Tornevall Networks is currently exploring a new integration layer for ToolsAPI called ToolsAPI Platform Bridge.

The basic idea is similar to services such as IFTTT: connect systems that normally operate separately, let an event in one system trigger something in another, and make those connections manageable from one place.

ToolsAPI already communicates with several external systems today, but many of those integrations have been built for one specific purpose. Platform Bridge would provide a common foundation instead.

Connecting more than social media

The original idea started around social platforms such as Facebook and Bluesky, but it quickly became clear that the same concept can be useful far beyond social media.

A platform could just as easily be Dropbox, OneDrive, Slack, Microsoft Teams, GitHub, Bitbucket, Jira or a forum.

ToolsAPI’s existing vBulletin integration is particularly interesting here. Instead of treating the forum as a separate system, Platform Bridge could make forum activity part of larger automated workflows.

A newly published WordPress article could, for example, create a forum thread, publish a post on Bluesky and Facebook, store related material in Dropbox or OneDrive and send a notification to Slack or Teams.

The flow could also start in the other direction. A new forum thread could trigger publication elsewhere, a GitHub pull request could result in a notification or another action, and changes in Jira or Bitbucket could be connected to other services.

Triggers, conditions and actions

The planned model is deliberately simple:

Something happens -> optional conditions are checked -> one or more actions are performed.

A trigger could be a new article, forum thread, uploaded file, received message, repository change or scheduled task.

Conditions could decide whether the workflow should continue. An automation may only apply to one forum section, a particular WordPress category, a specific repository or files placed in a certain directory.

Actions could then create a thread, publish a post, send a message, upload a file, create an issue or call another ToolsAPI service.

The individual services would still work very differently behind the scenes. Platform Bridge would provide a common layer so the rest of ToolsAPI does not need to understand every external API separately.

A growing list of possible platforms

Current candidates include Facebook, Instagram, WhatsApp, Bluesky, Slack, Microsoft Teams, Dropbox, OneDrive, vBulletin, WordPress, GitHub, Bitbucket and Jira.

Other services such as Discord, Telegram, Matrix, Mastodon, GitLab, Google Drive, SharePoint and generic webhooks are also natural candidates for later integration.

Not every service provides the same possibilities, and some integrations will inevitably be easier than others. The Bridge is therefore being designed around capabilities rather than assuming that every platform can perform the same operations.

Keeping track of what happened

Automation becomes considerably less useful when nobody knows why something failed.

Platform Bridge is therefore also intended to keep a history of events and individual actions. If one automation publishes to three services and one of them fails, the successful actions should remain successful while the failed action can be retried separately.

The same tracking can also prevent loops. If ToolsAPI creates a Facebook post from a forum thread, an incoming event for that Facebook post must not accidentally create another forum thread and start the same process again.

Connections between objects can also be remembered. ToolsAPI could know that a particular WordPress article belongs to a specific forum thread, Facebook post and Bluesky post, making future updates and cross-platform management possible.

Still at an early stage

ToolsAPI Platform Bridge is currently an architecture and development concept rather than a finished service.

The first work is focused on defining a common provider model, connections, triggers, actions, event handling and the database structure needed to support them safely.

The intention is to let existing ToolsAPI integrations gradually become part of the same system while leaving room for completely new platforms later.

In other words, the interesting part is no longer simply getting ToolsAPI to talk to another API.

It is getting all of those systems to talk to each other.

Tools has gained a new central function for receiving, storing and distributing Let’s Encrypt certificates between servers and user accounts.

Certificates that are already created with Certbot can be published to Tools after issuance or renewal. Tools validates the material, stores the PEM files privately and associates the certificate with the correct account. Certbot still handles the actual issuance process – Tools acts as the bridge for access, downloads and administration.

Certificates are collected in one place

Signed-in users can see the certificates assigned to their own account. The interface shows information such as domain names, additional included domains, status, expiry and when the certificate was last updated.

Administrators can assign owners, enable or disable certificates and manage download tokens.

External views and downloads identify certificates by UUID, so internal database IDs do not need to become public identifiers.

Download in the browser or automate it

The latest certificate bundle can be downloaded directly from Tools. A bundle can contain cert.pem, chain.pem, fullchain.pem, privkey.pem and metadata.

Servers that need to retrieve renewed certificates automatically can use the token-protected API download. The same certificate UUID can continue to be used after renewal, while the token can be rotated when necessary.

Ready-made shell and Windows/curl examples are included so another server can fetch the latest certificate without manual handling.

Renewal and import are designed to survive interruptions

Existing Certbot certificates can be imported into Tools. The import utility reports which certificates were published, queued for another attempt or skipped.

If Tools cannot be reached during publication, valid certificate material can be placed in a local retry spool instead of turning the entire renewal flow into a failure. Certbot material under /etc/letsencrypt remains the source and is not modified by the Tools bridge.

A certificate can also unlock its DNS zone

Certificate management is now connected to the DNS editor. An enabled Let’s Encrypt certificate assigned to a user can grant access to the DNS zone covered by that certificate. Wildcard domains are normalized before matching.

