About

Surblhost is a small command-line program that looks up hostnames in the Spam URI Realtime Blocklists (SURBL).

Hosts that are blacklisted means that global spam email have been reported to contain links to these hosts.

Many spam filtering programs use the SURBL to aid in the filtering process, but this program can serve many other needs. In fact, it was written to provide safe URL redirection at memurl.com.

Surblhost is written in C and distributed freely under the GNU General Public License v2.

Features

Surblhost is useful because:

It's easy to use, quick and portable
It comes with a predefined whitelist, which you can add to or change at runtime
It recognizes two-level top-level-domains (TLDs) such as co.uk, and will therefore correctly look up hostnames like foo.co.uk
It can automatically strips off subdomains for correct lookups, which is very handy in automated environments
It can read hostnames from the commandline or standard input
It can operate in quiet mode, indicating lookup results by the shell return value
You'll sleep better at night knowing your systems use surblhost to help fight spam

Download

Download surblhost source code from sourceforge.net

Subversion repository

You can browse the surblhost subversion repository for the source code.

If you want to checkout the source from svn, do this:

$ svn co https://svn.sourceforge.net/svnroot/surblhost
$ autoreconf -v -i   # probably requires autoconf 2.60
$ ./configure
$ make check

Examples

Verbose output

$ surblhost -v bigredskhoediet.com clowndiket.com
checking against multi.surbl.org
bigredskhoediet.com.multi.surbl.org is blacklisted by [jp][ab][ob][sc][ws]
clowndiket.com.multi.surbl.org is blacklisted by [jp][ob][sc][ws]

see http://www.surbl.org/lists.html for more information on the blacklists

More verbose output

$ surblhost -vv --test
test.sc.surbl.org.sc.surbl.org 127.0.0.2 is blacklisted by spamcop 
test.sc.surbl.org.sc.surbl.org txt record: sc.surbl.org permanent test point

Whitelisting and stripping of subdomains

$ surblhost -vv -s www.google.com
checking against multi.surbl.org
google.com is in whitelist

Recognition of two-level TLDs

$ surblhost -vv -s www.somewhere.co.uk
checking against multi.surbl.org
somewhere.co.uk.multi.surbl.org is not blacklisted

Blocked site discovered using recursive checking

# NO HIT
$ surblhost -v 156.tissuqeweightloss.com
checking against multi.surbl.org
warning: hostname contains subdomains: 156.tissuqeweightloss.com (try option -r)
156.tissuqeweightloss.com.multi.surbl.org is not blacklisted

# OPTION -r GIVES HIT
$ surblhost -v -r 156.tissuqeweightloss.com
checking against multi.surbl.org recursively
156.tissuqeweightloss.com.multi.surbl.org is not blacklisted
tissuqeweightloss.com.multi.surbl.org is blacklisted by [jp][ob][sc][ws]

see http://www.surbl.org/lists.html for more information on the blacklists

Used within a script

Put this in a file called for example lookup.sh

#!/bin/bash

# Copyright (C) 2006 Christian Stigen Larsen <csl@sublevel3.org>
# This script is in the public domain.

if test "$#" == "0" ; then
        echo "usage: lookup [ hostname(s) ]"
        echo "looks up if hosts are blocked by surbl.org"
        exit 1
fi

while test ! -z "${1}" ; do

        echo -n "checking ${1} ... "
        surblhost -q -r 2>/dev/null ${1}

        if test "$?" == "2"; then
                echo "blocked"
        else
                echo "not blocked"
        fi

        shift
done

echo ""
echo "for more information, see http://www.surbl.org/lists.html"
exit 0

This script can now be run as:

$ chmod +x lookup.sh
$ ./lookup.sh 156.tissuqeweightloss.com google.com www.somewhere.co.uk
checking 156.tissuqeweightloss.com ... blocked
checking google.com ... not blocked
checking www.somewhere.co.uk ... not blocked

for more information, see http://www.surbl.org/lists.html

Ports and package managers

FreeBSD

To install the port:

cd /usr/ports/mail/surblhost/ && make install clean

To add the package:

pkg_add -r surblhost

Links

Author

Christian Stigen Larsen