lists:

Access to this zone data is currently only available via Data Feed Service.
• gold.uribl.com - This list contains proactive black listings, with the goal of reducing miss rate associated with reactive listings due to the build and replication delay. Once a domain in this list begins to show up in mail flow, it will be moved over to the public black.uribl.com list. This zone rebuilds frequently as new data is added.

Implementation

To utilize these lists, please see the Usage page

You can subscribe to our public discussion list here: Public Mailling List

Our lists only have the top level domain information. We strip all hostparts from URIs before addition, with the exception of a few domain names which tend to be heavily abused (see http://rss.uribl.com/hosters/). In those cases, we do list the subdomain prior to the abused domain name. So when you query our lists, make sure you have done proper scrubbing of the URI before submitting the query, or you may not get the results you expect.

We do list IP addresses! Not where the mail was sent from, but where the URI in the body is trying to take you. To query a IP address on our list, we use the reversed ipv4 dotted decimal address. For example, 1.2.3.4 should be queried as 4.3.2.1.multi.uribl.com.

multi.uribl.com list contains all of the list data, and is the list that we recommend you query to produce your results instead of making seperate requests to each list. If a domain is found on multi, it will return a IP address of 127.0.0.X where X is the value for what list it is on. See the following reference..

X   Binary    On List
---------------------------------------------
2   00000010  black
4   00000100  grey
8   00001000  red
14  00001110  black,grey,red (for testpoints)
---------------------------------------------

Other bitmasked values, such as 6, 10, and 12 should no longer occur, as we have no reason to cross-list domains on multiple lists. Our testpoints (2.0.0.127 and test.uribl.com) are the only items that are crosslisted, and they should return the bitmasked value for the combined hits, currently 127.0.0.14.

Testing

To test functionality of the lists, we have published test points on each zone. 2.0.0.127 and test.uribl.com. Using the host or dig command can be your friend... If you need to lookup a domain in our database and do not want to mess with a DNS call, please use our Lookup Form.

LISTED TEST RESULTS

# host -tA 2.0.0.127.multi.uribl.com
2.0.0.127.multi.uribl.com has address 127.0.0.14

# ping 2.0.0.127.multi.uribl.com
PING 2.0.0.127.multi.uribl.com (127.0.0.2) 56(84) bytes of data.
64 bytes from 127.0.0.14: icmp_seq=0 ttl=64 time=0.033 ms

NOT LISTED TEST RESULTS

# host -tA domain.tld.multi.uribl.com
Host domain.tld.multi.uribl.com not found: 3(NXDOMAIN)

# ping domain.tld.multi.uribl.com
ping: unknown host domain.tld.multi.uribl.com

TEST POINTS

# host -tTXT test.uribl.com.multi.uribl.com
test.uribl.com.multi.uribl.com text "permanent testpoint"

# host -tTXT 2.0.0.127.multi.uribl.com
2.0.0.127.multi.uribl.com text "permanent testpoint"