URLhaus adds DNS RPZ blocklist feature
Abuse.ch's URLhaus, tracking over 200,000 malware URLs, now offers a DNS Response Policy Zone feed to help admins block malware domains via Bind.
Sourceabuse.ch — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This is a technical tutorial from abuse.ch describing how to integrate the URLhaus RPZ (Response Policy Zone) dataset into a Bind DNS server to block resolution of domains actively distributing malware. URLhaus, a community-driven malware URL tracking project, recently surpassed 200,000 tracked malicious URLs, with the majority linked to Emotet (Heodo), followed by Mirai, Gafgyt, and Gozi ISFB (Ursnif).
The article walks through configuring Bind9 on Ubuntu to consume the URLhaus RPZ feed, which updates every 5 minutes and excludes Alexa Top 1M domains to reduce false positives. Once configured, DNS queries for known malware distribution domains return NXDOMAIN, effectively acting as a DNS-layer firewall. The post also includes guidance on logging blocked queries and applying access control lists to prevent the DNS server from becoming an open resolver vulnerable to amplification attacks.
This is a defensive tooling/how-to piece rather than a report on active threat activity, though it references the malware families most commonly associated with URLhaus-tracked distribution infrastructure.
Mentioned in this report
Source reporting: https://abuse.ch/blog/using-urlhaus-as-response-policy-zone-rpz
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs