Frequently
Asked
Questions
Frequently asked questions about our solutions and data. If you can’t find what you’re looking for, get in touch below - we’re happy to help.
Categories
abuse.chBorder Gateway Protocol (BGP)Botnet C2 IPsBotnet Controller ListData Query ServiceDNS BlocklistsDNS FirewallDo Not Route or Peer (DROP)General account questionsGeneral terminologyHighly malicious networksListing removalsPassive DNSReputation PortalResponse Policy Zones (RPZ)Sharing data with SpamhausSpamhaus Intelligence APISpamhaus Intelligence API - Developer LicenseFAQs | Botnet Controller List
Will I block legitimate traffic with the "Botnet C2 IPs - Compromised" dataset?
There are two Botnet C2 IPs (Botnet Controller List) datasets:
- “Botnet C2s IPs – Dedicated” which lists IPs of servers dedicated to hosting botnet C&Cs only.
- “Botnet C2s IPs – Compromised” which lists the IP addresses of legitimate devices that bad actors have compromised and are using to host botnet C2s. As a result, there is a minimal chance that null routing these nodes can potentially lead to blocking legitimate traffic that these devices are supposed to generate or receive.
We provide these compromised entries as a separate community to allow users to choose whether they want to include this data. However, we do recommend that all users include this community. It is irrelevant whether a device is being used for legitimate purposes. If it hosts a botnet C2, you should block packets between your network and this IP address. The hosting provider of this IP address will have received an abuse report detailing the problem on their network, and the time to live (TTL) of compromised Botnet C2 IP listings is significantly shorter than dedicated Botnet C2 IP listings. Therefore, the chance of blocking legitimate traffic is minimal.
Need Help?
Get in touch
Spamhaus is committed to protecting and respecting your privacy. We’ll only use your personal information to respond to your enquiry, manage any accounts you may set-up, and to provide the products and services you request from us. From time to time, we would like to contact you about our products and services, as well as other security related content that may be of interest to you. If you consent to us contacting you for this purpose, please tick the box below.
You can unsubscribe from these communications at any time. For more information on how to unsubscribe, our privacy practices, and how we are committed to protecting and respecting your privacy, please review our Privacy Policy.
By clicking submit below, you consent to allow Spamhaus to store and process the personal information submitted above to provide you the content requested.
I agree to receive other communications from Spamhaus.