Block malicious domains
at the DNS layer.

⚙️ How It Works

The nameserver address is dbl.urlabuse.com. Prepend any domain to this address and send a DNS A record query. A blacklisted domain returns 127.0.0.2; a clean domain returns NXDOMAIN.

DNS Query — dig example

Copydig A malware.wicar.org.dbl.urlabuse.com @dbl.urlabuse.com

Sample Output

; <<>> DiG 9.18.28 <<>> @dbl.urlabuse.com malware.wicar.org.dbl.urlabuse.com
;; ANSWER SECTION:
malware.wicar.org.dbl.urlabuse.com. 300 IN A 127.0.0.2

;; ADDITIONAL SECTION:
malware.wicar.org. 300 IN TXT "TARGET: TEST ENTRY"

;; Query time: 93 msec
;; SERVER: 135.181.151.12#53(dbl.urlabuse.com)

🔌 HTTP API

Prefer HTTP over DNS? Use the /lookup endpoint. No authentication required. The only parameter is rd — the domain or FQDN to query.

Endpoint

Copyhttps://dbl.urlabuse.com/lookup?rd={domain}

Python

Copyimport requests, json

url = "https://dbl.urlabuse.com/lookup"
r = requests.get(url, params={"rd": "malware.wicar.org"}, timeout=3)
print(json.loads(r.text))
r.close()

cURL

Copycurl -q "https://dbl.urlabuse.com/lookup?rd=malware.wicar.org"

📋 Notes