Amazon SES
Integration

Integration details

• Access the integration

  Spamhaus’ DNSBLs come pre-configured as an Email Add On, and can be activated directly from the Mail Manager console. No development work is needed.

  Sign in to the Amazon SES Console and use this guidance to subscribe to Spamhaus Email Add Ons.

• Suitable users

  Any Amazon SES Mail Manager customer can use this integration.

• Included datasets

  The following data is included:

  • Botnet C2 IPs (Botnet Controller List)

  Botnet command and controller (C2) servers. The status of these single IPv4 addresses is re-evaluated several times a day to identify active botnet controllers only. Utilize for protection or threat intelligence requirements.

  • Bruteforce IPs (AuthBL)

  IP addresses known to host bots using stolen credentials or brute-forcing SMTP-AUTH (and other authentication protocols), helping detect and mitigate ongoing abuse from malicious login attempts.

  • Compromised IPs (Exploits Blocklist)

  IP addresses exhibiting signs of compromise, which can include downloaded malware, security vulnerabilities allowing unauthorized access, etc. Designed to protect networks from malware and spam by preventing connections from these IPs. Available in binary and contextual format.

  • Email Spam IPs (Combined Spam Sources Blocklist)

  Spam-emitting IPs that are direct snowshoe spam sources or senders posing a risk. This includes emails showing indications of an unsolicited nature, sending malicious emails due to a compromise, and other indicators of low reputation or abuse.

  • Highly malicious networks (DROP)

  The worst of the worst malicious traffic IPs - an advisory to “drop all traffic” - with activity directly originating from rogue networks, such as encryption via ransomware, DNS-hijacking, authentication attacks, harvesting, DDoS attacks, and spam campaigns.

  • Low reputation domains (Domain Blocklist)

  Domains and hosts used for suspicious or malicious activity, e.g., those associated with phishing, spam, malware, botnet command and controllers (C2s), and redirector domains; may be owned by malicious actors or have been hijacked. Available in binary and contextual formats.

  • Low reputation resources (Hash Blocklist)

  The worst of the worst IP traffic - it is an advisory to “drop all traffic” from these IPs. DROP seeks out activity directly originating from rogue networks, such as encryption via ransomware, DNS-hijacking and exploit attempts, authentication attacks to discover working access credentials, harvesting, DDoS attacks, and spam campaigns.

  • Malicious network ranges (Spamhaus Blocklist)

  This dataset exposes IPs being observed in a range of adversarial activities, derived through Open Source Intelligence (OSINT) from Spamhaus' most specialized and experienced researchers.

  • Non-mail emitting IPs (Policy Blocklist)

  IPs that should never send email directly to the MX servers of third parties. Networks add and maintain many of these ranges, resulting in strong data efficacy. Spamhaus supplements by identifying end-user IP space that is observed as having high concentrations of botnet zombies.

  • Zero reputation domains (Zero Reputation Domains)

  Newly registered or newly observed domains. These domains are included in this dataset for 24 hours; newly created domains are rarely used for legitimate purposes within 24 hours of registration, which provides a strong indicator of potential malicious behavior.

  
  

  Why does the data have two labels?

  We are moving to more transparent naming conventions. However, some organizations have been consuming these datasets for decades. To save any confusion, for old or new users, we’re currently documenting both names.

• Pricing

  For pricing information, please visit the Amazon SES website.