What Spamhaus Project does

Spamhaus Project is a non-profit threat intelligence organization founded in 1998 by Steve Linford in London and now headquartered in Andorra. It produces IP and domain reputation data through DNS-based blocklists (DNSBLs) covering spam sources, exploits, botnet controllers, policy violations, and malicious domains, including the SBL, XBL, CSS, PBL, DBL, ZEN, BCL, and DROP datasets. The technical foundation is real-time DNS zone publication, complemented by multi-source intelligence combining SIGINT, OSINT, machine learning, heuristics, and human investigation; the platform analyzes 7.5 million IPs and 3 million domains per day, tracks 280 million domains, and protects an estimated 4.5 billion user mailboxes globally.

The organization serves a horizontally distributed customer base that includes email administrators, ISPs, network security teams, CERTs/CSIRTs, ESPs, domain registries and registrars, and enterprise security operations. Customer-facing access paths include free DNS blocklist mirrors, a free Data Query Service, a free Intelligence API developer tier, and dedicated CERT and ISP portals. Commercial, high-volume, real-time access is delivered through Spamhaus Technology, the commercial partner that sells subscription licenses for DNSBLs, DNS Firewalls, and Intelligence APIs. Spamhaus monetizes through a freemium community-led and product-led motion supplemented by enterprise subscriptions routed through Spamhaus Technology.

Spamhaus Project also maintains strategic relationships with law enforcement (supporting Europol's Emotet takedown in 2021, the FBI's Qakbot operation in 2023, and Europol's Operation Endgame in 2024) and a global community of voluntary threat data contributors. It holds awards from the Internet Service Providers Association (2003), the FBI-affiliated NCFTA (2008), and Virus Bulletin. The organization's stated mission is to strengthen trust and safety across the internet, and it operates independently with no parent company or disclosed venture backing.

Name

Spamhaus Project

Legal name

Spamhaus Project

Website

https://spamhaus.org

Company type

Private

Founded year

1998

Operating status

Operating

Headcount range

11–50 employees

Short description

Spamhaus Project is a non-profit founded in 1998 that publishes real-time DNS-based IP and domain reputation blocklists, protecting 4.5 billion mailboxes and serving email administrators, ISPs, CERTs/CSIRTs, ESPs, and enterprises worldwide, with commercial data delivery through its partner Spamhaus Technology.

Ownership category

akta.pro rank

Product category

Threat Intelligence / Email Reputation Data

akta.pro primary industry

Spam, Fake Engagement & Content Abuse Prevention (HDADALAG)

akta.pro secondary industries

DNS Security & Protective DNS (HDADABAF), Email Phishing & BEC Protection (HDADAKAB), DDoS Protection & Mitigation (HDADABAG)

Keywords

• Threat intelligence feeds
• DNS blocklists
• Email reputation data
• Botnet controller tracking
• Cybersecurity data feeds

Headquarters

HQ city

Geneva

HQ country

Switzerland

HQ region

Europe

Offices2 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Infrastructure, Operations

Revenue model

1. Free DNS Blocklists and Community Data: Spamhaus Project operates as a non-profit organization providing free DNS blocklists, threat intelligence data, and tools to the global internet community. Legacy DNS blocklists and DROP lists are offered at no cost, funded by donations and the organization's non-profit structure.
2. Commercial Data Services via Spamhaus Technology: Real-time data delivery at volume for commercial customers is handled through Spamhaus Technology, the commercial partner of Spamhaus Project. Organizations requiring high-volume, real-time access to reputation data purchase commercial subscriptions for DNSBLs, DNS Firewalls, and Intelligence APIs.

Pricing tiers

Go-to-market motion3 records

Distribution channels7 records

Marketing channels9 records

Core offering

Spamhaus Project aggregates and disseminates real-time IP and domain reputation intelligence used to block spam, phishing, malware, and botnet-driven abuse at internet scale. Its core deliverables are curated DNS-based blocklists (DNSBLs) covering compromised hosts, snowshoe senders, policy-listed ranges, spam domains, and botnet controllers, alongside an Intelligence API and DNS Firewall (RPZ) services distributed commercially through its partner Spamhaus Technology. The data feeds protect a substantial share of the world's mailboxes and are referenced by most major email and network security products.

