Spamhaus is the trusted authority on IP and domain reputation. This data not only protects but also provides insight across networks and email worldwide.
London, England
- Tweets 1,769
- Following 169
- Followers 3,667
- Likes 748
+190% increase in new “sports” domains during the World Cup! Major sporting events = domain registration spikes 📈 - read the full report ⤵️ ⤵️
New domains containing “sports” ⬆️ 190% during the 2026 World Cup, peaking in June at around 67,500 domains. That’s from our latest Domain Reputation Update: April to September 2026:
👉️ spamhaus.org/resource-hub/do…
And there're more....
4
From TODAY, non-authenticated users can no longer export files from our platforms. If you haven’t already #Authenticate 👉 auth.abuse.ch/
Once authenticated, you will need to:
➡️ Use the new domain: {{platform}}-api.abuse.ch (where the platform can be urlhaus, threatfox or mb for MalwareBazaar)
➡️ Insert your unique Auth Key before the file name (obtained via auth.abuse.ch)
#SteadyPlatform #SteadySignal #SharingIsCaring
2
3
903
🌐 The @spamhaus Project Apr 2026 - Sept 2026 Domain Reputation Update is LIVE! Find insights from Spamhaus researchers into domain abuse and trends with newly observed domains.
Read the full report here ⤵️
hubs.ly/Q04BgSkH0
#DomainReputation #DomainInsights
71
Nyxar Stealer with potential Turkish roots 🇹🇷, sold as malware-as-a-service with of 60 modules, including:
🪝 Browser credential and cookies stealer
💬 Messaging app credential stealer (Discord, Telegram, etc)
👛 Crypto wallet stealer
🎮 Gaming app credential stealer (Steam, Epic, etc)
Probably of turkish origin:
🕑 Client quotas reset at 03:00 Instanbul time
🇹🇷 tr-TR formatting and error messages in bot admin panel
Botnet C2s:
📡nyxar .cc
📡nyxar .lol
📡nyxarstealer .lol
📡nyxarst .lol
📡polnet .lol
Malware samples:
bazaar.abuse.ch/browse/signa…
ALT NyxarStealer botnet admin panel
#Malware #Stealer #Teelegram #NixScareStealer
StalkCraft.exe:
virustotal.com/gui/file/e1b6…
app.any.run/tasks/75be7f3c-9…
GitHub: github.com/3xp0rt/NixscareSt…
Special thanks to @ViriBack.
nitter.siddz.com/ViriBack/status/130223…
Still information in the comments 👇
7
17
80
7,627
Fake DocuSign emails luring recipients into downloading a fake Adobe Acrobat Reader update, leading to ConnectWise #ScreenConnct RMM 🖥️🖱️
email ➡️ Link ➡️ PDF ➡️ MSI
Payload delivery URLs:
📕 data.vaceditions .com/wp-content/new-statement.pdf
⚙️ acrob.my-adobe-plugins-update .top
Malware sample ⤵️
bazaar.abuse.ch/sample/9f34e…
Rogue ScreenConnect servers:
📡 owo.efunmilowoonline .top (NameSilo 🇺🇸)
📡 153.52.178.118:8041 (Hyonix🇺🇸)
ALT Fake DocuSign email
ALT Fake Adobe Acrobat Reader update
ALT Rogue ConnectWise ScreenConnect download
15
38
3,151
🇫🇷 Just two weeks to M3AAWG 68 in Paris! We’re closing out day one with drinks alongside @Postmastery, @Seczones, @omnivery and SURBL... and the drinks are on us. 🍻 🙌
Details: Mon, Oct 26 · 6–8pm · Café Oz Denfert
RSVP: ⤵️
hubs.ly/Q04zTcP80
2
3
222
If you're exporting files on @abuse_ch platforms, soon you'll need to be authenticated - details below👇👇
📢 Important update | Changes to file exports
From October 21st, file exports will require authentication. Non-authenticated users will no longer be able to export files. Authenticated users can continue exporting, with a small update to how export URLs are accessed.
ALT abuse.ch and Spamhaus logos above bold text on a dark teal background: "Access to file exports is changing from October 21st. Are you authenticated?"
94
🇫🇷 Join Spamhaus and our friends @Postmastery, @seczones, @omnivery and SURBL for drinks, nibbles and good times at #M3AAWG68 à Paris!
