📢 If you looked at the @abuse_ch API from Spamhaus when it first launched, it’s worth another look…
Here’s what we’ve added:
➡️ Elastic integration: now on the Elastic marketplace!
➡️ File exports: the same data in bulk, in ready-to-use formats
➡️ API-key authentication: now Revocation list: removes withdrawn indicators from your SIEM and caches
NEXT UP: more integrations, plus a unified API that covers all @abuse_ch datasets - learn more here👇
hubs.ly/Q04CdmWZ0
#ThreatIntelligence #ThreatHunting #CyberSecurity
Here’s what we’ve added:
➡️ Elastic integration: now on the Elastic marketplace!
➡️ File exports: the same data in bulk, in ready-to-use formats
➡️ API-key authentication: now Revocation list: removes withdrawn indicators from your SIEM and caches
NEXT UP: more integrations, plus a unified API that covers all @abuse_ch datasets - learn more here👇
hubs.ly/Q04CdmWZ0
#ThreatIntelligence #ThreatHunting #CyberSecurity
0
0
0
87
🇫🇷 🍻 TONIGHT join Spamhaus, @seczones, @Postmastery @omnivery and @Surbl for drinks! From 6pm at The Cafe Oz Denfert (7 mins walk from Marriot) #M3AAWG68
0
0
0
98
🇫🇷 Bon voyage if you're heading to #M3AAWG68 this weekend!
There's still time to RSVP for drinks here 👇hubs.ly/Q04C7NjK0
There's still time to RSVP for drinks here 👇hubs.ly/Q04C7NjK0
0
1
1
69
📢 For anyone running mail infrastructure, the @spamhaus Project team has just launched their Sender Guidelines, with an added HELO/DNS checker to find and fix issues in your setup. 🙌
Getting the basics right goes such a long way towards avoiding listings and deliverability headaches - these guidelines are gold for senders! 🤩
Getting the basics right goes such a long way towards avoiding listings and deliverability headaches - these guidelines are gold for senders! 🤩
📣 Say hello to the Spamhaus Sender Guidelines! One clear set of rules for anyone running a mail server, from your IT admin to the biggest ESPs...
And because DNS is kind of our thing, we've also built a HELO/DNS checker too!
We're really proud of this one, and we hope it enders everywhere. Now, go grab a cup of coffee, have a read and test your setup:
👉️ spamhaus.org/sender-guideli…
🇫🇷 If you’re heading to #M3AAWG68 next week, come and tell us what you think!
#EmailDeliverability #EmailSecurity #DNS
0
2
2
168
+190% increase in new “sports” domains during the World Cup! Major sporting events = domain registration spikes 📈 - read the full report ⤵️ ⤵️
New domains containing “sports” ⬆️ 190% during the 2026 World Cup, peaking in June at around 67,500 domains. That’s from our latest Domain Reputation Update: April to September 2026:
👉️ spamhaus.org/resource-hub/d…
And there're more....
0
0
1
73
Spamhaus Technology retweeted
From TODAY, non-authenticated users can no longer export files from our platforms. If you haven’t already #Authenticate 👉 auth.abuse.ch
Once authenticated, you will need to:
➡️ Use the new domain: {{platform}}-api.abuse.ch (where the platform can be urlhaus, threatfox )
➡️ Insert your unique Auth Key before the file name (obtained via auth.abuse.ch)
#SteadyPlatform #SteadySignal #SharingIsCaring
Once authenticated, you will need to:
➡️ Use the new domain: {{platform}}-api.abuse.ch (where the platform can be urlhaus, threatfox )
➡️ Insert your unique Auth Key before the file name (obtained via auth.abuse.ch)
#SteadyPlatform #SteadySignal #SharingIsCaring
0
2
3
1,239
🌐 The @spamhaus Project Apr 2026 - Sept 2026 Domain Reputation Update is LIVE! Find insights from Spamhaus researchers into domain abuse and trends with newly observed domains.
