Which datasets are included?
Here is an overview of each dataset included:
Highly Malicious Networks (Do Not Route or Peer, DROP)
This dataset detects the worst of the worst IP traffic - it is an advisory to “drop all traffic” from these IPs. It seeks out activity directly originating from rogue networks, such as encryption via ransomware, DNS-hijacking and exploit attempts, authentication attacks to discover working access credentials, harvesting, DDoS attacks, and spam campaigns. Any traffic from your network to an IP listed in this dataset will likely be a user responding to a phishing email or a device infected with botnet malware.
Botnet C2 IPs (Botnet Controller List)
This dataset is an advisory “drop all traffic” list of individual IPv4 addresses (/32 only) that are actively hosting botnet C&C servers used to control infected computers (bots). It incorporates threat intelligence from abuse.ch, one of Spamhaus’ trusted partners, and is designed to be used at the network edge to stop any infected devices on your network from communicating with a botnet C&C.
The IPs are divided into two categories:
Dedicated – IPs used exclusively to host their botnet C&C infrastructure on dedicated hosts, which serve no other purpose than controlling botnets.
Compromised – IPs belonging to compromised devices (often on residential internet connections) that have been repurposed to host botnet C&C infrastructure. These operators rely entirely on direct IP communication rather than domain names, bypassing protections such as DNS firewalls. This dataset closes a significant gap in network defenses by protecting against malicious traffic to compromised hosts acting as botnet C&C servers.
The status of botnet controller IPs are frequently re-evaluated to ensure only active controllers are listed.
Edge protection with BGP
Block malicious traffic at your network edge using existing hardware and stop infected devices communicating with botnet C&C servers.
Additional details about Spamhaus’ BGP and how to get started with a 30-day free trial can be found here.