Recently, shortened url’s are being used by cybercriminals to obfuscate and hide the intended ‘bad domain’, to avoid filters and blocklists. Hash / Shortener Feed from SURBL will help detect threats not caught by traditional domain blocklists.  The feed recognizes abused shorteners, abused cloud services, storage platforms, and more. 

HashBL is a new service to identify known bad URIs such as shortener URIs whose domain may have legitimate purposes. SURBL provides domain intelligence in the form of zone files and other data files that enumerate hosts used in spam malware phishing or cracked websites. 

Blocking by domain is so effective malicious actors have been using redirector and URI shortener services such as bit.ly to hide the target domain behind a shortener URI. The domain of the shortener service cannot be listed without triggering false positives as such services also have legitimate uses. 

In order to address this new type of abuse, SURBL introduces HashBL a lookup service for identifying known malicious shortener URI. When a mail filter identifies a URI whose domain belongs to a shortener service, it can compute a hash code of the URI and look up this hash code against a DNS zone.  If the URI is known as malicious this will be identified via the return code of the lookup.