The Spamhaus Project

Strengthening trust and safety across the internet

Spamhaus Project is the authority on IP and domain reputation. This intelligence enables us to shine a light on malicious activity, educate and support those who want to change for the better and hold those who don't to account. We do this together with a like-minded community.

7,500,000IPs analyzed every 24 hours
3,000,000Domains processed every 24 hours
4,500,000,0004.5 billionProtected User Mailboxes
1,500Active botnet command and controllers detected
Global internet traffic changes daily, as do the activities of adversaries. These statistics are indicators based on daily averages; actual daily figures will fluctuate.

Are you listed in one of Spamhaus' blocklists?

Do you have problems sending email? Do you need to check if an IP address or domain name is on one of our blocklists?

Submit malicious activity to the Threat Intel Community Portal

Be part of our community; share IPs, domains, URLs or raw source of potentially malicious activity or threats.

Submit

Spotlight on Spamhaus data reputation statistics

Last updated: 29th July 2025

Countries

Best
Czechia-67%Hosting botnet command and controllers
Worst
Iran+900%Hosting botnet command and controllers
July 2025
Robot with countries

Networks

Best
unifique .com .br-70%Largest decrease in exploited IPs
Worst
smart.com.ph+1,792%Largest increase in exploited IPs
July 2025
Robot with countries

gTLDs

Best
.hair-35%Largest % decrease in spam-related domains
Worst
.coupons+138%Largest % increase in spam-related domains
July 2025
Robot with countries

ccTLDs

Best
.se-37%Largest % decrease in malicious domains
Worst
.nz+225%Largest % increase in malicious domains
July 2025
Robot with countries

Registrars

Best
阿里云计算有限公司-54%Largest % decrease in phishing domains
Worst
西部数码国际有限公司+435%Largest % increase in phishing domains
July 2025
Robot with countries

Countries

Best
Czechia-67%Hosting botnet command and controllers
Worst
Iran+900%Hosting botnet command and controllers
July 2025
Robot with countries

News feed

5 days ago

Some miscreants come and go - others stay in business for years. An example of the latter is a prolific IP hijacking operation using AS398770 (Twisted Computing Incorporated 🇺🇸) since January, among others. At this time, AS398770 announces hijacked IPv4 networks allocated to 🇨🇱-based Adexus S.A., first hitting our radar in late May. 📡

In the past, we also observed botnet controller hosting at AS398770, as well as more IP hijacking incidents, networks impersonating tier-1 US ISPs, and snowshoe spam.

Involved personas are no strangers at all: Their nefarious activity goes back until 2011 and the (still unresolved) IP hijacking case involving US defense contractor Planning Research Corporation:

👉 check.spamhaus.org/results?que...

Investigating IP hijacking incidents often requires classic detective work, such as sifting through commercial registers, tracing back network assets of defunct companies, and working with those that are still in business to reclaim their stolen digital goods. 🕵

More information on this topic, and how to protect your network against hijacking and other hijacks (hint: DROP and ASN-DROP 😉), is available here:

👉 spamhaus.org/resource-hub/hija

24 Jul 2025, 13:37
1 boost·4 favourites
6 days ago
 
7 days ago
 
11 days ago
 
12 days ago
 
5 days ago

Some miscreants come and go - others stay in business for years. An example of the latter is a prolific IP hijacking operation using AS398770 (Twisted Computing Incorporated 🇺🇸) since January, among others. At this time, AS398770 announces hijacked IPv4 networks allocated to 🇨🇱-based Adexus S.A., first hitting our radar in late May. 📡

In the past, we also observed botnet controller hosting at AS398770, as well as more IP hijacking incidents, networks impersonating tier-1 US ISPs, and snowshoe spam.

Involved personas are no strangers at all: Their nefarious activity goes back until 2011 and the (still unresolved) IP hijacking case involving US defense contractor Planning Research Corporation:

👉 check.spamhaus.org/results?que...

Investigating IP hijacking incidents often requires classic detective work, such as sifting through commercial registers, tracing back network assets of defunct companies, and working with those that are still in business to reclaim their stolen digital goods. 🕵

More information on this topic, and how to protect your network against hijacking and other hijacks (hint: DROP and ASN-DROP 😉), is available here:

👉 spamhaus.org/resource-hub/hija

24 Jul 2025, 13:37
1 boost·4 favourites
6 days ago
 
7 days ago
 
11 days ago
 
12 days ago