Submit suspicious activity

If you would like to make multiple submissions, then please use the API, which can be found here once you’ve authenticated.

For any questions or feedback relating to the Threat Intel Community Portal, please complete this contact form.

To register for a Threat Intel Community account, you will need to use one of the following applications for authentication:

• LinkedIn
• Google
• Github

Github is a favorite in the tech community, as you can use your personal email address when registering. Signing up to Github is quick and free: https://github.com/signup.

Even if you don’t plan on using GitHub for anything else, it’s a convenient way to authenticate into the Spamhaus Community Portal.

In addition to our website terms and conditions, the following apply to those making submissions.

Do send us

Domains/FQDNs/URLs/email source data

Submissions need to be:

• Based on personal observations of your own network or resources
• Observed from open sources.
• Data that’s justified, necessary, and proportionate for the purpose (See Data Minimization)
• Made in good faith to make the internet safer in accordance with our Mission Statement (see below)

Any domain, URL, IP etc submitted is not automatically listed in Spamhaus data sets.

Submissions are run through our own heuristics to see if they meet the criteria for listing. This is necessary as we have to stand by our data and make valid remediation for any listing.

By making a submission you confirm that you have the authorization to possess and share that data.

We never reveal the sources of our data in our data sets.

Do not send us

• Data that has been obtained or exfiltrated illegally
• Data containing proprietary information you wish to keep confidential
• Information received from other people which cannot be substantiated or speculation about actors’ activities
• Information that you are not authorized to disclose
• Illegal content – Do not make any submission which might relate to child abuse or sexual exploitation of any sort. Contact law enforcement in your own country to handle the issue.

Sensitive Personal Information – If you are concerned that your submission contains Sensitive Personal Information (SPI) then don’t send it. (See Definitions below)

If we detect that submissions don’t meet Community Standards then we reserve the right to deny access to the platform.

Use of the Community Portal is for contributors acting in good faith to make the internet safer.

If Spamhaus detects malicious or abusive use of the portal in any way, we reserve the right to revoke a contributor’s access to the API and block any other submissions immediately.

Submissions that we believe have been made in bad faith to discredit individuals, organizations or disrupt lawful activities will be blocked and access to the platform will be denied.

Sending data to Spamhaus confers no right to use the Spamhaus name by the submitter as a partner of Spamhaus, authorized by Spamhaus or any other association, unless agreed prior in writing.

There is no monetary reward or equivalent for any submission

Definitions

Mission Statement

The mission of this community portal is to provide a platform for the sharing of threat information for the security and stability of the Internet, based on observation and publicly available information.

OSINT

Open-Source Intelligence (OSINT) is information sourced from ether observed or available to all members of the public, that has been collected, verified, and evaluated for a specific requirement. Such sources include information available to the general public, including by purchase, without requiring special legal status.

Sensitive Personal Information

• Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs
• Trade-union membership
• Genetic data, biometric data processed solely to identify a human being
• Health-related data
• Data concerning a person’s sex life or sexual orientation
• Criminal record information that does not have to be legally disclosed such as ‘spent’ convictions.

Data Minimization

Information should only be collected and processed if it is;

1. Justified for an articulable purpose
2. Necessary for achieving that purpose
3. Proportional to the ability to achieve that purpose

To create an account, click ‘Log in’ at the top right of the homepage or scroll down and select ‘Create an Account’.

To register, sign in using one of the following for authentication:

• LinkedIn
• Github
• Google

Click the ‘confirm email’ button in the verification email to complete your registration.

Yes - whether you’re making a one off submission or submitting at scale via the API, you will need to authenticate and create an account. This helps protect the platform, minimize abuse, and ensure the quality and reliability of submitted data.

You can create an account here.

There are a couple of reasons we include an email in addition to the three methods of authentication:

• So you can easily change the email address associated with your (Spamhaus) account. But please note that you’ll need to verify the updated email address before making submissions.

• Not all of the authentication platforms provide us with confirmation that your email address is verified. Where this is the case, we require you to verify your email address in addition to the authentication method.

Yes, you can. We have included the ability to update/change your email address via the account page. Please note that you will be required to verify a new email address.

There are two potential reasons for this issue:

Incorrect Domain Syntax: The domain name may contain invalid characters such as ‘space', #, or +. Please double-check the domain name for errors and try submitting it again.

Unresolvable Domain: Even if the domain format is correct, it might not be resolving to a valid IPv4 or IPv6 address.

To delete your account log in at the top right of the homepage, and click "Account."

Click the red "Delete Account" button at the bottom right of the page.

We understand it's frustrating when unrelated entities purchase lookalike domains i.e. domain squatting. However, it's important to note that Spamhaus can only assign reputations to already existing domains. We cannot analyze or list domains that have not yet been created.

Spamhaus receives data from Brand Protection companies that monitor and report domain abuse. These companies submit specific URLs or domains along with supporting evidence, such as screenshots obtained through urlscan.io.

ICANN offers valuable advice on domain squatting, which you can find here: https://icannwiki.org/Typosquatting.

It is recommended to identify common typographical errors in your domain name and purchase the variations to protect yourself from typosquatting.

For further guidance on making submissions, please refer to our FAQ on how to submit data to the Threat Intel Community Portal.

Yes. Spamhaus strongly recommends warming up any new or recently inactive IP address or domain before using it to send email.

All sending IP should have a HELO hostname that resolves correctly in forward DNS. The HELO domain name should resolve to the same IP address from which the mail is sent and must be owned (or under administrative control) by the organization operating the sending infrastructure.

Failing to warm up properly can lead to a sudden spike in email volume, which may result in the IP or domain being listed.

What is IP/Domain warm up?

IP/Domain warm-up is the process of gradually increasing the volume of mail sent from a new or previously inactive IP or domain.

How do I warmup my IP?

The warmup process depends largely on the reputation of the HELO domain.

Spamhaus recommends the following guidelines:

• Do not send more than 1,000 emails/day during the initial few days of using a new or dormant IP.
• Avoid doubling the daily email volume for the first week.
• Send only to users who have provided consent and focus on segments with recent engagement.

The approach helps build a healthy reputation.

Does lack of warmup affect reputation?

Yes. New or inactive IPs start with a neutral reputation. If they begin sending large volumes of email from unknown IP, filters are likely to treat that activity as suspicious.

Hitting spam traps or inactive users from a new IP and domain will quickly harm your reputation and may lead to listings.

When is an IP considered new?

A domain with no previous sending history is considered a new domain. An IP is considered inactive if it has had no email sending history for over 90 days. Additionally, any IP that has recently changed its HELO value without any sending history needs to warm up their email volume for the first few days of sending.

Can I use commercial IP/domain warm-up services?

Spamhaus strongly discourages the use of commercial IP and domain warm up services. These services are intended to bypass spam filters by artificially inflating engagement metrics and manipulating reputation systems.