This article describes the Intelligence Card Extension for a Multi-RBL check.
About:
This extension includes both a reverse DNS lookup and a Multi-RBL check.
Reverse DNS lookup:
The reverse DNS name which is returned currently resolves to this IP Address. Note that often many other DNS names also currently resolve to the same host IP Address.
The extension finds the reference DNS name for the IP Address by making a PTR record lookup for the DNS Name in the in-addr.arpa domain that corresponds to the specific IP Address. This PTR lookup will eventually be routed through the Regional Internet Registries (RIR) to the organization operating the IP Address, unless it is resolved from cache by one of the intermediate DNS servers.
Wikipedia offers a more complete explanation of the Reverse DNS lookup process.
Multi-BRL Check
According to Wikipedia, a DNS-based Blackhole List (DNSBL), Real-time Blackhole List (RBL), or Reputation Block List are lists used to identify and prevent email spamming. It is a "blacklist" of locations on the Internet reputed to send email spam. The Multi-RBL Checker extension compares an IP against 40+ lists. The extension also performs a Reverse DNS lookup at the same time.
RBL lists queried include: tor.dan.me.uk, misc.dnsbl.sorbs.net, netblock.pedantic.org, xbl.spamhaus.org, and bl.spamcop.net. A full list and descriptions of each can be found in the extension response. Most of these sites don't have any specified query-rate limits, as some of them are personal servers. But for those which do have, a general recommended limit would be 1000 queries per day before getting blacklisted/blocked.
This extension is available on IP Address Intelligence cards, and is free for use by all Recorded Future clients.
Extending IP Cards
RBLs that the given IP address appears on are listed in the "Real-time Blackhole List Hits" section; RBLs that do not include the IP address are included in the "Misses" section.
Users can also pivot on the domain from reverse DNS lookup (when available).