Have you been blocked?
All blocklists are researched and managed by The Spamhaus Project.
Simply click on the link below, which will take you to the Project’s IP and Domain Reputation Checker. From here you will be able to enter your IP or Domain and begin your request for removal.
Please note that the Project’s IP and Domain Reputation Checker is the only place where removals are handled.
IT and security teams consistently face multiple business challenges. Discover how our solutions can help overcome some of those issues.
From processing issues, to email-borne threats our blocklists easily integrate with your current email set-up to improve anti-spam & anti-virus email filtering.
Employ our threat intelligence to increase visibility across security events, reveal potential weaknesses in your network, and threats to your brand.
Stay on top of the latest threats and proactively combat botnet infections, and other forms of abuse, with our solutions.
From clicking on phishing emails to visiting malware dropper sites, our threat intelligence provides automatic protection for your users.
Data for Integration
Enhance your service and create competitive advantage by integrating Spamhaus’ world-class IP and domain reputation data.
Our products provide additional layers of security for networks and email. They also present security teams with additional insight into malicious behavior.
Border Gateway Protocol (BGP)
Block the worst of the worst at your network edge, taking advantage of your existing BGP-capable routers. Configuration only takes minutes.
Data Query Service (DQS)
Benefit from industry-leading real time blocklists. These DNSBLs easily plug into your existing email infrastructure to block spam and other email threats.
A powerful research tool to investigate relationships between internet infrastructures. Quickly pivot to new areas of concern to rapidly investigate potential threats.
Immediately block connections to dangerous sites, including phishing and malware dropper websites. A ‘set and forget’ solution.
Spamhaus Intelligence API
Threat intelligence data in API format to enable users to easily integrate metadata relating to threats with their own applications, programs, and products.
A wide range of datasets, providing multiple layers of protection. They can be plugged directly into your existing hardware, making them an affordable choice.
Border Gateway Protocol (BGP) Feeds
Do Not Route Or Peer (DROP) and Botnet Controller List (BCL) datafeeds can peer with your existing BGP-capable router.
Domain (DBL), Zero Reputation (ZRD) and Hash blocklists (HBL) enable you to block content in emails, filtering out a higher rate of email-borne threats.
Data for Investigation
Passive DNS and extended datasets give you additional information on internet resources. They provide deeper insights into incidents and possible threats.
DNS Firewall Threat Feeds
A wide range of feeds to apply to your DNS recursive server. Choose the right level of protection for your organization.
Spam (SBL), Policy (PBL), Exploits (XBL) and Auth (AuthBL) blocklists allow you to filter email from IPs associated with spam, botnets, and other threats.
Find out more about us.
Learn more about Spamhaus; who we are, and what we do.
Find a parter
Discover our partners and how they can support you.
Become a partner
Learn about the benefits of being a Spamhaus partner and how to get started.
Discover a wide range of blog posts, case studies and reports.
Spamhaus’ insight into malware, botnet C&Cs, and the domain reputation landscape.
Commonly asked questions about Spamhaus products and processes.
The Blocklist Tester
A tool to help you check if your servers are correctly configured to use Spamhaus DNSBLs.
The Reputation Portal
A tool for ASN owners to get visibility of their IPs’ reputation and proactively manage listings.
Help for the Project's legacy DNSBLs users
Using the Project’s legacy blocklists and suddenly experiencing email issues? This page may be able to help.
In depth information about the technical details and implementation of our products.
Posted by Milly Fawcett on 1 Jul 2022
Passive DNS has been an industry-standard tool for more than a decade. Here's an introduction to Passive DNS, where the data comes from, how it can help boost threat intelligence data and help organizations with investigations, protecting their networks and brand.
Until the introduction of Passive DNS, there was no way to retrieve the content of any DNS zone owned by other people. Why? System administrators were not keen to share them. Also, once a change was made to a DNS record, the previous details were gone forever as the new version immediately propagated across the internet… Not very helpful if you need to research all the domain names a suspect IP address has resolved to historically, and vice versa. Passive DNS resolves this issue.
To understand where Passive DNS data comes from we need to take a closer look at the basics of DNS. Passive DNS data is generated when a cache miss takes place and the hostname is resolved by an external authoritative server, instead of a DNS resolver’s cache. When you go to look at www.example.com, if no one’s checked that website out recently, the domain name has to be resolved using external DNS queries. Take a look at the infographic below:
With special probes activated on the DNS resolver, after a cache miss has happened, it is possible to record the packets containing the answers to the client, along with the time & date stamp of when the query was made. This is Passive DNS data.
No! All PII is held downstream. Passive DNS data does not contain which client (or person) made a query, just the fact that at some point in time, there was an association between a specific domain and a specific DNS record. Here is the exact information recorded:
Privacy is maintained throughout.
Passive DNS data from Spamhaus is collected across the internet globally from trusted third parties, including hosting companies, enterprises, and ISPs.
Spamhaus’ Passive DNS cluster handles more than 200 million DNS records per hour and stores hundreds of billions of records per month, providing you with access to a vast lake of threat intelligence data.
Passive DNS data can improve existing threat intelligence data streams, increasing visibility across potential threats. It provides a wealth of DNS-focused information for IT security teams, research teams, and brand protection specialists.
Research analysts can gain insight as to how a particular domain name changes over time and how it is related to other domains and/or IP addresses. For example, where this typically static data is suddenly changing rapidly, and a hostname’s IP address changes every 30 seconds, this indicates malpractice and requires further investigation. Passive DNS data enables you to build a picture of potential threats across global networks that cannot be identified by monitoring your network.
Brand protection specialists can identify spoofed domains/websites, noting when they have been active and how they are associated with other domains.
Discover the value this data can bring. Sign up for a FREE Passive DNS trial here.
Our Passive DNS allows you to quickly and easily navigate through billions of DNS records to shine a spotlight on potentially malicious internet resources associated with your network or domain.
23 September 2020
Discover how Passive DNS data can help brand specialists and marketing teams quickly identify potentially harmful domains.