This means a user responsible for a certificate does not also need a separate DNS permission for the same zone just to manage it. Existing explicit DNS permissions continue to work as before.

Private key material is handled separately

Public certificate information can be displayed and used in more places, while private key material is treated as sensitive content. Download and administrative paths verify ownership and permissions before private files are released.

The result is a clearer path from Certbot to Tools and onward to the server or user that actually needs the certificate, without placing private PEM files in a public web structure.

SocialGPT 1.2.19 improves the workflow around “Verify fact”. A successful verification no longer has to be something you read once and then lose track of. The result can be saved as a fact card in Tools, reopened later, and shared when needed.

The update also makes troubleshooting clearer when a verification takes a long time or does not behave as expected.

Verifications are saved automatically

When a fact verification succeeds, it is saved as a fact card in the Tools account. This makes it possible to return to an earlier check without running the same search again.

It also becomes easier to review sources at your own pace, compare several verifications, and use an earlier result as a reference.

Saved fact cards can be shared

A saved fact card can receive a public share link. The same finished version can then be opened by somebody else without running the verification again.

This is useful when a result needs to be forwarded, used in a follow-up, or kept as supporting material for other documentation.

A more readable format

Fact cards are displayed in a more editorial format than before. Better Markdown support makes headings, lists, and links easier to read when a result is reopened or shared.

For the user, the result feels more like a finished text and less like raw internal output.

Discreet debugging when it is needed

The verification box now has a small dbg opener. It can show which phase the check is in, how long different parts take, timeout information, transport details, and a compact preview of the response or error.

The troubleshooting view stays out of the way until it is needed. It has its own scrolling area, and its content is easier to read and copy.

Timeout handling now also uses the same logic as other AI calls in the tool. A verification that becomes stuck should therefore no longer be able to keep counting indefinitely without ending clearly.

Clearer Facebook workflows

The Facebook-related admin and review workflows also provide a better overview. The panel more clearly shows queue and duplicate-checking status, the latest batch result, and when scrolling has reached content that is already known or previously sent.

This makes it easier to follow what the tool is actually doing without having to interpret internal details.

No!

We have evolved.

FraudBL.org has been unusually quiet for several years. From the outside, that may look like the project has been abandoned.

That is not what has happened.

FraudBL has gradually become part of a larger rebuild within Tornevall Networks. Instead of continuing to maintain FraudBL as an isolated website with its own aging infrastructure, much of the technical work is now taking place through Tornevall Networks Tools.

The name FraudBL remains. The DNS-based reputation service remains. What has changed is where the surrounding tools, administration and future development are being built.

From a separate website to a wider platform

FraudBL was originally created as a specialized blacklist for IP addresses associated with phishing, fraud and other activity that could cause financial harm.

The public website at FraudBL.org became the recognizable home of the project. Behind the website, however, FraudBL has always depended on DNS infrastructure, classification rules, reporting sources, maintenance tools and administrative processes.

Those parts are now being brought closer together.

The current DNSBL and FraudBL architecture is increasingly managed through ToolsAPI at tools.tornevall.net. Reputation information is still primarily consumed through DNS lookups, while Tools provides the interfaces used to inspect, maintain, publish and remove DNS-backed records.

The active and historical DNS zones include:

• dnsbl.tornevall.org
• bl.fraudbl.org
• ecom.fraudbl.org
• opm.tornevall.org

Tools can perform live checks across the relevant zones, combine returned classification flags and handle record publication through the current DNS infrastructure. Public DNSBL statistics and selected whitelist information are also available through Tools.

The old API model has also changed

Earlier integrations were built around older versions of the Tornevall Networks DNSBL API. Those APIs allowed external systems to check, add, update and remove blacklist records through a traditional HTTP interface.

That older request model is no longer the primary public contract.

The current structure is based on DNS publication, direct DNS resolution and ToolsAPI endpoints for the administrative and specialized parts of the system. Consumers such as the Tornevall Networks WordPress plugin can perform normal reputation checks directly through DNS while using Tools for functions such as token validation, statistics, administration and controlled removal workflows.

This has also made it possible to improve several parts of the system that were previously fragmented:

• DNSBL record inspection.
• Token-backed access.
• Addition, update and removal workflows.
• Bulk operations.
• Dry-run validation.
• Public and internal statistics.
• Whitelist and local-network handling.
• Operator tools for inspecting existing reputation flags.

The work is still ongoing. Some parts are public, some are intended for delegated integrations and some remain operator tools.

FraudBL is still available through DNS

Ordinary users of the blacklist do not need to communicate with ToolsAPI for every lookup.

FraudBL remains a DNS-based service. A mail server, website, plugin or other application can query the relevant DNS zone and interpret the returned address as a bitmask.

Each flag represents a particular type of reputation information. Several flags can be active at the same time, allowing an address to be associated with more than one kind of abuse.

This DNS-first model is intentionally simple for consumers. An application does not need access to the complete FraudBL database. It only needs to perform a DNS lookup and interpret the response.

