Spamhaus
The Spamhaus Project
Home  |  XBL FAQs  |  CBL Website  |  NJABL Website





Remove IP
To check or remove an IP address from the XBL, enter it here


Information on this page is for ISPs and mail server administrators.
DNS-based Blocklists (DNSBLs) such as the Spamhaus XBL are designed only for use on mail servers.

Exploits Block List

The Spamhaus Exploits Block List (XBL) is a realtime database of IP addresses of hijacked PCs infected by illegal 3rd party exploits, including open proxies (HTTP, socks, AnalogX, wingate, etc), worms/viruses with built-in spam engines, and other types of trojan-horse exploits.

If your IP address is listed by the XBL, see the XBL FAQs for solutions

Incorporates CBL data and NJABL proxy data

The XBL wholly incorporates data from two highly-trusted DNSBL sources, with tweaks by Spamhaus to maximise the data efficiency and lower False Positives. The main components are:
- the CBL (Composite Block List) from cbl.abuseat.org
- the NJABL Open Proxy IPs list from www.njabl.org.

XBL Usage

The Exploits Block List can be used by all modern mail servers, by setting your mail server's anti-spam DNSBL feature (sometimes called "Blacklist DNS Servers" or "RBL servers") to query xbl.spamhaus.org. XBL is also part of a combined DNSBL comprising SBL, XBL and PBL, see: ZEN

Mail servers already using cbl.abuseat.org should NOT also use xbl.spamhaus.org or you will be making 'double' queries to basically the same data source and only one DNSBL will appear to work (the other(s) will appear to not catch anything). Mail servers already using dnsbl.njabl.org are advised to continue doing so, as dnsbl.njabl.org is itself a composite list and contains more than the open proxy IPs list part now incorporated in XBL.

For information on CBL see http://cbl.abuseat.org/
For information on NJABL see http://www.njabl.org/

Use of the Spamhaus DNSBLs is free of charge for low-volume non-commercial use. To check if you qualify for free use, please see: Spamhaus DNSBL usage criteria.