# Spamhaus DROP Blocklist Scraper (`parseforge/spamhaus-drop-blocklist-scraper`) Actor Pull the Spamhaus DROP and EDROP blocklists of hijacked and criminal netblocks. Each row carries the CIDR prefix, the Spamhaus SBL reference, the allocating regional internet registry, and IP version. Filter by registry across IPv4 and IPv6 for firewall and routing defense. - **URL**: https://apify.com/parseforge/spamhaus-drop-blocklist-scraper.md - **Developed by:** [ParseForge](https://apify.com/parseforge) (community) - **Categories:** Developer tools, Automation, Other - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $1.00 / 1,000 results This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ![ParseForge Banner](https://github.com/ParseForge/apify-assets/blob/ad35ccc13ddd068b9d6cba33f323962e39aed5b2/banner.jpg?raw=true) ## ๐Ÿ›ก๏ธ Spamhaus DROP Blocklist Scraper > ๐Ÿš€ **Pull the live Spamhaus DROP and EDROP blocklists in one run.** Get every hijacked or criminal netblock as a clean row with its CIDR, Spamhaus SBL reference, and regional internet registry, ready for firewall and routing blocklists. > ๐Ÿ•’ **Last updated:** 2026-06-05 ยท **๐Ÿ“Š 6 fields** per record ยท IPv4 and IPv6 lists ยท Global RIR coverage (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) Spamhaus DROP (Don't Route Or Peer) and EDROP are public, free blocklists published by The Spamhaus Project. They list IP netblocks that are directly allocated to, or hijacked by, spammers and cyber criminals. This Actor fetches the official Spamhaus DROP feeds and returns one clean row per netblock so network and security teams can ingest fresh indicators without parsing raw feed lines by hand. This is a defensive, public-data threat-intelligence tool. Every record comes straight from the Spamhaus DROP download feed. Use it to feed firewall and BGP null-route blocklists, enrich alerts in a SOC, confirm whether a prefix is on the DROP list, or back research into criminal hosting patterns. | ๐ŸŽฏ Target Audience | ๐Ÿ’ก Primary Use Cases | |---|---| | Network and security engineers | Block hijacked netblocks at the edge | | SOC and blue-team analysts | Enrich alerts with DROP context | | Threat intelligence teams | Track criminal netblock allocations | | ISPs and hosting providers | Null-route DROP prefixes via BGP | | Security researchers | Study RIR and netblock abuse trends | ### ๐Ÿ“‹ What the Spamhaus DROP Blocklist Scraper does - Fetches the official Spamhaus DROP feeds for IPv4 (`drop_v4`), IPv6 (`drop_v6`), or both. - Returns one row per netblock with the CIDR, Spamhaus SBL reference, and regional internet registry. - Builds a direct link to the matching Spamhaus SBL record for each entry. - Filters by regional internet registry (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC). - Caps the number of rows returned so you can pull a quick sample or the whole list. - Uses only the public download feed, no login, no API key, no images. ### ๐ŸŽฌ Full Demo (_๐Ÿšง Coming soon_) ### โš™๏ธ Input | Field | Type | Description | |---|---|---| | `listVersion` | select | Which feed to fetch. `v4` pulls the IPv4 list, `v6` pulls the IPv6 list, `both` merges them. | | `rir` | select | Optional registry filter. `any`, `arin`, `ripencc`, `apnic`, `lacnic`, `afrinic`, or `other`. | | `maxItems` | integer | Maximum rows to return. Free plan is capped at 10. | Example input, IPv4 list sample: ```json { "listVersion": "v4", "rir": "any", "maxItems": 5 } ```` Example input, only RIPE NCC netblocks across IPv4 and IPv6: ```json { "listVersion": "both", "rir": "ripencc", "maxItems": 100 } ``` > โš ๏ธ **Good to Know:** DROP is a high-confidence, conservative list, so the IPv6 feed in particular is small and can return only a handful of rows. The `sblUrl` field points to the Spamhaus SBL record behind each listing, where you can read why the netblock was added. Each run fetches the feed live, so counts shift as Spamhaus adds or removes netblocks. ### ๐Ÿ“Š Output Each record has the following fields: | Field | Description | |---|---| | ๐Ÿงฑ `cidr` | The listed netblock in CIDR notation | | ๐Ÿ”– `sblid` | Spamhaus SBL reference for the listing | | ๐ŸŒ `rir` | Regional internet registry that allocated the block | | ๐Ÿ”ข `ipVersion` | `IPv4` or `IPv6` | | ๐Ÿ”— `sblUrl` | Direct link to the Spamhaus SBL record | | ๐Ÿ•’ `scrapedAt` | When this Actor fetched the record | | โŒ `error` | Null on data rows, set only when a run fails | Three real sample records from a run on 2026-06-05: ```json { "cidr": "1.10.16.0/20", "sblid": "SBL256894", "rir": "apnic", "ipVersion": "IPv4", "sblUrl": "https://www.spamhaus.org/sbl/query/SBL256894", "scrapedAt": "2026-06-05T17:18:20.225Z", "error": null } ``` ```json { "cidr": "1.19.0.0/16", "sblid": "SBL434604", "rir": "apnic", "ipVersion": "IPv4", "sblUrl": "https://www.spamhaus.org/sbl/query/SBL434604", "scrapedAt": "2026-06-05T17:18:20.285Z", "error": null } ``` ```json { "cidr": "2.56.192.0/22", "sblid": "SBL459831", "rir": "ripencc", "ipVersion": "IPv4", "sblUrl": "https://www.spamhaus.org/sbl/query/SBL459831", "scrapedAt": "2026-06-05T17:18:20.342Z", "error": null } ``` ### โœจ Why choose this Actor - Pulls straight from the official Spamhaus DROP download, no third-party copy. - Clean, flat rows that drop into a firewall, router, or threat-intel platform. - Merges the IPv4 and IPv6 lists into one result set when you need both. - Filter by regional internet registry before the data ever leaves the run. - No API key and no login required for this public feed. - Honest schema, only fields the source actually returns, no padded always-null columns. ### ๐Ÿ“ˆ How it compares to alternatives | Approach | Effort | Freshness | Structured output | |---|---|---|---| | This Actor | One run | Live feed | Yes, flat rows | | Manual download and parse | Repeated by hand | Live feed | You build the parser | | Copy-pasting the website list | Slow and error prone | Stale fast | No | | Generic web scraper on the page | Brittle setup | Breaks on layout change | Needs cleanup | ### ๐Ÿš€ How to use 1. Sign in or create a free Apify account using [this sign-up link](https://console.apify.com/sign-up?fpr=vmoqkp). 2. Open the Spamhaus DROP Blocklist Scraper and pick the `v4`, `v6`, or `both` list. 3. Optionally set a regional internet registry filter. 4. Set `maxItems` and click Start. 5. When the run finishes, browse the dataset or pull it through the API into your tools. ### ๐Ÿ’ผ Business use cases #### ๐Ÿ”ฅ Firewall and edge blocklisting Feed listed netblocks into firewall, router, and DNS blocklists so traffic to and from hijacked prefixes is dropped at the perimeter. | Need | How this helps | |---|---| | Block criminal netblocks | Push fresh CIDRs to perimeter controls | | Reduce exposure | Cut traffic to known bad prefixes early | #### ๐Ÿงญ SOC alert enrichment When an alert references an external IP, check whether its prefix appears on the DROP list to confirm it sits in known criminal space. | Need | How this helps | |---|---| | Triage faster | Match IPs to a listed netblock instantly | | Prioritize alerts | DROP hits jump the queue | #### ๐Ÿ›ฃ๏ธ BGP and routing policy Network operators can null-route or refuse to peer with DROP-listed prefixes to keep criminal traffic off their backbone. | Need | How this helps | |---|---| | Drop hijacked routes | Build null-route lists from CIDRs | | Tighten peering | Refuse known bad prefixes | #### ๐Ÿ“Š Registry and abuse analysis Study which regional internet registries and allocations repeatedly appear on the list to inform risk scoring and policy. | Need | How this helps | |---|---| | Score allocation risk | Aggregate by `rir` and CIDR size | | Brief stakeholders | Back claims with real counts | ### ๐Ÿ”Œ Automating Spamhaus DROP Blocklist Scraper Connect runs to the rest of your stack: - **Make** and **Zapier**: trigger a run on a schedule and route new netblocks to a webhook. - **Slack**: post newly listed prefixes to a network or security channel. - **Airbyte**: load the dataset into your data warehouse for trend analysis. - **GitHub**: commit periodic snapshots of the list to a repo for change tracking. - **Google Drive**: archive each run for an auditable