← Feed

Posts

• Post #4500418

  ❗Here's the most recent additions to Spamhaus DROP (Do Not Route or Peer) list - including hijacked IPs, suspected snowshoe spam and cybercrime hosting ⤵️ 1/3

• Post #4240809

  Spamhaus keeps observing internet abuse involving dangling CNAME DNS records, a threat we first highlighted in 2024: 👉️ https://www.spamhaus.org/resource-hub/dns/dangling-dns-and-the-dangers-of-subdomain-hijacking/ A long-standing threat actor is currently disseminating snowshoe spam from about 2.5k IPv4 addresses, leveraging dangling CNAMEs. While our CSS & DBL datasets cover this campaign, our ticket team encounters a steady stream of domain owners (whose dangling CNAMEs are actively abuse...

• Post #4198752

  🛡️ENDGAME SOCGHOLISH REMEDIATION | It's been just over five weeks since @Europol announced the disruption effort against SocGholish. Nearly 15,000 compromised WordPress sites were identified. If your company has received a notification from Spamhaus, some of your customers are very likely affected. ⚠️ These credentials are already circulating, and unremediated sites remain an open door for ransomware, fraud, and further compromise. 1/3

• Post #4060613

  ❗We're tracking a spam campaign that abuses cross-site scripting (XSS) flaws in website search forms to funnel victims to phishing and scam pages. Here's what we've confirmed so far: ➡️ Spam emails, mainly from compromised accounts, many on Microsoft 365 (*.onmicrosoft.com), linking to legitimate sites whose search forms are vulnerable to XSS. ➡️ The links carry a hidden payload using a classic technique: an tag pointing to a non-existent file, with the onerror handler carrying the a...

• Post #4014154

  Sliver has dethroned Cobalt Strike as the #1 malware family associated with botnet C&Cs between Jan-Jun 2026. Sliver climbed +58% to 3,008 detections, while Cobalt Strike collapsed -68% to 1,110 - this is the biggest single-period fall we've ever recorded for this malware. Grab the full report here ⤵️ https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-january-to-june-2026/ #Malware #BotnetCC #ThreatIntel #infosec #cyberSecurity

• Post #3810681

  Bulletproof hosting doesn't run on its own. It depends on facilitators: IP address brokers, carriers, data centers. Remove the facilitators, and the operation stops working. In this blog, Threat Investigator Jonas Arnold looks at how we hold those facilitators accountable, and why an approach that's slow and methodical still beats one that's fast and shallow. A few things the data shows: ⤵️

• Post #3649400

  If you manage routing, firewall policy, or upstream filtering, here are the latest Spamhaus DROP (Do Not Route or Peer) listings ⤵️⤵️

• Post #1686047

  💪 Contributor "mugufinder" has shared 2,731 domains over the past 30 days 🔥 That’s a +1,969% increase, landing them in the Top10 on the domain leaderboard! Incredible work! Your ongoing support and submissions are what keep the threat intelligence flowing, thank you. ❤️🙏 Got malicious or suspicious IPs, domains, URLs, or raw source to share? 👉 Join the fight against cybercrime: https://submit.spamhaus.org/submit/ #CyberSecurity #ThreatIntelligence #ThreatHunting #Infose...

• Post #1686046

  We've recently observed some unusual large-scale routes appearing on the internet (see image), involving the following networks: AS393232: Comcast Cable Communications 🇺🇸 AS36429: Charter Communications 🇺🇸 AS41128: Orange 🇫🇷 AS13335: Cloudflare 🇺🇸 AS17072: Total Play Telecommunications 🇲🇽 AS270118: Soluciones, Analíticos Y Servicios Team (Stratosphere Technology Latam) 🇲🇽 AS199524: Gcore Labs 🇱🇺 The label "path (fixed)" indicates that identical paths were observed by sever...

