Blocklist Removal Center
About Spamhaus  |  FAQs  |  News Blog   
Blocklist Help

Blocked? To check, get info and resolve listings go to
Blocklist Removal Center

Associated Documents

SBL Home Page
SBL Delisting Policy

SBL FAQs
DNSBL Usage Terms
How Blocklists Work
Datafeed Service
SBL Policy

IP addresses are listed on the SBL because they appear to Spamhaus to be under the control of, used by, or made available for the use of, senders of Unsolicited Bulk Email ("spammers") or perpetrators of other types of Internet-based security threats.

The Spamhaus definition of "spam" is "unsolicited bulk email" ("UBE"). Spamhaus does not evaluate the content or legality of spam, merely whether a message is spam by our definition or not. The responsibility for complying with Spamhaus SBL policy begins and ends with senders of bulk email, hosts of websites advertised by bulk email or that host malware, and providers of services used to support bulk email or malware operations. SBL listings are based on evidence which has satisfied the SBL team that the IP address or IP range meets our listing criteria and represents a nuisance or threat to SBL users.

SBL listings are immediate. In cases that involve known spam operations or IP ranges that exhibit characteristics strongly associated with spam or malware, SBL listings may be preemptive. The SBL does not provide warnings or have a 'grace period', and does not require physical evidence of spam received from any specific IP. IP addresses owned by or under the control of known spam operations listed on the Spamhaus ROKSO are listed in the SBL on sight. Notification of SBL listings is discussed below.

The criteria for listing IP addresses in the SBL is:

SBL Listing Criteria
Spam Sources
Sources of unsolicited bulk email identified by Spamhaus
Snowshoe spam ranges
Snowshoe spam style configurations, particularly ranges and domains with poor or frequently changing identification
Spam Hosting
IPs that host spam-advertised websites or other resources used by spammers or malware operations
Spam Operations
Known spam or malware operations listed in the Spamhaus Register of Known Spam / Malware Operations (ROKSO / ROKMO)
Spam Services
IPs that host services that support spam or malware operations, including but not limited to:

Bulletproof hosting. DNS, web, mail or other services provided with either explicit or tacit actions not to disconnect customers who spam or engage in cybercrime.

Spamware. Sales or distribution of software whose main purpose is to aid in the sending of high volume unsolicited bulk email.

Scrapers. Sales or distribution of software whose main purpose is to automatically collect email addresses from web sites or whois records.

List providers. Providers of email lists without explicit, informed and prior consent.

Email appenders. Services that append email addresses to existing lists of names or companies.
Security Threats
Any IP address that is deemed to be a security risk to Spamhaus SBL users, including but not limited to:

Botnet controllers. IPs that host botnet command and control (C&C) servers.

Malware. IPs that host malware-infected websites or other resources that participate in any aspect of attempting to infect other computers, or extract data or personal information, without the knowledge or consent of their owners.

Phish sites. IPs that host fake login pages to bank and financial institution websites, customer email accounts, customer web hosting sites, VPNs, and other sites in an attempt to steal sensitive private information and/or login credentials.

Ransomware. IPs that host websites or other resources that participate in any aspect of holding user data for ransom by encrypting it and then demanding payment for the key to decrypt it ("Ransomware").

Hacking Attempts. IPs that are the source of attempts to crack passwords, scan for vulnerabilites, or other attempts to trespass on other computers without the knowledge or consent of their owners.

Escalation Listings

When a network ignores SBL listings for a significant period of time, claims to remove a spammer that repeatedly reappears, or exhibits other patterns of persistent spam or security issues, Spamhaus may list additional IP ranges of that network, or enlarge existing listings, if we believe that the network poses an ongoing risk to our users.

Notifications of Listings

Automatic notification is sent at the time an SBL is created to the owner of the respective top-level network, as assigned by Regional Internet Registries (RIR). We maintain our own contact list for those networks. Generally SBL notifications are sent to the Abuse Point of Contact (POC) from a network's RIR whois records. There are exceptions and we can accommodate a network's request for additional notification contacts.

SBL notification are a courtesy provided by Spamhaus to network operators and service providers. Spamhaus is not an abuse reporting service. If a network or service provider does not wish to receive SBL notifications we will accommodate that request. If we see that SBL notifications are ignored or not acted upon, we may choose to stop sending them at any time.

Delisting / Removal

SBL listings are removed after the network administrator emails the SBL Team explaining what was done to resolve that issue. We expect to hear from an authoritative administrator, and we may require to hear from the upstream network. We expect the problem to be fully terminated, and we may decline the removal request if we are not satisfied with the resolution or cannot confirm the results. In general, we are asking ISPs to remove abusers, educate customers to stop abuse, and/or fix security vulnerabilities.

See SBL Delisting Procedure for a detailed description. Once the network notifies the Spamhaus SBL Removals Team of a change or requests removal, Spamhaus will normally process the request within a day, and reply back. Removal information is located on the bottom of every SBL listing page.

Updating

Spamhaus does not routinely review SBL records to remove those that are no longer needed. It is the network operator's responsibility to notify Spamhaus of any changes that affect an SBL listing, and to request removal when the conditions that caused the SBL listing no longer apply. We welcome updates from the operators of networks with old and stale SBL records.

Search by SBL Record#

© 1998-2018 The Spamhaus Project Ltd. All rights reserved.
Legal  |  Privacy