Data Query Service
Free Account

Details of service

• Setting up an account

  Simply complete the form and submit.

• System requirements

  Use your existing email infrastructure, no additional hardware required.

  For users of SpamAssassin and Rspamd, purpose-built plug-ins are available on GitHub to maximize catch rates when using our real-time DNSBLs:

  GitHub – SpamAssassin plug-in

  GitHub – Rspamd plug-in

• Technical Documentation

  Full configuration details for the Data Query Service can be found on our documentation page.

  PLEASE NOTE: We are unable to provide technical support for any of our free services.

• Datasets included

  The following data is included in the free Data Query Service:

  • Bruteforce IPs (AuthBL)

  IP addresses known to host bots using stolen credentials or brute-forcing SMTP-AUTH (and other authentication protocols), helping detect and mitigate ongoing abuse from malicious login attempts.

  • Compromised IPs (Exploits Blocklist)

  IP addresses exhibiting signs of compromise, which can include downloaded malware, security vulnerabilities allowing unauthorized access, etc. Designed to protect networks from malware and spam by preventing connections from these IPs. Available in binary and contextual format.

  • Email Spam IPs (Combined Spam Sources Blocklist)

  Spam-emitting IPs that are direct snowshoe spam sources or senders posing a risk. This includes emails showing indications of an unsolicited nature, sending malicious emails due to a compromise, and other indicators of low reputation or abuse.

  • Highly malicious networks (DROP)

  The worst of the worst malicious traffic IPs - an advisory to “drop all traffic” - with activity directly originating from rogue networks, such as encryption via ransomware, DNS-hijacking, authentication attacks, harvesting, DDoS attacks, and spam campaigns.

  • Low reputation domains (Domain Blocklist)

  Domains and hosts used for suspicious or malicious activity, e.g., those associated with phishing, spam, malware, botnet command and controllers (C2s), and redirector domains; may be owned by malicious actors or have been hijacked. Available in binary and contextual formats.

  • Malicious network ranges (Spamhaus Blocklist)

  This dataset exposes IPs being observed in a range of adversarial activities, derived through Open Source Intelligence (OSINT) from Spamhaus' most specialized and experienced researchers.

  • Non-mail emitting IPs (Policy Blocklist)

  IPs that should never send email directly to the MX servers of third parties. Networks add and maintain many of these ranges, resulting in strong data efficacy. Spamhaus supplements by identifying end-user IP space that is observed as having high concentrations of botnet zombies.

  • Zero reputation domains (Zero Reputation Domains)

  Newly registered or newly observed domains. These domains are included in this dataset for 24 hours; newly created domains are rarely used for legitimate purposes within 24 hours of registration, which provides a strong indicator of potential malicious behavior.

  
  

  Here’s a comparison table to view what’s included in the free and commercial service.

• Usage Terms

  If you are a non-commercial entity or individual with low query volumes, you may qualify for a Data Query Service account to access our real-time DNSBLs with no subscription costs.

  Here are the terms related to this service.