• Post #909311

  Big shout out to the latest Threat Intel Community Top10 new entries!! 📣 🤩 📩 Alastyr (#5) 📩 Contributor: EB63 (#10) 🌐 PhishDestroy (#5) - now a trusted submitter! 🤩 🌐 NetPhishing (#7) Thank you to all contributors - new and old - for your support & threat intelligence submissions 🙏 Contributor EB63, don't forget to claim your name - it only takes a few minutes. Login here to review your 'Display Name' : 👉 https://auth.spamhaus.org #CommunityLeaderboard #Th...

• Post #909310

  Whether you’re part of a security team, an independent researcher, or simply someone who spotted something unusual online 🕵️ 🔎 — sharing what you've seen can make a difference. If you’re already sharing suspicious IPs, domains, or URLs with Spamhaus — thank you! 🙏 🙏 But quality matters just as much as quantity. Providing context, timestamps, supporting evidence, and clear descriptions of the activity helps us verify reports and take action more effectively. ⤵️ ⤵️

• Post #909309

  📣 In case you missed it: last week the FBI released a Public Service Announcement on residential proxy networks. The notice explains, at a high level: - What residential proxy networks are - How they work - How your device can become part of a residential proxy network - How criminals are exploiting them - Best practices to help protect yourself Read the announcement here 👉 https://www.ic3.gov/PSA/2026/PSA260312 It’s encouraging to see residential proxies - an often overlooked security threat...

• Post #909308

  TAKE ACTION | If you’re using the free #DNSBLs and querying via Oracle ’s network, you need to change your config, or from April 8th, you may face issues with your email stream. Read why and the steps you need to take to stay protected for free in this blog: https://www.spamhaus.org/resource-hub/email-security/querying-the-free-dnsbls-via-oracle #FreeProtection #FreeData #Oracle

• Post #909307

  LESS THAN 2 WEEKS until access will start to be restricted to those querying our blocklists via Oracle’s network. Stay protected for free with Spamhaus Technology's Data Query Service - changes to config take minutes. Read more & sign up: 👇 https://www.spamhaus.org/resource-hub/email-security/querying-the-free-dnsbls-via-oracle #StayProtected #Oracle #DQS

• Post #909306

  With ongoing discussion around a potential sixth Regional Internet Registry (RIR) for outer space allocations, as outlined in: https://datatracker.ietf.org/doc/draft-li-tiptop-address-space/ …it has become clear that governance of interplanetary IP allocations is no longer hypothetical. 🛰️ Recent incidents involving interference with critical satellite infrastructure demonstrate that space-based threats are no longer theoretical: https://news.satnews.com/2026/02/04/russia-intercepts-europes-key-...

• Post #909305

  RE: https://infosec.exchange/@spamhaus/116328395667742203 Ok, you got us...April Fools 😜! Can you find and solve the riddle? Remember that DNSBLs provide A records as the main answer, and TXT are just there for (the lulz) support!

• Post #909304

  No April Fools today 😄 this one is real. We've been busy DROP'ing the worst of the worst IP netblocks. Here are the latest additions to the Spamhaus DROP (Do Not Route or Peer) list ⤵️⤵️

• Post #732332

  An individual, Zhenyun Sun (https://find-and-update.company-information.service.gov.uk/officers/svz68usL11Hfb5q2_65DDqlFd2Y/appointments), is registering UK "fibre ISPs" at Companies House at an unusual rate. On the surface, they could pass for legitimate broadband providers. But look closer, and the picture soon changes 🕵️ ... Some of these companies are assigned an ASN, sharing the same abuse contact: onesproxy[.]com. ⤵️

• Post #699738

  It doesn't happen every day that you see a /13 IPv4 network end up on Spamhaus Blocklist (SBL). Such large prefixes are commonly listed in conjunction with IP hijacking activity - and yes, you guessed it, the last /13 entering SBL (and DROP) is a hijacked unallocated prefix, according to our investigations🕵️ 102.224.0.0/13, "reserved [by AFRINIC] for future as per section 5.4.7.1 of [AFRINIC's] consolidated policy manual Version 1.1", according to its AFRINIC da...