The Spamhaus Project
IP and Domain Reputation Checker
header-curveheader-curve

Blocklist Glossary

This glossary covers community blocklists available via The Spamhaus Project.

Here you will see a blocklist name such as the Spamhaus Blocklist (SBL) or Exploits Blocklist (XBL), along with a description, and what it does. Some blocklists can also be queried using free data access methods provided by Spamhaus Technology, such as Blocklists via DNS Query or DNS Response Policy Zones.

For definitions of additional common terms used on this website, visit the Spamhaus glossary.

Combined Spam Sources (CSS)

Email Spam IPs

Dedicated to SMTP traffic, only listing port-25 based detections. Potential triggers for a listing include unsolicited emails, having poor email marketing list hygiene, or sending out malicious emails due to compromised accounts or content management systems (CMS). Both IPv4 (/32) and IPv6 (/64) addresses are listed in the CSS.

Domain Blocklist (DBL)

Low Reputation Domains

Covers any domain indicating signs of spam or malicious activity. It includes domains owned by bad actors, or hijacked domains otherwise used for legitimate purposes. This also covers domains hosted in a network that has a poor reputation.

Don't Route Or Peer (DROP) (DROP & DROP-ASN)

Highly Malicious Networks & ASNs

Don't Route Or Peer (DROP) lists the worst of the worst IP traffic. It is an advisory “drop all traffic”, containing IP ranges which are so dangerous to internet users that Spamhaus provides access to anyone who wants to add this layer of protection, free of charge.

Exploits Blocklist (XBL)

Compromised IPs

Contains individual IPv4 and IPv6 addresses exhibiting signs of compromise i.e. IPs that are legitimate but have been hijacked to use by third-party exploits. This includes devices turned into residential proxy nodes (e.g. via "free VPN" apps) without the owner's knowledge.

Policy Blocklist (PBL)

Non-mail Emitting IPs

A dataset containing end-user IP address ranges from which email should never be sent directly to the final destination. This is predominantly IPv4-based, though does include IPv6 ranges - with most listings in Classless Inter Domain Routing (CIDR) format.

Spamhaus Blocklist (SBL)

Malicious Network Ranges

Contains IP addresses that have been identified as malicious. These IPs are being observed in adversarial activity, e.g. sending spam, snowshoe spamming, hosting malicious content, behaving like a bulletproof hosting company or hijacking IP space. Both individual IPs and IP ranges are provided in this dataset.