The Spamhaus Project

1.4K Followers
21 Following
593 Posts
Spamhaus strengthens trust and safety for the Internet. Advocating for change through sharing reliable intelligence and expertise. As the authority on IP and domain reputation data, we are trusted across the industry because of our strong ethics, impartiality, and quality of actionable data. This data not only protects but also provides signal and insight across networks and email worldwide. 
With over two decades of experience, our researchers and threat hunters focus on exposing malicious activity to make the internet a better place for everyone. A wide range of industries, including leading global technology companies, use Spamhaus' data; currently protecting over 4.5 billion mailboxes worldwide.
Websitehttps://www.spamhaus.org
Threat Intel Communityhttps://submit.spamhaus.org
LinkedInhttps://www.linkedin.com/company/the-spamhaus-project
Twitterhttps://twitter.com/spamhaus
No April Fools today 😄 this one is real. We've been busy DROP'ing the worst of the worst IP netblocks. Here are the latest additions to the Spamhaus DROP (Do Not Route or Peer) list ⤵️⤵️

If you’re not already using the DROP list to protect your network, now’s a good time to start. Spamhaus provides FREE access to anyone who wants to add this layer of protection.

Get DROP here 👉 https://www.spamhaus.org/blocklists/do-not-route-or-peer/

#ThreatIntel #NetworkSecurity #Infosec

Don't Route Or Peer Lists (DROP) | Use with firewalls & BGP

A free advisory “drop all traffic” list containing the most dangerous IP ranges - available to anyone who wants to add this layer of protection.

The Spamhaus Project

RE: https://infosec.exchange/@spamhaus/116328395667742203

Ok, you got us...April Fools 😜! Can you find and solve the riddle?

Remember that DNSBLs provide A records as the main answer, and TXT are just there for (the lulz) support!

...we're reviving and expanding a project that has contributed greatly to securing the Internet over decades: the CBL 🤩

Now reborn as the "Cosmic Blocklist", it's being expanded to allow the listing of IP addresses even in multiple planetary networks across the solar system, by appending the planet name to the actual internet address, thereby taking into account the inevitable existence of multiple internets in the near future! 🪐 ⤵️

Learn more ➡️ https://www.spamhaus.org/resource-hub/spamhaus/spamhaus-cbl-is-reborn-now-interplanetary/

You can look up the status of an IP on another planet via:
<reverse-IP>.<PLANET>.cbl.spamhaus.org.

Try it with your favorite planet! 🪐

Resources | Spamhaus CBL is reborn… now interplanetary! | Spamhaus Project

From today, the CBL now extends beyond Earth, allowing the listing of IP addresses across multiple planetary networks in the solar system!

The Spamhaus Project

With ongoing discussion around a potential sixth Regional Internet Registry (RIR) for outer space allocations, as outlined in: https://datatracker.ietf.org/doc/draft-li-tiptop-address-space/ …it has become clear that governance of interplanetary IP allocations is no longer hypothetical.

🛰️ Recent incidents involving interference with critical satellite infrastructure demonstrate that space-based threats are no longer theoretical: https://news.satnews.com/2026/02/04/russia-intercepts-europes-key-satellites-placing-nato-satellite-at-risk/

For this reason... ⤵️

LESS THAN 2 WEEKS until access will start to be restricted to those querying our blocklists via Oracle’s network. Stay protected for free with Spamhaus Technology's Data Query Service - changes to config take minutes.

Read more & sign up: 👇
https://www.spamhaus.org/resource-hub/email-security/querying-the-free-dnsbls-via-oracle

#StayProtected #Oracle #DQS

For anyone actually trying to buy internet service from this list of providers? Good luck! We haven't observed abuse traffic emanating from these ASNs yet. But the infrastructure suggests this one is one to keep an eye on! 👀

This same company markets itself as a Chinese provider of "residential proxies." These ASNs are registered at RIPE (@ripencc) as assigned to ISPs delivering fibre to UK homes.

One explanation is that this makes proxy traffic appear to originate from genuine residential broadband customers. But it may not necessarily be for malicious purposes. It could be targeting SEO and those who want to "cheat the system" by simulating traffic from a large pool of users for marketing. ⤵️