- Operator
- SURBL LLC
- Zone
- multi.surbl.org
- Lists
- domain names
- Status
- Active
- Severity
- Major
- Removal
- self-service via SURBL Analysis page: www.surbl.org/surbl-analysis
- Cost
- free (public zone, query-limited)
- Turnaround
- undocumented
- Auto-expiry
- undocumented
- Source
- SURBL LLC: SURBL
What is SURBL?
SURBL is a domain list queried by content filters against the URLs in a message body. Its combined zone, multi.surbl.org, answers with a bitmask: 8 for phishing (PH), 16 for malware (MW), 64 for spam abuse (ABUSE) and 128 for cracked sites (CR), summed when a domain sits in several categories. A domain gets there by appearing in mail that hit SURBL's sources, whether you sent that mail or someone else linked your site.
Because it is a domain list, the sending IP is irrelevant: a compromised website, an open redirect on your domain, or a link-shortener that spammers borrowed will all list the domain while your mail infrastructure looks fine.
| 127.0.0.8 | PH: Phishing site |
| 127.0.0.16 | MW: Malware site |
| 127.0.0.64 | ABUSE: Spam abuse |
| 127.0.0.128 | CR: Cracked site |
| 127.0.0.72 | Phishing + spam abuse |
| 127.0.0.192 | Spam abuse + cracked site |
How serious is a SURBL listing?
Major: corporate gateways and scoring filters consult this list, so a listing costs placement at a meaningful share of receivers. Clear it promptly. The lookup at www.surbl.org/surbl-analysis is the reference for whether you are listed today.
Why your domain got listed
What the operator lists: Domains used in phishing, malware, spam advertising.
How to remove your domain from SURBL
- 1
Look the domain up at www.surbl.org/surbl-analysis
The operator's own lookup shows whether the domain is listed and, where the list publishes reasons, why. Third-party checkers can lag or misread the zone.
- 2
Fix the cause before you ask
Domains used in phishing, malware, spam advertising. A removal request while the cause is live is the fastest route to a repeat listing, and repeat listings are slower to clear.
- 3
Request removal at www.surbl.org/surbl-analysis
Self-service via SURBL Analysis page. Cost: free (public zone, query-limited).
- 4
Verify and watch for a return
Typical turnaround: undocumented. Re-run the live check after that window; a listing that comes back means the source is still active.
- 01Look it upwww.surbl.org/surbl-analysis
- 02Fix the causebefore you ask
- 03Self-service removalwww.surbl.org/surbl-analysis
- 04Verifyundocumented
cost: free (public zone, query-limited)
How long removal takes
Typical turnaround: undocumented. Automatic expiry: undocumented. Cost: free (public zone, query-limited).
Frequently asked questions
How do I get removed from SURBL?
Self-service via SURBL Analysis page, at www.surbl.org/surbl-analysis, after the cause is fixed. Cost: free (public zone, query-limited). Typical turnaround: undocumented.
How long does a SURBL listing last?
Automatic expiry: undocumented. Removal turnaround: undocumented. A listing that returns after clearing means the cause is still live.
Does SURBL removal cost anything?
Free (public zone, query-limited). No third party can remove a domain from SURBL faster than the operator's own process, so paid "express delisting" offers add nothing.
What does SURBL list?
Domain names: Domains used in phishing, malware, spam advertising. Zones: multi.surbl.org.
How do I check whether I am on SURBL?
Use the operator's lookup at www.surbl.org/surbl-analysis, or the live check on this page, which queries multi.surbl.org directly.
Record checked against the operator's site on ; the whole set was last reviewed on . Cells that say undocumented or not found are gaps in the operator's own material, left as they are.