Product overview

Spamhaus Project operates a comprehensive threat intelligence platform providing IP and domain reputation data through multiple delivery mechanisms. The core offering consists of DNS-based blocklists (DNSBLs) including the Spamhaus Blocklist (SBL), Domain Blocklist (DBL), eXploits Blocklist (XBL), Policy Blocklist (PBL), Combined Spam Sources (CSS), and ZEN Blocklist (aggregated view). For network-level protection, they offer the Botnet Controller List (BCL), DROP list, and BGP Feed. Commercial and free tiers provide Real-time DNS Blocklists, DNS Response Policy Zones (DNS Firewall), and Intelligence APIs. Supporting tools include the Blocklist Tester, Reputation Checker, CERT Insight Portal, ISP Portal, and Threat Intel Community Portal. Founded in 1998, the non-profit organization analyzes 280 million domains, 7.5 billion SMTP connections, and protects 4.5 billion mailboxes daily.

Differentiator

Problem solved

Functional benefit

Products and services

• Spamhaus Block List (SBL) Curated list of IP addresses observed as sources of spam, used by mail administrators at the MTA to reject incoming abusive mail. Distributed as a DNSBL and intended for internet-facing mail systems.
• Exploits Block List (XBL) Blocklist of IP addresses of hosts compromised by exploits (open proxies, open relays, hijacked machines) used by mail administrators to drop mail from compromised senders.
• CSS (Composite Snowshoe Block List) Blocklist targeting snowshoe-style low-reputation spam operations spread across many IPs and domains, distributed via DNSBL.
• Policy Block List (PBL) Policy-based blocklist of end-user IP address ranges that should not be issuing unauthenticated direct-to-MX email, used to enforce outbound mail policy.
• Domain Block List (DBL) Reputation database of domain names observed in spam, phishing, and malware activity, distributed as a DNSBL and used by mail and security products to block lookups against malicious domains.
• ZEN (Combined Spamhaus Block List) Aggregated DNSBL that combines the SBL, XBL, CSS and PBL into a single lookup, simplifying deployment for mail administrators and security products.
• Botnet Controller List (BCL) Blocklist of IP addresses and infrastructure identified as active botnet command-and-control servers, used by network defenders to block communications with infected hosts.
• Do Not Route or Peer (DROP) List of netblocks allocated to known hijacked or unallocated address space that should not be routed or peered to legitimate networks, distributed for BGP routing context.
• BGP Context Data Routing and BGP context that augments blocklist entries so network operators understand the allocations and network owners behind listed ranges.
• Real-time Data Query Service (commercial) Commercial, SLA-backed real-time DNS query access to Spamhaus's reputation data feeds for enterprises with high query volumes and reliability requirements.
• Free Data Query Service Free, community-tier real-time DNS query access to Spamhaus's reputation data feeds for low-volume users and individual administrators.
• DNS Firewall (commercial) Commercial DNS Response Policy Zones (RPZ) feed delivered for recursive resolvers and DNS-layer security products to block lookups of malicious domains in real time.
• Free DNS Firewall Free-tier DNS Response Policy Zones (RPZ) feed of malicious domain reputation data, intended for low-volume community users of recursive resolvers.
• Intelligence API Commercial REST API providing programmatic, on-demand IP and domain reputation queries with rich metadata, designed for integration into security products and automated workflows.
• Free Intelligence API / Developer License Free, lower-volume developer tier of the Intelligence API intended for non-commercial or low-traffic use cases, allowing developers to integrate Spamhaus reputation lookups into their tooling.
• CERT Insight Portal Web portal giving CERT and CSIRT analysts structured access to Spamhaus threat intelligence and botnet tracking data to support abuse triage and takedown operations.
• ISP Portal Web portal tailored for ISP and network operator abuse teams, providing visibility on Spamhaus listings affecting their networks and tools for managing removals.

Quantifiable outcome

• 4.5 billion protected user mailboxes globally
• +4 more outcomes

Named customers1 record

Segments5 records

Ideal customer profiles6 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Feature7 records

Partnerships

Eleven partnerships are on record, tiered core, major, supporting and strategic.

