ivmURI
“a URI blacklist”

ivmURI, is one of three invaluement DNSBLs. Please first read the discussion of goals and features shared by all 3 lists detailed on the invaluement Anti-Spam DNSBL page.

ivmURI is the invaluement uri dnsbl. Aka a “uri bl”, this list includes those IPs and domain names which only appear in the body of unsolicited messages. ivmURI was developed by one of the long-time SURBL adminstrators, Rob McEwen, and is now considered to be one of the three top-tier URIBL blacklists, along side SURBL and URIBL. In fact, the drop-off in quality after the three major URI blacklists (SURBL, URIBL, and ivmURI) is considerable. Simply put, there is no close fourth.

How can we know this? Besides having data from industry leaders backing up this claim, we are in a position to know and to judge because the founder and developer of ivmURI, Rob McEwen, has been an adminstrator for SURBL since June 2005 and continues to serve in that role. Therefore, Rob has an insider’s knowledge of the inner workings of SURBL. (Rob was also a participant in the discussions which led to the formation of URIBL, and keeps close contact with some of the URIBL folks as well.) It was this hard won expertise that inspired the creation of ivmURI.

None of the three major URI blacklists (SURBL/URIBL/ivmURI) make any of the others obsolete because all three block some spams missed by the other two. Therefore, we consider all three to be indispensable. However, ivmURI could still be a huge help for some organizations who now suddenly find themselves unable to afford SURBL’s new pricing policies. (NOTE: Starting 11/6/2008, SURBL is no longer free for organizations “processing more than 250,000 inbound messages per day or having more than 1,000 users”. In the near future, such SURBL-users will be cut off unless/until they subscribe to SURBL.)

FOR EXAMPLE: Recently, a multi-national corporation with 60K employees gathered stats on all three URI blacklists. Their statistics showed that 72% of the spam blocked by SURBL was also blocked by ivmURI. Obviously, it is noteworthy that 28% of the spam blocked by SURBL was missed by ivmURI! However, (overall) in those statistics, ivmURI blocked more spam than both SURBL and URIBL, and had fewer false positives than both SURBL and URIBL. Additionally, for every 1 spam blocked by SURBL that ivmURI missed, there were 2 spams blocked by ivmURI that SURBL missed. Finally, ivmURI had the highest “unique” spams blocked (that being spams blocked by a URI blacklist which ALL other URI lists missed). In fact, ivmURI beat out the 2nd place URI blacklist in this “uniques” category (uribl.com) by a 2-to-1 margin. (details and raw data available upon request)

How does ivmURI fit into this mix of high quality URI DNSBLs?

1. LOW FALSE POSITIVES: At least as low as SURBL and URIBL. Some have reported the FPs to be the lowest of all three major URI BLs!
2. UNIQUES: As stated, there are some series of spam listed only by ivmURI, or listed by ivmURI first. In fact, periodically a URI will get listed only on ivmURI, and then SURBL and/or URIBL will pick up that URI months later. (Of course, the reverse is true as well! Which is why all three lists are very valuable and we use all three in our own spam filtering!)
3. SMALL MEMORY FOOTPRINT: ivmURI has a memory footprint which is much smaller than URIBL and vastly smaller than SURBL.
   • This opens up possibilities for applications which require a smaller memory footprint URI BL!
   • Interestingly, ivmURI’s spam catch rate is at least as high as SURBL and URIBL. So, in this case, having less data does not translate to less spam caught!
4. FAST UPDATING: In situations where all three URI blacklists have caught a new spammer’s domain at the same time (at the backend), ivmURI has the fastest turnaround time for getting that domain into circulation, for productive use, in comparison to URIBL and SURBL. (Actually, this is a “game of inches” when ivmURI is compared to URIBL, but the turnaround for ivmURI is substantially faster than SURBL’s turnaround time.) This helps catch new series of spam that haven’t had much time to get listed on all the various types of anti-spam clearinghouses and are, therefore, at high-risk for getting missed by many spam filters.

Examples of URIs caught by ivmURI,
but missed by SURBL and URIBL!

The following is a tiny sampling of such messages. In this case, we took the last 500 message caught by ivmURI, waited 24 hours (to give SURBL and URIBL extra time to catch these). Extracted from that batch, below are the domains caught by ivmURI but missed (at that time) by surbl and uribl, even after giving them an extra 24 hours to catch up.

• Some of these web sites have been terminated by hosting providers by now. Also, some of these are listed on surbl and uribl by now!.
• This batch was collected on May 31, 2008. Fresher samples will be posted here from time to time.
• For each domain listed below, we have unsolicited messages on file with those domain names used in the message’s links.
• Had we spotted URIBL and SURBL an extra 1 hour instead of 24 hours, this list would be much larger. And, as mentioned earlier, surbl and uribl also catch much spam missed by the other two URI BLs, including listing URIs missed by ivmURI... so this point cuts all three ways!
• Visit these web sites at your own risk since we haven't checked them for malicious exploits.

How to access the invaluement DNSBL?

Sign up here for an evaluation.

ivmURI
“a uri dnsbl”