Spamhaus is the trusted authority on IP and domain reputation. This data not only protects but also provides insight across networks and email worldwide.
London, England
Joined April 2016
- Tweets1.8K
- Following169
- Followers3.7K
- Likes749
🇫🇷 🍻 TONIGHT join Spamhaus, @seczones, @postmastery @omnivery and @SURBL for drinks! From 6pm at The Cafe Oz Denfert (7 mins walk from Marriot) #M3AAWG68
🇫🇷 Bon voyage if you're heading to #M3AAWG68 this weekend!
There's still time to RSVP for drinks here 👇hubs.ly/Q04C7NjK0
📢 For anyone running mail infrastructure, the @Spamhaus Project team has just launched their Sender Guidelines, with an added HELO/DNS checker to find and fix issues in your setup. 🙌
Getting the basics right goes such a long way towards avoiding listings and deliverability headaches - these guidelines are gold for senders! 🤩
📣 Say hello to the Spamhaus Sender Guidelines! One clear set of rules for anyone running a mail server, from your IT admin to the biggest ESPs...
And because DNS is kind of our thing, we've also built a HELO/DNS checker too!
We're really proud of this one, and we hope it makes life easier for senders everywhere. Now, go grab a cup of coffee, have a read and test your setup:
👉️ spamhaus.org/sender-guidelin…
🇫🇷 If you’re heading to #M3AAWG68 next week, come and tell us what you think!
#EmailDeliverability #EmailSecurity #DNS
+190% increase in new “sports” domains during the World Cup! Major sporting events = domain registration spikes 📈 - read the full report ⤵️ ⤵️
New domains containing “sports” ⬆️ 190% during the 2026 World Cup, peaking in June at around 67,500 domains. That’s from our latest Domain Reputation Update: April to September 2026:
👉️ spamhaus.org/resource-hub/do…
And there're more....
Spamhaus Technology retweeted
From TODAY, non-authenticated users can no longer export files from our platforms. If you haven’t already #Authenticate 👉 auth.abuse.ch/
Once authenticated, you will need to:
➡️ Use the new domain: {{platform}}-api.abuse.ch (where the platform can be urlhaus, threatfox or mb for MalwareBazaar)
➡️ Insert your unique Auth Key before the file name (obtained via auth.abuse.ch)
#SteadyPlatform #SteadySignal #SharingIsCaring
🌐 The @spamhaus Project Apr 2026 - Sept 2026 Domain Reputation Update is LIVE! Find insights from Spamhaus researchers into domain abuse and trends with newly observed domains.
Read the full report here ⤵️
hubs.ly/Q04BgSkH0
#DomainReputation #DomainInsights
Spamhaus Technology retweeted
Nyxar Stealer with potential Turkish roots 🇹🇷, sold as malware-as-a-service with of 60 modules, including:
🪝 Browser credential and cookies stealer
💬 Messaging app credential stealer (Discord, Telegram, etc)
👛 Crypto wallet stealer
🎮 Gaming app credential stealer (Steam, Epic, etc)
Probably of turkish origin:
🕑 Client quotas reset at 03:00 Instanbul time
🇹🇷 tr-TR formatting and error messages in bot admin panel
Botnet C2s:
📡nyxar .cc
📡nyxar .lol
📡nyxarstealer .lol
📡nyxarst .lol
📡polnet .lol
Malware samples:
bazaar.abuse.ch/browse/signa…
ALT NyxarStealer botnet admin panel
#Malware #Stealer #Teelegram #NixScareStealer
StalkCraft.exe:
virustotal.com/gui/file/e1b6…
app.any.run/tasks/75be7f3c-9…
GitHub: github.com/3xp0rt/NixscareSt…
Special thanks to @ViriBack.
xitter.cf/ViriBack/status/130223…
Still information in the comments 👇
Spamhaus Technology retweeted
Fake DocuSign emails luring recipients into downloading a fake Adobe Acrobat Reader update, leading to ConnectWise #ScreenConnct RMM 🖥️🖱️
email ➡️ Link ➡️ PDF ➡️ MSI
Payload delivery URLs:
📕 data.vaceditions .com/wp-content/new-statement.pdf
⚙️ acrob.my-adobe-plugins-update .top
Malware sample ⤵️
bazaar.abuse.ch/sample/9f34e…
Rogue ScreenConnect servers:
📡 owo.efunmilowoonline .top (NameSilo 🇺🇸)
📡 153.52.178.118:8041 (Hyonix🇺🇸)
ALT Fake DocuSign email
ALT Fake Adobe Acrobat Reader update
ALT Rogue ConnectWise ScreenConnect download
🇫🇷 Just two weeks to M3AAWG 68 in Paris! We’re closing out day one with drinks alongside @Postmastery, @Seczones, @omnivery and SURBL... and the drinks are on us. 🍻 🙌
Details: Mon, Oct 26 · 6–8pm · Café Oz Denfert
RSVP: ⤵️
hubs.ly/Q04zTcP80
If you're exporting files on @abuse_ch platforms, soon you'll need to be authenticated - details below👇👇
📢 Important update | Changes to file exports
From October 21st, file exports will require authentication. Non-authenticated users will no longer be able to export files. Authenticated users can continue exporting, with a small update to how export URLs are accessed.