🗓️ Mon, October 26th
⏰ 6 - 8pm
📍 Cafe Oz Denfert
RSVP here if you'd like to come along:
forms.gle/6eSZnb2YAybTthUx6
We're looking forward to catching up with everyone (they say there's going to be merch!! 👀)
1
2
3
245
New entry: Christoffer Gamrath has gone straight in at #2 on our raw source leaderboard, with 2,923 submissions in 30 days. Thank you 🙏 , Christoffer, and to every contributor helping make the internet a safer place.
See this month's full leaderboards:
👉 submit.spamhaus.org/leaderbo…
ALT Second-place Threat Intel raw source leaderboard announcing a new entry with 2,961 raw source code submissions over the last 30 days, with the submitter’s name shown on the image.
2
4
4
1,265
📢 Friday October 16th 12pm (CEST) | @SpamhausTech's Carel Bitter will be presenting at #VB2026: "Inside Popa: a day in the life of a residential proxy"
View the abstract:
hubs.ly/Q04yy5Ln0
🇪🇸 If you're heading to Seville, come say hey! 👋
1
1
104
Earlier this year, we had the privilege of supporting Daud Ahmed and his fellow co-authors in their research into how domain and URL blocking decisions should be made. To help build their ground-truth dataset, we provided access to Spamhaus' Intelligence API:
👉 spamhaus.com/data-access/int…
1/3 ⬇️
1
2
158
Their tool, BlockMeNot, automatically recommends the right blocking granularity - apex, subdomain, or URL - to minimize both collateral damage and evasion. Presented at the 35th @USENIXSecurity Symposium, it found that only 37% of real-world blocklist entries were already listed at the optimal granularity.
Access the full research paper here ⤵️
usenix.org/conference/usenix…
2/3 ⬇️
1
1
97
🔎 Could access to Spamhaus data help your research project? Contact us to share more details: spamhaus.com/#contact-us
3/3
1
1
51
Did you know that if you run Cowrie high interaction SSH and Telnet honeypot 🍯🐝, you can automatically submit malicious URLs caught by it to URLhaus 💡? If you aren't running a Cowrie honeypot yet, you may want to check it out:
Project website:
🖥️ cowrie.org/
GitHub repository:
🖱️ github.com/cowrie/cowrie
Malicious URLs caught by Cowrie honeypots:
🌐 urlhaus.abuse.ch/browse/tag/…
ALT Cowrie SSH and Telnet honeypot
7
8
2,086
Are you using Spamhaus's Blocklists via DNS Query for email filtering? Here's a pro tip: start sharing your SMTP data with us (don’t worry there's no PII involved).
Why do this? Because sharing basic SMTP connection data helps uncover patterns of malicious activity. This means:
✅ Better protection for your email infrastructure
✅ Contribute to a global effort to fight email abuse
It’s a win-win! Read this blog to learn more 👇👇
hubs.ly/Q04xYkhB0
#EmailFiltering #SMTPData #EnhancedProtection
1
3
247
None of this happens without the people behind it. To everyone contributing to @abuse_ch platforms: thank you 🙏 🙏
A couple of months in and the Community Hub is thriving 🤩 ... 36,441 contributions across all abuse.ch platforms in the last 30 days (up +30.8%) 🔥🔥🔥
@geenensp 🥇 on URLhaus (78-month streak!!)
TheRavenFile 🥇 on ThreatFox
whack_sh 🥇 on MalwareBazaar
Go see the full Top10 leaderboards
👉 community.abuse.ch
#SharingisCaring #Leaderboards #Community 💛
3
134
Most malicious infrastructure gets blocked after the damage is already done.
Spamhaus Blocklists via DNS Query work differently: a real-time DNS lookup checks an IP or domain against Spamhaus data before your network accepts the connection.
Access a free 30-day trial - no card needed👇
spamhaus.com/data-access/rea…
#EmailSecurity #DNSBL #ThreatIntelligence
88
🎉 It started as an unplanned chat at a conference. Now we're thrilled to make our partnership official: Spamhaus-abuse.ch and @Modat.
Community-driven threat intel + internet intelligence, with one mission: helping security teams get ahead of attackers.
And top @abuse_ch contributors? Free Modat Magnify licenses are coming your way 🙏
More details below ⬇️ ⬇️
spamhaus.com/resource-center…
1
2
4
321
Might help if we tagged the right @modat_magnify... we're just too excited! 🤪
1
1
95
Find more info on the Spamhaus and @abuse_ch alliance here: spamhaus.com/abuse-ch/
54