Our data is produced by true experts with vast experience behind investigations. Through machine learning techniques with advanced automations, we surface robust and reliable, automated detections.
Solutions
Data
Email & Network
Cyber Threat Intelligence
Resources
About
Spam
Intelligence
Get access to data covering millions of Internet resources associated with spam to either protect with or to enrich your research. With unrivalled data coverage and a proven methodology developed over almost 30 years, this data is accurate with minimal false positives.
Robust and
Reliable
By monitoring billions of IP addresses, domains, and networks globally, Spamhaus identifies sources of spam with exceptional accuracy. Our data is derived from a combination of spam traps, expert analysis, and partnerships, including ISPs and law enforcement.
This allows Spamhaus to maintain real-time datasets that help both prevent and detect unsolicited, suspicious and malicious spam emails.
For decades, organizations have trusted us to provide reliable, high-efficacy data with consistently low false positive rates. Whether you need precise spam indicators or broad protection against email-based threats, our data delivers.
Manual and automated detections
Data accuracy and timeliness
Our data is updated within seconds of detection, and validated as offering one of the lowest false positive rates in the industry. When used for protection, it serves high catch rates to keep users away from risk.
Integration and usability
Our data is available via numerous formats and data access methods - covering real-time or remote to local file synchronization - so you have the flexibility and control to utilize the data to best solve your unique business needs.
Datasets
Datasets with Spam Coverage
Our datasets are defined by policy. The policies are created with alignment and input from the wider industry. This is to avoid bias, and ensure sound rationale behind every detection made. Our datasets are grouped by area of concern - for example, highly malicious networks, low reputation resources, zero reputation domains. All datasets shown here have coverage of spam-related activity, with binary and contextual data available, though may not exclusively cover spam.
Bruteforce IPs
Binary Data
IP addresses known to host bots using stolen credentials or brute-forcing SMTP-AUTH (and other authentication protocols), helping detect and mitigate ongoing abuse from malicious login attempts.
Access Methods
Compromised IPs
Binary Data
Contextual Data
IP addresses exhibiting signs of compromise, which can include downloaded malware, security vulnerabilities allowing unauthorized access, etc. Designed to protect networks from malware and spam by preventing connections from these IPs. Available in binary and contextual format.
Domain Intel
Contextual Data
Contextual metadata on every domain observed and analyzed by our researchers. This includes reputation areas to strengthen, domain contexts, senders data, nameserver reputation, A Record reputation, correlated related domains, listed Hostnames, and malware.
Access Methods
Email Spam IPs
Binary Data
Contextual Data
Spam-emitting IPs that are direct spam sources or senders posing a risk. This includes emails showing indications of an unsolicited nature, sending malicious emails due to a compromise, and other indicators of low reputation or abuse.
Highly Malicious ASNs
Binary Data
A list of autonomous system numbers (ASNs) that are hijacked or leased by professional spam or cyber-crime operations and used for dissemination of malware, trojan downloaders, botnet controllers, etc, and send no legitimate traffic.
Access Methods
Highly Malicious Networks
Binary Data
The worst of the worst malicious traffic IPs - an advisory to “drop all traffic” - with activity directly originating from rogue networks, such as encryption via ransomware, DNS-hijacking, authentication attacks, harvesting, DDoS attacks, and spam campaigns.
Low Reputation Domains
Binary Data
Contextual Data
Domains and hosts used for suspicious or malicious activity, e.g., those associated with phishing, spam, malware, botnet command and controllers (C2s), and redirector domains; may be owned by malicious actors or have been hijacked. Available in binary and contextual formats.
Access Methods
Low Reputation Resources
Binary Data
Malicious internet resources, including cryptowallets, malware files, email addresses, and URLs (including shorteners, redirectors, and online file storage providers). Provided as cryptographic hashes and described by users as "a game-changer".
Access Methods
Malicious network ranges
Binary Data
This dataset exposes IPs being observed in a range of adversarial activities, derived through Open Source Intelligence (OSINT) from Spamhaus' most specialized and experienced researchers.
Access Methods
Non-mail emitting IPs
Binary Data
IPs that should never send email directly to the MX servers of third parties. Networks add and maintain many of these ranges, resulting in strong data efficacy. Spamhaus supplements by identifying end-user IP space that is observed as having high concentrations of botnet zombies.
Access Methods
Zero reputation domains
Binary Data
Contextual Data
Newly registered or newly observed domains. These domains are included in this dataset for 24 hours; newly created domains are rarely used for legitimate purposes within 24 hours of registration, which provides a strong indicator of potential malicious behavior.
Related Solutions
Email Protection
Block more than 99% of spam and other email-related threats, including phishing, Business Email Compromise (BEC), emails containing malware, and more.
Email Compliance
Minimize risk, protect users, and maintain a clean, compliant email-sending environment with trusted data and expert insights from Spamhaus.
DNS Protection
Automatically block malicious activity at the DNS level, utilizing Response Policy Zones (RPZs) to safeguard your network and users against a variety of online threats.
Discover more
See all resources
Need Help?
Get in touch
Spamhaus is committed to protecting and respecting your privacy. We’ll only use your personal information to respond to your enquiry, manage any accounts you may set-up, and to provide the products and services you request from us. From time to time, we would like to contact you about our products and services, as well as other security related content that may be of interest to you. If you consent to us contacting you for this purpose, please tick the box below.
You can unsubscribe from these communications at any time. For more information on how to unsubscribe, our privacy practices, and how we are committed to protecting and respecting your privacy, please review our Privacy Policy.
By clicking submit below, you consent to allow Spamhaus to store and process the personal information submitted above to provide you the content requested.
I agree to receive other communications from Spamhaus.