The Spamhaus Project

About Spamhaus research and data

Where does Spamhaus data come from?

We hand-pick the best security researchers, threat hunters and developers from across the globe. This team analyzes huge volumes of data that are shared with us by organizations who want to contribute to making the internet a safer place. Through sensors on their networks, data that doesn't contain personally identifiable information, is collected and shared with our research team.

Types of organizations sharing data with Spamhaus

Independent Threat Hunters pictogramIndependent Threat Hunters
Hosting Providers pictogramHosting Providers
Email Service Providers pictogramEmail Service Providers
Law Enforcement pictogramLaw Enforcement
In-house Spamtraps pictogramIn-house Spamtraps
Enterprise Businesses pictogramEnterprise Businesses

How does Spamhaus analyze its data?

Machine Learning pictogramMachine Learning
Heuristics pictogramHeuristics
Manual Investigation pictogramManual Investigation

Spamhaus data principles

Reliable data
Robust data collection and rigorous expert analysis.
Reliable
Actionable data
Data and signal for investigation, detection and protection.
Actionable
Timely data
Real-time investigation and threat detection 24/7.
Timely

How much data does Spamhaus analyze in 24 hours?

280,000,000Track 280 million domains
22,000Process 22,000 malware samples
7,500,000,000Analyze 7.5 billion SMTP connections
650,000New detections relating to exploited IPs
4,500,000,000Protect 4.5 billion mailboxes

Want to share data with Spamhaus?

Organizations who want to share large volumes of data, contact our data sharing team.

Contact Us

Want to share threat intelligence with Spamhaus?

Small organizations and individuals who want to share suspicious or malicious activity, visit the Threat Intel Community.

Share Now

How can IP and domain reputation data be used?

We collect and analyze a multitude of signals associated with the IPs and domains we observe. Through careful investigations "reputation" is attributed to every internet identifier.

This immensely rich signal relating to IPs and domains should be used to inform how to interact with these internet identifiers, what they are and who they belong to. From a user wanting to purchase an item from an online store to a Security Operations Center (SOC) wanting to investigate a vulnerability, reputation data is a fundamental part of the ecosphere.

Useful links about IP and domain reputation

Reputation Data
About The Research
...
About The Research