URIBL

A list of spamvertised domains

A URI blacklist, or URIBL, is a list of 'bad' domains, usually accessed via the DNS protocol.

URIBLs are most commonly used in spam filters that look for URLs occurring in the email and block them if any URL is known to have been used for spamvertising and/or serving malware.

To prevent their messages from being blocked by URIBLs, spammers register new domains at a fast rate. They also try to use redirection services (such as URL shorteners) and web pages on legitimate domains, which cannot be blocked because of the high risk of false positives. Some spammers 'break' the URLs in their messages, so that they are not recognized as such by spam filters.

Some URIBLs can also be used to check the domain of the sender used in the SMTP envelope.

See also: DNSBL.

Quick Links

Poll
The Japanese government is reported to have commissioned a 'defensive virus'. Is 'defensive' malware ever a good idea?
Yes
No
I don't know
Leave a comment
View 11 comments

99 Subscription Promo

Virus Bulletin
In this month's magazine:
  • Living the meme
  • If Svar is the answer...
  • Static analysis of mobile malware
  • And the devil is six: the security consequences of the switch to IPv6
  • Behind enemy lines: reporting from the CCC 28C3 Congress
Virus Bulletin 02 2012
Subscribe now!

Virus Bulletin currently has 224,238 registered users.