Strengthening trust and safety across the Internet, by being the authority on IP and domain reputation. Mastodon: @spamhaus@infosec.exchange
Global
Joined December 2010
- Tweets1.7K
- Following137
- Followers10.6K
- Likes673
New domains containing “sports” ⬆️ 190% during the 2026 World Cup, peaking in June at around 67,500 domains. That’s from our latest Domain Reputation Update: April to September 2026:
👉️ spamhaus.org/resource-hub/do…
And there're more....
“casino” was the #1 trending term, with 448,100 new domains (⬆️ 71%).
🇨🇳 Chinese-language gambling terms appeared too, including “kaiyun”, a betting brand, and “shijiebei”, which means World Cup.
The same terms showed up in phishing: “sports” and “kaiyun” both entered our Top 20 phishing terms for the period.
📢 Registries and registrars: look out for betting and scam domains around major events, and review pricing promotions, which can make bulk registration cheap for abusers.
#DomainSecurity #Phishing #WorldCup
📢 OUT NOW | Spamhaus Domain Report (April – September 2026)
Here’s a quick snapshot:
🌐 57.1 million new domains (+21.8%)
👾 3.37 million malicious or suspicious domain detections (+56.6%)
📈 September hit a record 1.15 million listings (spoiler: it's cold email domains!)
⚽ “sports” domains up +190%, and “casino” still #1
🔄 .bond turns it around 👏
And find out which TLD has a massive 26.5% of its zone file listed!
Read the full domain report here:
👉 spamhaus.org/resource-hub/do…
#DomainAbuse #DomainInsights
📈 Malicious domains sponsored by Nameslink (Hong Kong) Private Limited increased 776% from 3,643 to 31,914 in 30 days – it’s now #1 on our list of registrars associated with malicious domains.
🌐 See the full statistics here:
spamhaus.org/reputation-stat…
#ThreatIntelligence #CyberSecurity #DNS #DomainAbuse
Spamhaus retweeted
🇫🇷 Just two weeks to M3AAWG 68 in Paris! We’re closing out day one with drinks alongside @Postmastery, @Seczones, @omnivery and SURBL... and the drinks are on us. 🍻 🙌
Details: Mon, Oct 26 · 6–8pm · Café Oz Denfert
RSVP: ⤵️
hubs.ly/Q04zTcP80
❗Here's the most recent additions to Spamhaus DROP (Do Not Route or Peer) list - including hijacked IPs, suspected snowshoe spam and cybercrime hosting:
45.81.154.0/24 -> SBL700455
62.60.134.0/24 -> SBL700391
147.90.182.0/24 -> SBL700378
217.60.77.0/24 -> SBL700377
94.154.40.0/24 -> SBL700376
13.143.247.0/24 -> SBL700373
102.135.106.0/24 -> SBL700252
13.143.144.0/24 -> SBL700371
85.239.147.0/24 -> SBL700369
196.251.65.0/24 -> SBL700367
Full details available via Spamhaus IP and Domain Checker - simply input the SBL number and hit ENTER ➡️ check.spamhaus.org
🤔 Not using Spamhaus' DROP lists already?
You can access them for FREE and gain protection against the worst of the worst IP traffic at the routing level.
Lists are available for IPv4, IPv6 and ASN filtering:
➡️ spamhaus.org/blocklists/do-n…
#CyberSecurity #ThreatIntel #NetworkSecurity #Infosec
Spamhaus retweeted
ASOS links data breach to social engineering attack, credential theft
bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
Spamhaus retweeted
📢 Important update | Changes to file exports
From October 21st, file exports will require authentication. Non-authenticated users will no longer be able to export files. Authenticated users can continue exporting, with a small update to how export URLs are accessed.
ALT abuse.ch and Spamhaus logos above bold text on a dark teal background: "Access to file exports is changing from October 21st. Are you authenticated?"
Spamhaus retweeted
ASOS confirms data breach after “HACKED” in-app notifications
bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
Spamhaus retweeted
‼️ A suspected #ShinyHunters member is reportedly helping the FBI identify others in the group.
Rey, also known as ReyXBF, was allegedly detained in Jordan on September 29. His cooperation is now feeding an ongoing effort to pursue more members.
Read: thehackernews.com/2026/10/sh…
Spamhaus retweeted
🇫🇷 Join Spamhaus and our friends @Postmastery, @seczones, @omnivery and SURBL for drinks, nibbles and good times at #M3AAWG68 à Paris!
🗓️ Mon, October 26th
⏰ 6 - 8pm
📍 Cafe Oz Denfert
RSVP here if you'd like to come along:
forms.gle/6eSZnb2YAybTthUx6
We're looking forward to catching up with everyone (they say there's going to be merch!! 👀)
New entry: Christoffer Gamrath has gone straight in at #2 on our raw source leaderboard, with 2,923 submissions in 30 days. Thank you 🙏 , Christoffer, and to every contributor helping make the internet a safer place.
See this month's full leaderboards:
👉 submit.spamhaus.org/leaderbo…
ALT Second-place Threat Intel raw source leaderboard announcing a new entry with 2,961 raw source code submissions over the last 30 days, with the submitter’s name shown on the image.
Spamhaus retweeted
Are you using Spamhaus's Blocklists via DNS Query for email filtering? Here's a pro tip: start sharing your SMTP data with us (don’t worry there's no PII involved).
Why do this? Because sharing basic SMTP connection data helps uncover patterns of malicious activity. This means:
✅ Better protection for your email infrastructure
✅ Contribute to a global effort to fight email abuse
It’s a win-win! Read this blog to learn more 👇👇
hubs.ly/Q04xYkhB0
#EmailFiltering #SMTPData #EnhancedProtection
Over the last 30 days, detections of compromised IPs hosted in 🇮🇳 India have ⬆️ from 352,000 to 1.05 million (at the time of writing) – that's almost 3x! These are devices showing signs of malware infection, botnet control or abuse as residential proxies.
This places India #1 for IPs linked to exploited devices, ahead of 🇧🇷 Brazil (808K) and the 🇺🇸 US (503K). Meanwhile, spam coming from Indian IPs is up 70% over the same period.
🌎 See all country rankings here:
spamhaus.org/reputation-stat…
Network operators in the region – are you seeing this in your abuse queues?
#ThreatIntelligence #CyberSecurity #Botnets #India
The registration record shows almost nothing. It has the same creation date (2015), the same registrar and no sign it lapsed. There's just an "Updated Date" of 21 April 2026, with no clue what changed.
We can't say how it happened. It could be domain warehousing by a registrar, or an agency that registered the domain under its own name. What we're confident about is that FedEx didn't knowingly send its brand to a gambling site.
(3/4)
The lesson for every brand:
✅ Treat every campaign domain as a permanent brand asset
✅ Make sure your organization is the registrant, not your agency
✅ Keep a list of all brand domains, with owners and expiry checks
✅ Keep monitoring domains even after you let them go
Our DNS best practice guidance shows you how:
👉 spamhaus.org/resource-hub/dn…
(4/4)
Spamhaus retweeted
📢 #ICANN confirms that 1,616 new gTLD applications will proceed in the #NewgTLDProgram: 2026 Round, following the close of the application submission window last month.
ICANN expects to announce the date for Reveal Day, when the applied for strings will be published, early next week.
🔗 Learn more about the latest updates and upcoming milestones >> go.icann.org/47beZz5
