How I’m fighting cybercrime with Spamhaus (and how you can too!)

For years, I've been passionate about combating online abuse and making the internet a safer place. In early 2024, the drive “to do more” led me to the Spamhaus Threat Intel Community - a portal for sharing suspicious or malicious internet identifiers. Through this initiative and collaborative intelligence sharing, I have amplified the impact of my threat hunting activity on internet security.

Through this blog, I hope to inspire others to join the community, and raise awareness of what we can all do to shine a light on malicious internet activity and protect others.

Joining Spamhaus in the fight against cyber threats

For over 25 years, Spamhaus has been at the forefront of tracking and mitigating cyber threats, including spam operations, botnets, malware and phishing campaigns. Since joining the Spamhaus Threat Intel Community initiative, my focus has been on identifying and reporting malicious domains, URLs, and spam/phishing emails.

But perhaps the most inspiring aspect of this project is the ability to directly contribute to making the internet a safer place. By participating, I have an active role in disrupting cybercriminal operations, providing the intel necessary to block IP ranges, domains, and spam for users worldwide. I’m making a difference.

Getting started with the portal…

…is easy. You can make one-off submissions as a guest, or create an account to access an API for multiple submissions. This means if you’re an experienced threat analyst (like me) you can use the API for regular reports. For a casual user submitting occasional findings it’s a simple webform.

This flexibility ensures that ANYONE regardless of technical expertise, can participate meaningfully in the fight against cyber threats. Even your Oma (that’s German for grandma)!

What data can you share?

Currently, you can share domains, IPs, URLs or raw email source via the Spamhaus Threat Intel Community.

Sharing evidence is key

Submitting accurate and well-documented reports is critical to ensuring high-quality threat intelligence. When submitting suspicious activity or threats, if you have any evidence to support your submission, Spamhaus wants to see it.

Providing concrete evidence - such as domain impersonation details, phishing email headers, and other reasons why the submission is malicious - helps Spamhaus verify threats and prevent false positives. Adding a simple link to your evidence in the "Reason" field can help to signficantly speed up the process of confirming malicious or suspicious activity.

What about sharing malware?

To report malware, I recommend abuse.ch, a community-driven threat intelligence platform focused specifically on malware and botnets, which is also partnered with Spamhaus. With a community of more than 15,000 researchers, the intelligence from these platforms is used by security researchers, network operators and law enforcement agencies around the world.

It’s feels good to be recognized

Hunting for cybercriminals can often feel like thankless work. It might sound trivial but being recognized for the effort you put in means a lot. On the Spamhaus Threat Intel Community there are leaderboards to see your contributions alongside other community members. This not only recognizes the dedication of contributors but helps foster engagement among the community. And a bit of healthy competition never hurt anyone!

At the time of writing this blog, I’m ranking #2 on the raw email source leaderboard, but, kudos to EGP Abuse Dept. at #1! That said, the leaderboards do change regularly! Nevertheless, I’m proud to appear regularly as a top ‘raw email source’ contributor.

For those concerned about remaining anonymous, your leaderboard name is a pseudonym by default - you can also update your leaderboard name in the account settings.

Together we are stronger

If, like me, you're passionate about cybersecurity and want to make a tangible difference, I encourage you to join the Spamhaus Threat Intel Community. For more information or to make your first contribution, visit the Spamhaus Threat Intel Community Project.

Together, we can combine our knowledge and resources to combat cyber threats and build a safer internet for everyone.