Read the full report here ⤵️
hubs.ly/Q04BgSkH0
#DomainReputation #DomainInsights
Read the full report here ⤵️
hubs.ly/Q04BgSkH0
#DomainReputation #DomainInsights
0
0
0
75
Spamhaus Technology retweeted
Nyxar Stealer with potential Turkish roots 🇹🇷, sold as malware-as-a-service with of 60 modules, including:
🪝 Browser credential and cookies stealer
💬 Messaging app credential stealer (Discord, Telegram, etc)
👛 Crypto wallet stealer
🎮 Gaming app credential stealer (Steam, f turkish origin:
🕑 Client quotas reset at 03:00 Instanbul time
🇹🇷 tr-TR formatting and error messages in bot admin panel
Botnet C2s:
📡nyxar .cc
📡nyxar .lol
📡nyxarstealer .lol
📡nyxarst .lol
📡polnet .lol
Malware samples:
bazaar.abuse.ch/browse/signatu…
🪝 Browser credential and cookies stealer
💬 Messaging app credential stealer (Discord, Telegram, etc)
👛 Crypto wallet stealer
🎮 Gaming app credential stealer (Steam, f turkish origin:
🕑 Client quotas reset at 03:00 Instanbul time
🇹🇷 tr-TR formatting and error messages in bot admin panel
Botnet C2s:
📡nyxar .cc
📡nyxar .lol
📡nyxarstealer .lol
📡nyxarst .lol
📡polnet .lol
Malware samples:
bazaar.abuse.ch/browse/signatu…
#Malware #Stealer #Teelegram #NixScareStealer
StalkCraft.exe:
virustotal.com/gui/file/e1b67…
app.any.run/tasks/75be7f3c…
GitHub: github.com/3xp0rt/Nixscar…
Special thanks to @ViriBack.
x.com/ViriBack/statu…
Still information in the comments 👇
7
17
81
7,854
Spamhaus Technology retweeted
Fake DocuSign emails luring recipients into downloading a fake Adobe Acrobat Reader update, leading to ConnectWise #ScreenConnct RMM 🖥️🖱️
email ➡️ Link ➡️ PDF ➡️ MSI
Payload delivery URLs:
📕 data.vaceditions .com/wp-content/new-statement.pdf
⚙️ acrob.my-adobe-plugins-update bazaar.abuse.ch/sample/9f34ec3…
Rogue ScreenConnect servers:
📡 owo.efunmilowoonline .top (NameSilo 🇺🇸)
📡 153.52.178.118:8041 (Hyonix🇺🇸)
email ➡️ Link ➡️ PDF ➡️ MSI
Payload delivery URLs:
📕 data.vaceditions .com/wp-content/new-statement.pdf
⚙️ acrob.my-adobe-plugins-update bazaar.abuse.ch/sample/9f34ec3…
Rogue ScreenConnect servers:
📡 owo.efunmilowoonline .top (NameSilo 🇺🇸)
📡 153.52.178.118:8041 (Hyonix🇺🇸)
0
15
41
3,296
🇫🇷 Just two weeks to M3AAWG 68 in Paris! We’re closing out day one with drinks alongside @Postmastery, @seczones, @omnivery and SURBL... and the drinks are on us. 🍻 🙌
Details: Mon, Oct 26 · 6–8pm · Café Oz Denfert
RSVP: ⤵️
hubs.ly/Q04zTcP80
Details: Mon, Oct 26 · 6–8pm · Café Oz Denfert
RSVP: ⤵️
hubs.ly/Q04zTcP80
0
2
3
243
If you're exporting files on @abuse_ch platforms, soon you'll need to be authenticated - details below👇👇
📢 Important update | Changes to file exports
From October 21st, file exports will require authentication. Non-authenticated users will no longer be able to export files. Authenticated users can continue exporting, with a small update to how export URLs are accessed.
0
0
0
96
🇫🇷 Join Spamhaus and our friends @Postmastery, @seczones, @omnivery and SURBL for drinks, nibbles and good times at #M3AAWG68 à Paris!