ALT abuse.ch and Spamhaus logos above bold text on a dark teal background: "Access to file exports is changing from October 21st. Are you authenticated?"
🇫🇷 Join Spamhaus and our friends @Postmastery, @seczones, @omnivery and SURBL for drinks, nibbles and good times at #M3AAWG68 à Paris!
🗓️ Mon, October 26th
⏰ 6 - 8pm
📍 Cafe Oz Denfert
RSVP here if you'd like to come along:
forms.gle/6eSZnb2YAybTthUx6
We're looking forward to catching up with everyone (they say there's going to be merch!! 👀)
Spamhaus Technology retweeted
New entry: Christoffer Gamrath has gone straight in at #2 on our raw source leaderboard, with 2,923 submissions in 30 days. Thank you 🙏 , Christoffer, and to every contributor helping make the internet a safer place.
See this month's full leaderboards:
👉 submit.spamhaus.org/leaderbo…
ALT Second-place Threat Intel raw source leaderboard announcing a new entry with 2,961 raw source code submissions over the last 30 days, with the submitter’s name shown on the image.
📢 Friday October 16th 12pm (CEST) | @SpamhausTech's Carel Bitter will be presenting at #VB2026: "Inside Popa: a day in the life of a residential proxy"
View the abstract:
hubs.ly/Q04yy5Ln0
🇪🇸 If you're heading to Seville, come say hey! 👋
Earlier this year, we had the privilege of supporting Daud Ahmed and his fellow co-authors in their research into how domain and URL blocking decisions should be made. To help build their ground-truth dataset, we provided access to Spamhaus' Intelligence API:
👉 spamhaus.com/data-access/int…
1/3 ⬇️
Their tool, BlockMeNot, automatically recommends the right blocking granularity - apex, subdomain, or URL - to minimize both collateral damage and evasion. Presented at the 35th @USENIXSecurity Symposium, it found that only 37% of real-world blocklist entries were already listed at the optimal granularity.
Access the full research paper here ⤵️
usenix.org/conference/usenix…
2/3 ⬇️
🔎 Could access to Spamhaus data help your research project? Contact us to share more details: spamhaus.com/#contact-us
3/3
Spamhaus Technology retweeted
Did you know that if you run Cowrie high interaction SSH and Telnet honeypot 🍯🐝, you can automatically submit malicious URLs caught by it to URLhaus 💡? If you aren't running a Cowrie honeypot yet, you may want to check it out:
Project website:
🖥️ cowrie.org/
GitHub repository:
🖱️ github.com/cowrie/cowrie
Malicious URLs caught by Cowrie honeypots:
🌐 urlhaus.abuse.ch/browse/tag/…
ALT Cowrie SSH and Telnet honeypot
Are you using Spamhaus's Blocklists via DNS Query for email filtering? Here's a pro tip: start sharing your SMTP data with us (don’t worry there's no PII involved).
Why do this? Because sharing basic SMTP connection data helps uncover patterns of malicious activity. This means:
✅ Better protection for your email infrastructure
✅ Contribute to a global effort to fight email abuse
It’s a win-win! Read this blog to learn more 👇👇
hubs.ly/Q04xYkhB0
#EmailFiltering #SMTPData #EnhancedProtection
None of this happens without the people behind it. To everyone contributing to @abuse_ch platforms: thank you 🙏 🙏
A couple of months in and the Community Hub is thriving 🤩 ... 36,441 contributions across all abuse.ch platforms in the last 30 days (up +30.8%) 🔥🔥🔥
@geenensp 🥇 on URLhaus (78-month streak!!)
TheRavenFile 🥇 on ThreatFox
whack_sh 🥇 on MalwareBazaar
Go see the full Top10 leaderboards
👉 community.abuse.ch
#SharingisCaring #Leaderboards #Community 💛
Most malicious infrastructure gets blocked after the damage is already done.
Spamhaus Blocklists via DNS Query work differently: a real-time DNS lookup checks an IP or domain against Spamhaus data before your network accepts the connection.
Access a free 30-day trial - no card needed👇
spamhaus.com/data-access/rea…
#EmailSecurity #DNSBL #ThreatIntelligence