Tools is becoming the platform that supports the system around those lookups.

What happens to FraudBL.org?

FraudBL.org will remain the historical and recognizable home of the FraudBL name.

The site contains older status updates, documentation references and articles describing how the service was intended to work. Some of that material is outdated, but it also documents ideas that may still be useful.

One example was published on February 23, 2020.

In the article “När du får bedrägerimail”, we explained that people could submit fraudulent emails to FraudBL by sending them to support@fraudbl.org.

The important requirement was that the entire message had to be included.

The visible text of a fraudulent email is rarely enough. The technical headers may contain information about sending servers, routing, authentication, reply addresses and other details needed to investigate where the message came from.

The instructions linked from that article are now old and need to be replaced. The basic idea may still have a future.

A FraudBL service for private individuals

We are currently figuring out how FraudBL should move forward.

One possibility is to create a reporting service intended for ordinary email users. A person who receives a suspicious email could forward the complete message to a dedicated FraudBL intake address.

Calling it a “private person’s blacklist” could easily be misunderstood. The purpose would not be to create a blacklist containing private individuals.

It would be a blacklist and reporting service that private individuals can use.

The simplest possible workflow could look like this:

1. A person receives a suspected phishing or fraudulent email.
2. The complete original message is forwarded to FraudBL.
3. The message is received and analyzed by Tools.
4. Technical indicators are extracted from the email.
5. The report is compared with previous submissions and existing reputation information.
6. Confirmed infrastructure can be reviewed for possible publication through FraudBL.

The submission would preferably be sent as an attached original message or as an .eml file.

A normal forwarded email often removes, replaces or rewrites parts of the original headers. Forwarding the message as an attachment usually preserves much more of the technical information required for a useful investigation.

What could be extracted from a report?

A future intake system could inspect information such as:

• Sending IP addresses.
• Mail server hostnames.
• Message routing.
• Envelope sender information.
• From and Reply-To addresses.
• Domains contained in the message.
• Links leading to login forms, payment pages or fake websites.
• SPF, DKIM and DMARC results included in the headers.
• Repeated wording or templates used across several reports.
• Connections to earlier reports and existing FraudBL records.

Tools could group reports that appear to belong to the same campaign. That would make it easier to distinguish an isolated suspicious email from a larger operation being sent to many recipients.

The technical details could also be separated from the personal content of the email before information is retained or used elsewhere.

One forwarded email must not create a blacklist entry

Receiving a report would not automatically mean that an IP address, domain or mail server should be blacklisted.

Email sender addresses can be forged. Legitimate servers can be compromised. Fraudulent links can be placed on hacked websites. Redirect services and URL shorteners can also appear in messages without being responsible for the fraud itself.

A single report may be mistaken, incomplete or deliberately submitted to harm someone else.

Reports would therefore need to enter a review process.

Automation could extract evidence, group duplicate submissions and identify known indicators. It should not make the final publication decision on its own.

Before a record is published, the system may need to consider:

• Whether the original message is complete.
• Whether the sending address can be verified from the headers.
• Whether several independent recipients have reported the same campaign.
• Whether the infrastructure is compromised or intentionally operated for fraud.
• Whether an IP address belongs to shared hosting or a large mail provider.
• Whether the information is recent enough to remain relevant.
• Whether publishing the record could affect unrelated users.

Privacy must be part of the design

Forwarded emails can contain personal information.

They may include names, email addresses, account references, order numbers, telephone numbers, message history and other information that should not become part of a public blacklist.

A future FraudBL intake service would therefore need clear rules for data minimization.

The original report may need to be stored temporarily for investigation, while only the technical indicators required for abuse prevention are retained for longer periods. Personal content should not be published through DNS or exposed through public reputation responses.

The sender must also be told what happens to a submitted message:

• What information is stored.
• Why it is being processed.
• How long it may be retained.
• Whether it may be reviewed manually.
• Whether extracted indicators can be added to FraudBL.
• How incorrect information can be challenged or removed.

Protecting the reporting system itself

A public reporting address would immediately become a target for spam, automated submissions and attempts to manipulate the blacklist.

The intake process would need protections of its own.

Possible safeguards include:

• Submission limits.
• Duplicate detection.
• Sender verification.
• Automated spam filtering.
• Attachment and message-size restrictions.
• Malware-safe parsing.
• Separation between unverified reports and confirmed evidence.
• Human review before public publication.
• Audit logs for additions and removals.
• A correction and delisting process.

Reports from established providers or trusted integrations could eventually be handled differently from isolated public submissions. They should still be traceable and reviewable.

Where we are today

The consumer reporting service described here has not been launched.

The current work is focused on rebuilding the technical foundation through tools.tornevall.net, improving DNSBL and FraudBL administration, restoring documentation and creating safer record-management and removal workflows.

The older FraudBL article shows that public fraud reporting was already part of the idea in 2020. The rebuilt Tools platform gives us a better foundation for revisiting it.

FraudBL.org is not dead.

FraudBL is becoming part of something larger.