Blocklist Removal Center
Contacts  |  Official Statements  |  Sponsors  |  FAQs  |  News Blog   
Bookmark and Share Fraudulent DNSBL uncovered: Protected Sky (bad.psky.me)
Statement

Category: Report
Updated: 2017-05-20
Statement Ref: S015

Blocklist Help

Blocked? To check, get info and resolve listings go to
Blocklist Removal Center

Associated Documents

How Blocklists Work
Legal Questions
Glossary

Spamhaus has uncovered an anonymously-run DNSBL service which was wholly pirating our data and republishing it as its own work. "Protected Sky" (PSKY) published a DNSBL under the name 'bad.psky.me'. The Protected Sky web site contained almost no information on its data, procedures or policies, nor offered any way to request delisting/removal (one of the most important Best Practices as defined by RFC6471).

Suspicions were raised when we noticed that IP addresses recently listed on Spamhaus DNSBLs would consistently appear in bad.psky.me a short time later. Conversely, IP addresses removed from Spamhaus DNSBLs would disappear from bad.psky.me a short time later. Spamhaus listings which require advanced methodologies and intelligence, and thus are not likely to be detected by other DNSBLs were found consistently republished in PSKY. In fact, no Spamhaus listing was found not to be republished by PSKY.

Others also observed close synchronization between Spamhaus listings and removals, and PSKY listings and removals (ref: Webhostingtalk, Webhostingtalk, Hetrixtools, SpamAssassin mailing list). However, user comments (as seen in the links above) also indicate high false positive rates, suggesting that Protected Sky was including other IP addresses than simply Spamhaus zones, so it is possible that they may been pirating other less reliable data sources, too. Spamhaus suggests that all other DNSBL operators check whether their data may have also been copied and republished by PSKY without consent.

Protected Sky's access to Spamhaus DNSBL data was traced back through an unaware third party customer of the Spamhaus Datafeed service. As of 23 March 2017 additional security measures were put in place by the customer to block any further unauthorized access.

In 2009 Spamhaus exposed a similarly fake DNSBL named nsZones.com which, like Protected Sky, was simply stealing and republishing Spamhaus data as its own work.

Spamhaus retains all rights to its trademarks, copyrights, and intellectual property. Republication of Spamhaus data beyond contractual agreements is prohibited. It is easy to find Spamhaus DNSBL Usage Terms on our website.


Statements Index

Popular Spammer Myths About Spamhaus

Fraudulent DNSBL uncovered: Protected Sky (bad.psky.me)

Case Answer: e360Insight vs. The Spamhaus Project

Case Dismissed: Ames & McGee v The Spamhaus Project

EMarketersAmerica v The Spamhaus Project

Spamhaus IPv6 Blocklists Strategy Statement

Fake DNSBL uncovered: nszones.com

Report on the criminal 'Rock Phish' domains registered at Nic.at

TRO Answer: e360Insight vs. The Spamhaus Project

DDoS and Virus Attacks on Spamhaus

Spamhaus Position on CAN-SPAM Act of 2003


Copyright © 2017 The Spamhaus Project Ltd. Reproduction from "Fraudulent DNSBL uncovered: Protected Sky (bad.psky.me)" is permitted provided you quote the source as "The Spamhaus Project" and provide a link to the source url: https://www.spamhaus.org/organization/statement/15/fraudulent-dnsbl-uncovered-protected-sky-bad.psky.me
© 1998-2017 The Spamhaus Project Ltd. All rights reserved.
Legal  |  Privacy