The Spamhaus Project - Frequently Asked Questions (FAQ)

These lists can deployed on routers by peering with Spamhaus BGP feed (BGPf) using the BGP protocol. This allows router equipment to block packets originating from IP addresses involved in specific types of malicious activity.

What are the three lists?

The Botnet Controller List (BCL) is an advisory "drop all traffic" list consisting of single IPv4 addresses. The feed does not contain any subnets or CIDR prefixes longer than /32.
The Don't Route Or Peer (DROP) lists are advisory "drop all traffic" lists, consisting of netblocks that have been "hijacked" or leased by professional spam or cybercrime operations.
The Extended Don't Route Or Peer (EDROP) list is an extended version of the DROP list. It includes netblocks controlled by professional spamming operations and cyber criminals that are not directly allocated.

BGPf USAGE QUESTIONS

Who should use BGPf?
	BGPf can be used by any entity that has the ability to block or filter IP address ranges on their network. NOTE: Most of the other Spamhaus data-sets (SBL, XBL, PBL) are designed for filtering during the SMTP connection. The BGP feed (BGPf) is small in comparison and should not be considered a replacement for them. BGPf can be used to enhance existing filtering and security measures.

How to obtain access to Spamhaus BGP feed (BGPf)?
	The BGPf composite feed can be accessed for an annual fee. Please visit Spamhaus Technology for an application form.

Am I allowed to redistribute DROP and/or EDROP?
	The DROP & EDROP lists may be redistributed as long as attribution is retained. If you wish to redistribute one of the plain text feeds (DROP and/or EDROP) credit for the use must be given to The Spamhaus Project, and the date and © text should remain with the file and data. NOTE: Redistributing/exporting of the composite BGPf version is not allowed.

Am I allowed to redistribute BGPf?
	No. If you adopt the BGPf version of one of these lists or the botnet C&C list in your network, you are not allowed to redistribute the feed to other networks. The export of these feeds/prefixes to other networks is prohibited.

I don't have router equipment, can I still use BGPf?

BGPf is designed to serve null advisories to ISPs or network providers using BGP, which is implemented on the router level.

Spamhaus also offers DROP list and extended DROP list (EDROP) in plain text format which can be used to implement them on nearly any kind of device or software (eg. Network gateways, Firewalls, Web-proxies etc).
The plain text feeds are available at no cost.
The Botnet Controller List (BCL) is available in different formats as well, such as for IDS/IPS and as an RPZ. More information about BCL can be found on the BCL page.