SURBL Overview

SURBL Domain Reputation data

Real-Time Threat Intelligence on Malicious Domains

The industry’s most comprehensive and accurate list of bad domains:

  • Fast, dynamic coverage on malicious domains
  • Updated every 1-2 minutes
  • Accurate, actionable intelligence of ‘current, active, bad domains’
  • 20+ years of experience providing domain threat intelligence since

Used by Security Vendors, AntiSpam Solutions, Service Providers and Enterprises worldwide to improve their defenses against fast flux, bot generated, and malicious domains.

SURBL Data Feeds

SURBL Domain Threat Intelligence Data Feeds to help protect your system from hard-to-detect threats. Near-zero false positives. Updated every minute.


Comprehensive, composite feed of reputation-based domain threat intelligence. ‘Multi’ contains domains that have been observed engaging in or connected to phishing and botnet activity, as well as cracked and abused domain.


Cyber criminals cycle through domains in attempt to evade filters. As result, ~98% of new domains engage in malicious activity. SURBL's Fresh data feed identifies newly registered domains before they can establish their domain reputation.

HASH / Shortener BL

Latest technique from cyber criminals is to evade filters by hiding behind layers or URL shorteners (ex. This new data feed from SURBL can identify malicious hash data to allow for more precise blocking often missed by IP and domain blocklists.


What is SURBL?

SURBL ( is an independent cyber research organization with over 20 years of experience.  SURBL is comprised of a full-time dedicated staff of researchers, specialized in cyber threat hunting and committed to protecting the internet.  Their expertise is finding domains that have been involved in abusive activity on the web or that have been connected to malicious activity.  The team is constantly evolving their research techniques to keep their data feeds up-to-date and accurate with near zero false positives. 

In addition to their own research, SURBL data feeds are supplemented through key partnerships. Their team of highly experienced cyber security researchers have grown to be a trusted member of the internet ecosystem, developing trusted relationships with technology, security, and messaging providers on all continents, including leading registries and registrars. 

Today, SURBL’s highly-efficient, highly-accurate datafeeds help protect organizations globally from cyber threats.  SURBL data feeds are used by security vendors, webmail providers, large and small ISPs, universities, private companies, governments, service providers, and enterprises worldwide to improve defenses against fast-flux, bot-generated, malicious domains.

SURBL’s cutting edge research techniques, data sharing partnerships, and experience provide SURBL with unparalleled domain threat intelligence. 


SURBL’s Reliability & Commitment to Accuracy:

The focus is on actionable intelligence, delivered with near-zero false positives, which can be deployed and used to block malicious activity in near real time.

  • SURBL obsesses on accuracy—and in all cases errs on the side of caution.
  • SURBL understands that accuracy is paramount, and ensures the data delivered contains usable, actionable data. No noise and false alarms.
  • Proven solution.  The data has been demonstrated in numerous trials and current deployments. Try it for yourself!


Uses of SURBL Data Feeds

SURBL provides the industry’s most comprehensive and accurate list of bad domains.  Data Feeds are used by Security Vendors, AntiSpam Solutions, Service Providers and Enterprise worldwide for:

Start your free trial.

Design the best set of data feeds to meet your needs!


Experience improved cybersecurity and stop phishing emails, ransomware, malware, and other cyber threats. Sign up for your free consultation and receive an in-depth technical deep dive and a 30-day free trial.