🗓️ Mon, October 26th
⏰ 6 - 8pm
📍 Cafe Oz Denfert
RSVP here if you'd like to come along:
forms.gle/6eSZnb2YAybTth…
We're looking forward to ne (they say there's going to be merch!! 👀)
🗓️ Mon, October 26th
⏰ 6 - 8pm
📍 Cafe Oz Denfert
RSVP here if you'd like to come along:
forms.gle/6eSZnb2YAybTth…
We're looking forward to ne (they say there's going to be merch!! 👀)
1
2
3
259
Spamhaus Technology retweeted
New entry: Christoffer Gamrath has gone straight in at #2 on our raw source leaderboard, with 2,923 submissions in 30 days. Thank you 🙏 , Christoffer, and to every contributor helping make the internet a safer place.
See this month's full leaderboards:
👉 submit.spamhaus.org/leaderboards/
See this month's full leaderboards:
👉 submit.spamhaus.org/leaderboards/
2
4
4
1,278
📢 Friday October 16th 12pm (CEST) | @SpamhausTech's Carel Bitter will be presenting at #VB2026: "Inside Popa: a day in the life of a residential proxy"
View the abstract:
hubs.ly/Q04yy5Ln0
🇪🇸 If you're heading to Seville, come say hey! 👋
View the abstract:
hubs.ly/Q04yy5Ln0
🇪🇸 If you're heading to Seville, come say hey! 👋
1
0
1
105
Earlier this year, we had the privilege of supporting Daud Ahmed and his fellow co-authors in their research into how domain and URL blocking decisions should be made. To help build their ground-truth dataset, we provided access to Spamhaus' Intelligence API:
👉 spamhaus.com/data-access/in…
1/3 ⬇️
👉 spamhaus.com/data-access/in…
1/3 ⬇️
1
0
2
159
Their tool, BlockMeNot, automatically recommends the right blocking granularity - apex, subdomain, or URL - to minimize both collateral damage and evasion. Presented at the 35th @USENIXSecurity Symposium, it found that only 37% of real-world blocklist entries were already listed at the optimal granularity.
Access the full research paper here ⤵️
usenix.org/conference/use…
2/3 ⬇️
Access the full research paper here ⤵️
usenix.org/conference/use…
2/3 ⬇️
1
0
1
98
🔎 Could access to Spamhaus data help your research project? Contact us to share more details: spamhaus.com/#contact-us
3/3
3/3
1
0
1
51
Spamhaus Technology retweeted
Did you know that if you run Cowrie high interaction SSH and Telnet honeypot 🍯🐝, you can automatically submit malicious URLs caught by it to URLhaus 💡? If you aren't running a Cowrie honeypot yet, you may want to check it out:
Project website:
🖥️ cowrie.org
github.com/cowrie/cowrie
Malicious URLs caught by Cowrie honeypots:
🌐 urlhaus.abuse.ch/browse/tag/cow…
Project website:
🖥️ cowrie.org
github.com/cowrie/cowrie
Malicious URLs caught by Cowrie honeypots:
🌐 urlhaus.abuse.ch/browse/tag/cow…
0
8
9
2,164
Are you using Spamhaus's Blocklists via DNS Query for email filtering? Here's a pro tip: start sharing your SMTP data with us (don’t worry there's no PII involved).
Why do this? Because sharing basic SMTP connection data helps uncover patterns of malicious activity. This means:
r your email infrastructure
✅ Contribute to a global effort to fight email abuse
It’s a win-win! Read this blog to learn more 👇👇
hubs.ly/Q04xYkhB0
#EmailFiltering #SMTPData #EnhancedProtection
Why do this? Because sharing basic SMTP connection data helps uncover patterns of malicious activity. This means:
r your email infrastructure
✅ Contribute to a global effort to fight email abuse
It’s a win-win! Read this blog to learn more 👇👇
hubs.ly/Q04xYkhB0
#EmailFiltering #SMTPData #EnhancedProtection
0
1
3
247
None of this happens without the people behind it. To everyone contributing to @abuse_ch platforms: thank you 🙏 🙏
A couple of months in and the Community Hub is thriving 🤩 ... 36,441 contributions across all abuse.ch platforms in the last 30 days (up +30.8%) 🔥🔥🔥
@geenensp 🥇 on URLhaus (78-month streak!!)
TheRavenFile 🥇 on ThreatFox
whack_sh 🥇 on MalwareBazaar
Go see ards
👉 community.abuse.ch
#SharingisCaring #Leaderboards #Community 💛
0
0
3
134