Welcome to the Spamhaus Developer License

Supporting the internet community

Spamhaus believes in making the internet a safer place. The wider access there is to the latest IP and reputation data, the better.

We manage the free Data Query Service (DQS), on behalf of The Spamhaus Project, for this very reason. The DQS provides small-scale users with access to DNS Blocklists free of charge, 24/7.

We also provide the free DNSF Firewall Threat Feeds to protect against the worst of the worst threats for those running their DNS infrastructure.

But we wanted to take this community spirit a step further; to encourage and support the development of applications and solutions using the wide range of threat intelligence data we have available.

The Spamhaus Developer License

We’re aware that it can take time to find the right use case and build the right application to meet its needs.  So, we’ve created a six-month license, to give developers access to the data without the 30-day time limit attached to a trial. All we ask is that you provide some feedback once you’ve tested the data, to help shape future data enhancements.

Up to 5,000 queries per month are included in the Developer License. For those who require more time to stress test a solution or require additional query volumes for a limited testing time, please reach out to us. Where possible, we will aim to support your requirements.

Developer license via Spamhaus Intelligence API

The Developer License is available via Spamhaus Intelligence API (SIA), providing simple access to a variety of metadata signals. This makes it easy to integrate into threat intelligence platforms, automate reporting, along with many other applications.

Companies, such as Red Sift Open Cloud, are already reaping the benefits from the increased intelligence that SIA’s metadata supplies. SIA has given them a competitive advantage, enabling them to deliver immediate insight to their customers, “saving them weeks of work.”  Read more about this use case here.

What data is available to test?

Here’s an overview of the data available for testing via the Developer License API:

Botnet Controller Dataset: Contains individual IPv4 addresses used to host botnet command and control servers (C&Cs). These botnet C&Cs are used by cybercriminals to control infected computers (bots).

Domain Dataset: Provides actionable metadata for every domain observed and analyzed by our researchers. The metadata includes general domain information and reputation dimensions, for example domain contexts, domain listing data, nameserver reputation, and much more.

Exploits Dataset: Lists IP addresses exhibiting signs of compromise, from malware, Trojan or worm infections, devices controlled by botnets command and controllers (C&Cs), along with third-party exploits, such as open proxies.

Combined Spam Sources Dataset: Focused on SMTP traffic, listing detections based on port-25 only. Potential triggers include sending bulk unsolicited emails, poor email marketing list hygiene, or sending out malicious emails due to compromised accounts or content management systems (CMS).

Abuse.ch – URLhaus Dataset (BETA version): Provides metadata on URLs that are being used for malware distribution. Signals include URLs, domains, IPv4 addresses, DNS names and hashes. Find out how to enhance your investigations by combining this targeted malware data with Spamhaus’ context-rich IP and domain metadata.

Further additional datasets will be released periodically, to enable developers to experiment with all our data and see what challenges they can address.

How to apply for a Developer License.

Fill in the form on our Developer License page. Once you’ve verified your email address, an account is created for you in our Customer Portal, along with access to SIA. It’s that simple.