Frequently
Asked
Questions

FAQs | General terminology

• What is a botnet command and controller (C&C)?

  A ‘botnet controller,’ ‘botnet C2,’ or ‘botnet command & control’ server is commonly abbreviated to ‘botnet C&C.’ Fraudsters use these to control malware-infected machines (bots) and extract personal and valuable data from malware-infected victims.

  Botnet C&Cs play a vital role in operations conducted by cybercriminals who are using infected machines to send out spam or ransomware, launch DDoS attacks, commit e-banking fraud or click fraud, or mine cryptocurrencies such as Bitcoin.

  Desktop computers and mobile devices, like smartphones, aren’t the only machines that can become infected. There is an increasing number of devices connected to the internet, for example, the Internet of Things (IoT), devices like webcams, network attached storage (NAS), and many more items. These are also at risk of becoming infected.

• What is an Initial Access Broker?

  The term “Initial Access Brokers” (IABs) refers to threat actors who operate in groups trying to breach corporate networks. They use various tactics, techniques, and procedures (TTPs) to achieve their goals.

  Once they have penetrated a network, they will ascertain key facts relating to the breached network, for example, location, size, and industry. This enables them to place a value on an asset. The broker will then negotiate with potential buyers who want to purchase access to the victim’s network.

• What is DROP/EDROP?

  DROP (Don’t Route Or Peer) is an advisory “drop all traffic” list.

  • The DROP list will not include any IP space allocated to a legitimate network and reassigned.
  • DROP does include netblocks that are hijacked or leased by professional spam or cybercrime operations (used for dissemination of malware, trojan downloaders, botnet controllers, etc).
  • These are direct allocations from ARIN, RIPE, APNIC, LACNIC, or other Regional Internet Registries and “portable allocations” (known as “PI”) from RIPE.

  The EDROP list includes net blocks controlled by professional spammers and cyber criminals that are not directly allocated, thus it will contain only netblocks that are sub-allocations.

• Why have the names of the datasets and data access methods changed?

  Many of our datasets and data access methods have served users for years under technical names and acronyms. As more people start using our data, we've renamed them so it's clearer at a glance what each one is. The legacy names haven't disappeared. You'll still see them in older documentation, and we list them below so you can match old to new.

  What has changed?

  Legacy name	New name
  Data Query Service (DQS)	Blocklists via DNS Query
  Web Query Service (WQS)	Blocklists via HTTPS
  BGP Firewall	Border Gateway Protocol
  DNS Firewall	DNS Response Policy Zones
  Spamhaus Intelligence API (SIA)	Intelligence API

  Legacy name	New name
  Authentication Blocklist (AuthBL)	Bruteforce IPs
  Botnet Controller List (BCL)	Botnet C2 IPs
  Hash Blocklist (HBL)	Low Reputation Resources
  Domain Dataset	Domain Intel
  Exploits Blocklist (XBL)	Compromised IPs
  Combined Spam Sources (CSS)	Email Spam IPs
  ASN DROP	Highly Malicious ASNs
  Don't Route Or Peer (DROP)	Highly Malicious Networks
  Domain Blocklist (DBL)	Low Reputation Domains
  Spamhaus Blocklist (SBL)	Malicious Network Ranges
  Policy Blocklist (PBL)	Non-mail Emitting IPs

  Does the data or service I receive change?
  No. Only the names have changed. The data, coverage and delivery are exactly as before.

  Do I need to update my configuration?
  No action is needed.

  Have the free Spamhaus Project blocklists been renamed?
  No. The SBL, XBL, DBL, PBL, CSS and DROP keep their names on the Spamhaus Project. The new names apply only to the commercial datasets available through Spamhaus Technology.

  Have the abuse.ch platforms been renamed?
  No. MalwareBazaar, ThreatFox, URLhaus and YARAify keep their names. Commercial access to their data is described as Malware samples, Malware IOCs, Malware URLs and YARA scan results.

  Why do I still see the old names in places?
  We're updating our website, documentation and customer materials in stages, so you may come across legacy names for a while. The tables above map each one.