View source for Reputation Block Lists

'''Reputation Block Lists''', or RBLs, are lists of [[Domain Name]]s, Universal Resource Locators ([[URL]]s), and/or Internet Protocol ([[IP]]) addresses that have been identified as posing security threats.<ref>[https://www.icann.org/en/blogs/details/reputation-block-lists-protecting-users-everywhere-1-11-2017-en Reputation Block Lists Protect Users, ICANN Blog]</ref> DNS reputation systems can detect [[Malicious Domain|malicious domains]] at the registration time (with PREDATOR) or domain activity phase (with EXPOSURE). They classify domains as either malicious or benign; however, they do not consider [[Compromised Domain|compromised domains]].

==Overview==
Commercial service providers, researchers, and non-profit organizations operate the most prominent RBLs that detect or receive notifications of security threats. Examples include:
* Cisco’s [https://talosintelligence.com/reputation_center Talos] email reputation system,
* [https://apwg.org/ the Anti-Phishing Working Group's RBL],
* [https://safebrowsing.google.com/ Google Safe Browsing],
* [http://www.surbl.org/ SURBL], and
* [https://www.threatstop.com/ ThreatStop].

==History==
With the advent of email, email administrators began creating and sharing blocklists, which gave rise to some cases of false positives, which led to their creating a list of exceptions, known as allowlists.<ref>[https://www.computerworld.com/article/2468274/dns-blocklists-and-reputation-services--part-1--background-.html RBL Background, Computer World]</ref> In the early days, in some circles today, these lists were called blacklists and whitelists, but the racial implications of those terms, among many others, have led people to switch to block/allow.<ref>[https://www.nytimes.com/2021/04/13/technology/racist-computer-engineering-terms-ietf.html IETF Is Trying to Move Away From Racists Computer Engineering Terms, NY Times]</ref>  

Then, in 1997 [[Paul Rand]] and [[Paul Vixie]] used the DNS protocol to access a blocklist to see whether a sending IP address had sent spam recently, and trademarked "Real-time Blackhole List" to refer to the blocklist. [[ISP]]s followed suit, which led to finer-tuned descriptions of the legitimacy of an IP address.<ref>[https://www.computerworld.com/article/2468274/dns-blocklists-and-reputation-services--part-1--background-.html RBL Background, Computer World]</ref>  

In 2010, the [[IRTF|Internet Research Task Force]] released [[RFC|Request for Comments]] 5782 in acknowledgment of network managers worldwide using DNSxLs (DNS block or allow lists) to filter traffic and to make sure such managers were on the same page as to the structure and usage of DNSxLs and the protocol to query them.<ref>[https://tools.ietf.org/html/rfc5782 RFC 5782, IETF]</ref>

As of April 2021, [[Intra2net]]'s Blacklist Monitor ranked [[Distributed Checksum Clearinghouses]] or (DCC) as showing the highest rate of accuracy in filtering spam.<ref>[https://www.intra2net.com/en/support/antispam/blacklist.php_dnsbl=dcc_check.html Intra2net Blacklist Monitor]</ref>

==References==

[[Category:Cybersecurity]]