Our data is produced by true experts with vast experience behind investigation. Through machine learning techniques with advanced automations, we surface robust and reliable, automated detections.
Solutions
Data
Email & Network
Cyber Threat Intelligence
Resources
About
Phishing
Intelligence
With one of the largest SMTP connection databases, website investigations and a contributing community of researchers, Spamhaus offers phishing insight unavailable from another single source. Access hundreds of thousands of datapoints to enhance your defense against evolving attacks.
Trusted
detections
Spamhaus has over 25 years of detecting malicious email attempts and hosting of possibly criminal content. Since the practice of phishing started, we have been detecting, tracking and sharing data to reduce its impact, and increase the cost for malicious actors.
We understand this tactic deeply, including its evolution and how it often presents today: sophisticated, targeted, and more convincing to users than ever.
We’ve been able to share this data for decades because we are trusted. With low false positive rates and high efficacy, whether you want data directly attributable to phishing, or want broad protection against this type of attack vector, we’ve got you covered.
Manual and automated detections
Data accuracy and timeliness
Our data is updated within seconds of detection, and validated as offering one of the lowest false positive rates in the industry. When used for protection, it serves high catch rates to keep users away from risk.
Integration and usability
Our data is available via numerous formats and data access methods - covering real-time or remote to local file synchronization - so you have the flexibility and control to utilize the data to best solve your unique business needs.
Datasets
Datasets with Phishing Coverage
Our datasets are defined by policy. The policies are created with alignment and input from the wider industry. This is to avoid bias, and ensure sound rationale behind every detection made. Our datasets are grouped by area of concern - for example, highly malicious networks, low-reputation resources, and zero-reputation domains. All datasets shown here have coverage of phishing-related activity, with binary and contextual data available, though may not exclusively cover phishing.
Bruteforce IPs
Binary Data
IP addresses known to host bots using stolen credentials or brute-forcing SMTP-AUTH (and other authentication protocols), helping detect and mitigate ongoing abuse from malicious login attempts.
Access Methods
Compromised IPs
Binary Data
Contextual Data
IP addresses exhibiting signs of compromise, which can include downloaded malware, security vulnerabilities allowing unauthorized access, etc. Designed to protect networks from malware and spam by preventing connections from these IPs. Available in binary and contextual format.
Domain Intel
Contextual Data
Contextual metadata on every domain observed and analyzed by our researchers. This includes reputation areas to strengthen, domain contexts, senders data, nameserver reputation, A Record reputation, correlated related domains, listed Hostnames, and malware.
Access Methods
Email Spam IPs
Binary Data
Contextual Data
Spam-emitting IPs that are direct spam sources or senders posing a risk. This includes emails showing indications of an unsolicited nature, sending malicious emails due to a compromise, and other indicators of low reputation or abuse.
Highly Malicious ASNs
Binary Data
A list of autonomous system numbers (ASNs) that are hijacked or leased by professional spam or cyber-crime operations and used for dissemination of malware, trojan downloaders, botnet controllers, etc, and send no legitimate traffic.
Access Methods
Highly Malicious Networks
Binary Data
The worst of the worst malicious traffic IPs - an advisory to “drop all traffic” - with activity directly originating from rogue networks, such as encryption via ransomware, DNS-hijacking, authentication attacks, harvesting, DDoS attacks, and spam campaigns.
Low Reputation Domains
Binary Data
Contextual Data
Domains and hosts used for suspicious or malicious activity, e.g., those associated with phishing, spam, malware, botnet command and controllers (C2s), and redirector domains; may be owned by malicious actors or have been hijacked. Available in binary and contextual formats.
Access Methods
Low Reputation Resources
Binary Data
Malicious internet resources, including cryptowallets, malware files, email addresses, and URLs (including shorteners, redirectors, and online file storage providers). Provided as cryptographic hashes and described by users as "a game-changer".
Access Methods
Malicious network ranges
Binary Data
This dataset exposes IPs being observed in a range of adversarial activities, derived through Open Source Intelligence (OSINT) from Spamhaus' most specialized and experienced researchers.
Access Methods
Non-mail emitting IPs
Binary Data
IPs that should never send email directly to the MX servers of third parties. Networks add and maintain many of these ranges, resulting in strong data efficacy. Spamhaus supplements by identifying end-user IP space that is observed as having high concentrations of botnet zombies.
Access Methods
Zero reputation domains
Binary Data
Contextual Data
Newly registered or newly observed domains. These domains are included in this dataset for 24 hours; newly created domains are rarely used for legitimate purposes within 24 hours of registration, which provides a strong indicator of potential malicious behavior.
Related Solutions
Email Protection
Block more than 99% of spam and other email-related threats, including phishing, Business Email Compromise (BEC), emails containing malware, and more.
DNS Protection
Automatically block malicious activity at the DNS level, utilizing Response Policy Zones (RPZs) to safeguard your network and users against a variety of online threats.
Threat Hunting
Improve detection fidelity with data solely concentrated on malware-focused intrusions to drive hunting hypotheses, understand trends and correlations, and prioritize investigation paths.
Discover more
See all resources
Need Help?
Get in touch
Spamhaus is committed to protecting and respecting your privacy. We’ll only use your personal information to respond to your enquiry, manage any accounts you may set-up, and to provide the products and services you request from us. From time to time, we would like to contact you about our products and services, as well as other security related content that may be of interest to you. If you consent to us contacting you for this purpose, please tick the box below.
You can unsubscribe from these communications at any time. For more information on how to unsubscribe, our privacy practices, and how we are committed to protecting and respecting your privacy, please review our Privacy Policy.
By clicking submit below, you consent to allow Spamhaus to store and process the personal information submitted above to provide you the content requested.
I agree to receive other communications from Spamhaus.