• Spamhaus TechnologycoreTechnology or IntegrationSpamhaus Technology is the commercial data delivery partner handling real-time, volume-based access to Spamhaus reputation data. As the research organization grew and demand increased for commercial-grade real-time delivery, Spamhaus Technology was established to serve enterprise customers requiring high-throughput data access via DNSBLs, DNS Firewalls, and Intelligence APIs.
• Independent Threat HuntersmajorStrategic or Co-development PartnerGlobal community of independent security researchers who voluntarily share threat intelligence data with Spamhaus. These researchers contribute IP and domain reputation signals detected through their own monitoring activities.
• Hosting ProvidersmajorStrategic or Co-development PartnerHosting companies share network traffic data and abuse signals with Spamhaus, providing visibility into malicious activity hosted on their infrastructure.
• Email Service ProvidersmajorStrategic or Co-development PartnerMajor ESPs contribute email traffic data and spam signals to Spamhaus, helping improve blocklist accuracy and email threat detection.
• Law EnforcementmajorStrategic or Co-development PartnerLaw enforcement agencies share intelligence and coordinate operations with Spamhaus. Spamhaus has supported major takedowns including Europol operations (Emotet 2021, Operation Endgame 2024) and FBI operations (Qakbot 2023).
• Enterprise BusinessesmajorStrategic or Co-development PartnerEnterprise organizations contribute business data and threat intelligence to Spamhaus, helping expand visibility into cyber threats affecting commercial infrastructure.
• Spamtraps (In-house)coreStrategic or Co-development PartnerSpamhaus operates its own spamtrap networks - email addresses that have never opted into any mailing list. These traps detect spammers and malicious senders, forming a core component of the threat detection infrastructure.
• DDoS Mitigation ProvidersupportingTechnology or IntegrationSpamhaus survived the 2013 'DDoS that almost broke the Internet' attack (300Gbps) by collaborating with their DDoS mitigation service provider for robust defenses.
• Team CymrustrategicStrategic or Co-development PartnerTeam Cymru enables security teams to track and disrupt advanced bad actors and malevolent infrastructures worldwide. Listed as an affiliate with aligned mission to make the internet safer.
• Word to the WisesupportingStrategic or Co-development PartnerIndustry consultancy that teaches companies to create best email programmes, build reputation, and reach audiences. Listed as an affiliate with aligned mission.
• Amazon SESstrategicTechnology or IntegrationAmazon Simple Email Service works with Spamhaus to protect its network and reputation. SES proactively manages millions of IPs and domains using Spamhaus blocklists to ensure deliverability for its customers.

Scale indicators12 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• AbuseIPDB: Community-driven IP reputation database that catalogues reported malicious IPs. Closely comparable to Spamhaus's IP reputation data products with similar crowdsourced threat-intelligence model and developer/API access.
• Team Cymru: Provides IP reputation, botnet tracking, and threat intelligence feeds to security teams and CSIRTs. Closely comparable to Spamhaus in mission, data products, and customer segments, and is itself listed as a Spamhaus affiliate.
• DomainTools: Specializes in domain reputation, WHOIS, and DNS intelligence used for threat investigation and brand protection. Closely comparable to Spamhaus's DBL and IP/domain reputation data products.
• SURBL: Maintains URI/domain-based reputation data used for email spam and phishing detection. Directly comparable to Spamhaus's Domain Blocklist (DBL) in data category and delivery method (DNSBL).
• PhishTank: Community-based phishing URL verification and reputation database. Comparable to Spamhaus's domain reputation data, with overlapping customer base among email filtering and brand protection teams.

Broad incumbents

• Akamai (Prolexic): Provides carrier-grade DDoS protection and edge security, overlapping with Spamhaus's botnet C&C and DROP lists. Functions as a broad incumbent in the same threat-protection category.
• Proofpoint: Major email security vendor that consumes reputation data and competes in adjacent threat-intelligence products. Comparable to Spamhaus on email security use cases but as a broad incumbent with a much larger commercial platform.
• Recorded Future: Commercial threat intelligence platform ingesting IP and domain reputation signals. Comparable to Spamhaus in data category but as a much larger commercial incumbent with broader intelligence categories.
• Cloudflare: Provides DNS security, bot management, and DDoS protection at massive scale. Overlaps with Spamhaus on DNS firewalling and IP reputation but as part of a much broader network and security platform serving enterprises globally.
• Cisco Talos Intelligence: One of the largest commercial threat intelligence teams globally, publishing IP and domain reputation data and integrating it into Cisco's security portfolio. Overlaps directly with Spamhaus on IP/domain reputation, but with a much broader product portfolio.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat6 records

Key risks6 records

Key highlights6 records

Customer concentration

• Xx.com/spamhaus
• LinkedInlinkedin.com/company/the-spamhaus-project

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Spamhaus Project