|Fraudulent DNSBL uncovered: Protected Sky (bad.psky.me)|
Statement Ref: S015
Blocked? To check, get info and resolve listings go to
Blocklist Removal Center
How Blocklists Work
Spamhaus has uncovered an anonymously-run DNSBL service which was pirating our data and republishing it as its own work. "Protected Sky" (PSKY) published a DNSBL under the name 'bad.psky.me'. The Protected Sky web site contained almost no information on its data, procedures and policies, nor offered any way to request delisting/removal (one of the most important Best Practices as defined by RFC6471).
Suspicions were raised when we noticed that IP addresses recently listed on Spamhaus DNSBLs would consistently appear in bad.psky.me a short time later. Conversely, IP addresses removed from Spamhaus DNSBLs would disappear from bad.psky.me a short time later. Spamhaus listings which require advanced methodologies and intelligence, and thus are not likely to be detected by other DNSBLs were found consistently republished in PSKY. In fact, no Spamhaus listing was found not to be republished by PSKY.
Others also observed close synchronization between Spamhaus listings and removals, and PSKY listings and removals (ref: Webhostingtalk, Webhostingtalk, Hetrixtools, SpamAssassin mailing list). However, user comments (as seen in the links above) also indicate high false positive rates, suggesting that Protected Sky was including other IP addresses than simply Spamhaus zones, so it is possible that they may been pirating other less reliable data sources, too. Spamhaus suggests that all other DNSBL operators check whether their data may have also been copied and republished by PSKY without consent.
Protected Sky's access to Spamhaus DNSBL data was traced back through an unaware third party customer of the Spamhaus Datafeed service. As of 23 March 2017 additional security measures were put in place by the customer to block any further unauthorized access.
In 2009 Spamhaus exposed a similarly fake DNSBL named nsZones.com which, like Protected Sky, was simply stealing and republishing Spamhaus data as its own work.
Spamhaus retains all rights to its trademarks, copyrights, and intellectual property. Republication of Spamhaus data beyond contractual agreements is prohibited. It is easy to find Spamhaus DNSBL Usage Terms on our website.
Fraudulent DNSBL uncovered: Protected Sky (bad.psky.me)
Popular Spammer Myths About Spamhaus
Case Dismissed: Ames & McGee v The Spamhaus Project
EMarketersAmerica v The Spamhaus Project
Case Answer: e360Insight vs. The Spamhaus Project
Spamhaus IPv6 Blocklists Strategy Statement
Fake DNSBL uncovered: nszones.com
Report on the criminal 'Rock Phish' domains registered at Nic.at
TRO Answer: e360Insight vs. The Spamhaus Project
DDoS and Virus Attacks on Spamhaus
Spamhaus Position on CAN-SPAM Act of 2003
Copyright © 2017 The Spamhaus Project Ltd. Reproduction from "Fraudulent DNSBL uncovered: Protected Sky (bad.psky.me)" is permitted provided you quote the source as "The Spamhaus Project" and provide a link to the source url: https://www.spamhaus.org/organization/statement/15/fraudulent-dnsbl-uncovered-protected-sky-bad.psky.me