Who can use this?

• Email administrators
• Email engineers who manage their own email infrastructure 
• Free 30 day trial for data query service. See: https://www.spamhaustech.com/free-trial/free-trial-for-data-query-service/

What can Spamhaus data be integrated with?

• Any major mail transfer agent (MTA). If your MTA can consume Domain System Block Lists (DNSBLs) you can use Spamhaus block lists

Product outline

With a 99%+ block rate, this easy to configure service doesn’t rely on expensive hardware. Spamhaus block lists can be used with open-source tools like SpamAssassin, or integrated with your current anti-spam platform, keeping costs to a minimum.

The Spamhaus Data Query Service (DQS) comprises of a number of real-time IP block lists and domain block lists.

For website, form and portal protection our data-sets are also available via API.

Which Spamhaus block lists are available for use with the Data Query Service?

IP Block Lists

IP addresses observed to be involved in sending or hosting spam, including hijacked servers and computers infected with botnet malware.  Spamhaus ZEN combines the power of all our IP data sets into a single block lists.

Spamhaus Block List – SBL

IPs identified to Spamhaus’ best ability as likely:

• Direct spam sources,
• Spammer hosting/DNS
• Spam gangs
• Spam support services.

Filters out a significant majority of email threats before they have a chance to access your network. More time for you and your security team to focus on in-depth analysis and investigation.

Exploits Block List – XBL

IP addresses hosting:

• Bots
• Malware-infected computers.
• Automated tools observe SMTP connections for spamtrap and production mail servers.

Cyber criminals exploit and hijack legitimate networks so with XBL you can block email traffic from what might first appear to be a trusted source.

Policy Block List – PBL

IP address ranges for end-user devices from which email should never be sent:

• IoT devices
• Home routers
• Smart TVs

The PBL lists IPs not because they are actively sending spam, but as a pre-emptive measure to prevent spam from networks that should send no email at all.

Content Block Lists

Constantly updated block lists that focus on low reputation/malicious domains and cryptographic hashes.

Domain Block List – DBL

• Domains owned by spammers and used for spam or other malicious purposes.
• Domains owned by non-spammers, used for legitimate purposes, but hacked by spammers.

Includes basic spam, phishing, malware, botnet C&C and redirector domains.

Zero Reputation Domain – ZRD

Cyber criminals use newly registered and active domains to send spam and drive traffic to harmful websites hoping to claim victims before a domain has been analyzed.

ZRD automatically adds newly-registered and previously dormant domains to a block list for 24 hours.

Legitimate organizations will rarely activate a domain and start using it immediately after registration. ZRD prevents clicking on links and visiting domains until it is established that they are not associated with malicious activities.

Hash Block List – HBL

This blocklist contains the following content areas: Cryptowallet (Bitcoin etc.), Malware and Email addresses.

Hash Blocklists (HBL) are lists of cryptographic hashes associated with malicious content, as opposed to IP addresses or domains. They are extremely useful for filtering fraudulent emails coming from ISPs, domains, or IP addresses that Spamhaus is unable to list e.g. Gmail. Additionally, they can  block emails containing malware files.

Who can use this?

• Network engineers
• Security operation centre (SOC) teams who are running their own DNS infrastructures

What can Spamhaus data be integrated with?

Spamhaus DNS Firewall Threat Feeds can be used with a variety of major DNS software, in addition to DNS hardware:

DNS software

• Bind
• PowerDNS
• Unbound*
• Knot**

DNS appliances (DDIs)

• Infoblox
• Efficient IP
• Bluecat

* Requires feedback to Farsight for their proprietary plug-in “Fast Response Policy Zones” (RPZ)

** Partially supports DNS Firewall Feeds, however, does not support NSDname.

Firewalls

• Vendor support varies, please contact us for further information.

Which Spamhaus block lists are available for use with DNS Firewall

You can choose which threat feeds you use, based on the amount of risk your business needs to be exposed to.

Who can use this?

• Network engineers
• Security operation centre (SOC) teams who manage their own network edge routers

What can Spamhaus data be integrated with?

Product outline

Which Spamhaus datasets are available for use with Border Gateway Protocol?

Who can use this?

• Security professionals,
• Brand Protection Specialists,
• Malware Researchers
• Penetration Testers

How can Spamhaus Passive DNS data be accessed?

• Web browser
• API
• Real-time continuous data-feed
• Splunk integration being released in second half of 2020

Product outline