Blocklist Removal Center
About Spamhaus  |  FAQs  |  News Blog   
Blocklist Help

Blocked? To check, get info and resolve listings go to
Blocklist Removal Center

Associated Documents

SBL Listing Policy
SBL Delisting Policy

Spamhaus CSS Component of the SBL

A dedicated Snowshoe component of the Spamhaus Block List.


About the CSS

As a snowshoe spreads the weight of a traveler across a wide area of snow, snowshoe spammers spread their spam output across many IPs and domains in an attempt to dilute reputation metrics and evade spam filters. Snowshoe spammers frequently use fictitious business names (DBAs), false names and identities, concealed anonymous domains and frequently changing postal dropboxes and voicemail drops to prevent others from connecting snowshoe spam operations to one another and recognizing who is behind the operations and the spam they send.

The constant evolution of spamming methods demands that our technologies, data collection, processing and listing procedures adapt continuously. CSS is another element of Spamhaus's response to changes in spamming methods. CSS operates automatically and autonomously in conjunction with and driven by existing elements of Spamhaus including SBL, XBL/CBL, DBL, and our extensive spamtrap and data feeds.


Using CSS in your spam filtering

CSS is an integral part of the SBL (and therefore part of ZEN). CSS data is distinguished only by a different SBL return code (127.0.0.3 as opposed to normal SBL records which use 127.0.0.2). If you are already using the SBL or ZEN you should not need to do anything except ensure that your spam filter handles the additional 127.0.0.3 return code.


CSS Delisting Procedure

Unlike traditional SBL records, SBL CSS records do not have a manual delisting procedure. CSS records are automatically expired after 3 days. For this automatic expiration to work, it is vital that all spamming is terminated. If spamming continues, or continues from IPs in the vicinity of a listed IP, the CSS expiration date is continually reset forward upon being redetected. Redetections are also flagged to the SBL team for more extensive SBL listings of the IP range(s) involved.

In normal operation, therefore, CSS records expire automatically once the customer leasing the IPs is removed from the network and CSS detectors stop detecting spam activity from those IPs.

Contact the CSS team only if you are the ISP responsible for the IP allocation (the IP address range must be registered to you) and if an IP is still listed on the SBL CSS more than 3 days after your customer has been removed from your network. To contact the CSS team click this mailto link and do not alter the Subject line (emails without 'SBLCSS' in the Subject are discarded).
© 1998-2012 The Spamhaus Project Ltd. All rights reserved.
Legal  |  Privacy