Frequently
Asked
Questions

FAQs | Do Not Route or Peer (DROP)

• How often should my system fetch the DROP list?

  Please DO NOT auto-fetch the DROP list more than once per hour.

  The DROP list changes quite slowly. There is no need to update cached data more than once per hour, in fact once per day is more than enough in most cases. Automated downloads must be at least one hour apart. Excessive downloads may result in your IP being firewalled.

• Is eDROP no longer available?

  The eDROP list was combined into the DROP list on 10 April 2024. So, the protection offered by eDROP can now be gained by utilizing the DROP list alone.

  For more information on why this update was made, please read this blog post from The Spamhaus Project: https://www.spamhaus.org/resource-hub/network-security/spamhaus-drop-and-edrop-to-become-a-single-list/

• The DROP list is free for any use, how can it be any good?

  The DROP list contains network ranges which can cause so much damage that Spamhaus provides it to all, free-of-charge. We believe that due to the vital nature of the DROP list data, it will be available free-of-charge to any place, regardless of size or business type, to protect internet users. If you wish to redistribute the plain text feeds, name Spamhaus as source of the data and retain both the copyright statement and the date & time stamps at the top of the text file.

• What are "hijacked netblocks"?

  A ‘hijacked netblock’ is a netblock brought back from the dead, also called a ‘zombie netblock’. The original owner of the block may have left it derelict for any number of reasons. Squatters then reclaim it with various ploys including registering an abandoned domain name to accept email to the point-of-contact domain contact, or printing up bogus letterhead, or doing a bit of social engineering over the telephone. Some hijackers even outright steal IP space that is allocated to someone else, just by announcing it under their Border Gateway Protocol (BGP) Autonomous System Number (ASN).

  ASNs can be hijacked too. Old abandoned ASNs are taken by a spammer, or spammer supplier, to announce various IP ranges. It’s quite possible to have a hijacked netblock advertised by a hijacked ASN!

• What is DROP/EDROP?

  DROP (Don’t Route Or Peer) is an advisory “drop all traffic” list.

  • The DROP list will not include any IP space allocated to a legitimate network and reassigned.
  • DROP does include netblocks that are hijacked or leased by professional spam or cybercrime operations (used for dissemination of malware, trojan downloaders, botnet controllers, etc).
  • These are direct allocations from ARIN, RIPE, APNIC, LACNIC, or other Regional Internet Registries and “portable allocations” (known as “PI”) from RIPE.

  The EDROP list includes net blocks controlled by professional spammers and cyber criminals that are not directly allocated, thus it will contain only netblocks that are sub-allocations.