Domain Listed on SURBL: What It Means, How to Check, How to Get Removed

A SURBL listing means your domain appeared in links in spam, phishing or malware, or your website looks hacked. SURBL lists domains, not IP addresses, and filters use it on links inside email, so every message that mentions your site is affected. Find out which SURBL list you're on, remove the cause (usually a compromised website or mailing to a bad list), then request removal from the form on SURBL's lookup page.

An r/Emailmarketing thread described a less obvious side effect: a client's company page on LinkedIn sent visitors to a "suspicious page" warning while the domain was on SURBL. LinkedIn doesn't say what feeds that warning, so treat it as a practitioner report. The fix is the same either way.

What each SURBL list means

From SURBL's lists page (read 2 November 2026):

List	What it contains	Usual cause for a legitimate business
ABUSE	"Mainly general abused sites"	Your domain was in links in mail that looked like spam, often from a scraped or bought list
PH	Phishing sites, from PhishTank, PhishLabs and others	A page on your site was used for phishing, usually after a break-in
MW	Sites hosting malware	Malicious files planted on your site
CR	Cracked sites. "Criminals steal credentials or abuse vulnerabilities in CMS such as Wordpress or Joomla"	An outdated CMS or plugin, or stolen FTP or admin credentials
CT	Click tracker domains. "We only list domains used by senders that send emails to mailboxes without confirmed opt-in"	A tracking domain shared with senders mailing unconfirmed lists
DM	Disposable mail domains	Not usually a business site

The combined zone is multi.surbl.org. The last number of the answer says which lists matched: 4 DM, 8 PH, 16 MW, 32 CT, 64 ABUSE, 128 CR, added together when more than one applies (80 is MW plus ABUSE).

How to check

1. Run the domain through our domain blacklist check. It queries some domain lists live and links SURBL's own lookup, because SURBL's free query service isn't for commercial services.
2. Check SURBL directly on its lookup page, linked from surbl.org.
3. Check Google Safe Browsing and Google Search Console's security issues report. If the site was hacked, these usually flag it too.
4. Check every domain your emails link to, not just the From domain: tracking domains, link shorteners and landing pages. Our post on URL shorteners covers why shared shortener domains get listed.

How to get removed

SURBL's removal guidance for CR, PH and MW asks for real cleanup first:

1. Remove the malicious content. Phishing pages, malware, injected redirects and spam pages.
2. Fix how they got in. SURBL names "outdated PHP boards, WordPress, Joomla, third-party plugins" and weak FTP passwords. Update or remove them and rotate every password.
3. Secure the computers used to upload to the site. SURBL warns that unsecured systems "may be broken into again".
4. Check your DNS. SURBL says malicious subdomains may have been added through a compromised DNS control panel. Look for subdomains you didn't create.
5. Then request removal through the lookup page's removal form.

For an ABUSE listing the cause is usually email, not the website: links to your domain in mail that recipients and traps treated as spam. Stop the campaign, find the list it went to, and clean it before sending again. Spam traps sit in scraped and aged lists, and typo-domain addresses are another common source. Our post on getting off a blacklist covers the general delisting order.

Stop it happening again

• Keep the CMS and plugins updated, and remove the ones you don't use.
• Don't mail scraped or bought lists from anything that links to your main domain. Our post on buying email lists explains the trap risk.
• Verify lists before every send. The verify page removes invalid, disposable and dead-domain addresses. It doesn't find spam traps reliably, and no verifier can, so the list source matters more.

The first 100 checks are free with a Google sign-in. Pro is $39 a month with the first 100,000 checks a month at full speed, then slower, never cut off, and one-time packs of 10,000 checks for $15 never expire. See pricing.