history of the feed. ### ๐ŸŒŸ Beyond business use cases - **Research**: study criminal hosting patterns, RIR abuse, and netblock churn over time. - **Personal**: block listed netblocks on a home network or personal firewall. - **Non-profit**: help small organizations without a security budget harden their perimeter. - **Experimentation**: build and test routing or filtering rules against a real netblock feed. ### ๐Ÿค– Ask an AI assistant Paste a run output into your assistant of choice and ask for analysis: - [ChatGPT](https://chat.openai.com) - [Claude](https://claude.ai) - [Perplexity](https://www.perplexity.ai) - [Microsoft Copilot](https://copilot.microsoft.com) Example prompt: "Group these netblocks by regional internet registry and tell me which registries carry the most listed prefixes and the largest CIDR ranges." ### โ“ Frequently Asked Questions **Is this legal and safe to use?** Yes. Spamhaus publishes the DROP and EDROP lists publicly for defensive use. This Actor only reads that public feed and returns it in a structured form. **Do I need a Spamhaus API key?** No. The Spamhaus DROP downloads used here are public and keyless. No login or token is required. **What is DROP and EDROP?** DROP (Don't Route Or Peer) lists netblocks allocated to or hijacked by spammers and cyber criminals. EDROP is an extension covering further criminal allocations. Both are meant for blocking at the firewall or routing layer. **What is the difference between the v4 and v6 lists?** The `v4` feed lists IPv4 netblocks and the `v6` feed lists IPv6 netblocks. Choose `both` to merge them into a single result set. **Why did my run return only a few rows?** DROP is a conservative, high-confidence list. The IPv6 feed especially is small, so a run may return a handful of rows rather than thousands. **What is the SBL reference?** Each listing carries a Spamhaus Block List (SBL) reference such as `SBL256894`. The `sblUrl` field links to the SBL record explaining why the netblock was listed. **What does the rir field mean?** It is the regional internet registry that allocated the block, such as ARIN, RIPE NCC, APNIC, LACNIC, or AFRINIC. You can filter to a single registry with the `rir` input. **How fresh is the data?** Each run fetches the list live at run time, so the data is as current as the Spamhaus DROP feed itself. **Can I filter by registry?** Yes. Pick a registry in the `rir` input to keep only netblocks allocated by that registry. **How many rows can I get on the free plan?** Free runs are capped at 10 rows. A paid plan raises the cap so you can pull the entire list. **Can I schedule this to run automatically?** Yes. Use Apify Schedules to run it daily and route new netblocks to your tools through integrations or the API. **Does this replace a full threat-intel platform?** No. It is a clean source of one specific, high-quality blocklist that complements your existing tooling rather than replacing it. ### ๐Ÿ”Œ Integrate with any app Every run stores results in an Apify dataset you can pull through the REST API, the JavaScript and Python clients, or any of the no-code integrations above. Wire the output into a firewall management tool, a SIEM, a router automation pipeline, or a notification channel. ### ๐Ÿ”— Recommended Actors - [Feodo Tracker C2 Scraper](https://apify.com/parseforge/feodo-tracker-c2-scraper). Pull the abuse.ch Feodo Tracker botnet C2 IP blocklist. - [crt.sh Certificate Transparency Scraper](https://apify.com/parseforge/crtsh-certificate-transparency-scraper). Search certificate transparency logs by domain. - [Have I Been Pwned Breaches Scraper](https://apify.com/parseforge/hibp-breaches-catalog-scraper). Browse the catalog of known data breaches. - [EPA FRS Facility Registry Scraper](https://apify.com/parseforge/epa-frs-facility-registry-scraper). Query the EPA Facility Registry Service. - [deps.dev Package Insights Scraper](https://apify.com/parseforge/deps-dev-package-insights-scraper). Pull open source package security and dependency data. > ๐Ÿ’ก **Pro Tip:** browse the complete [ParseForge collection](https://apify.com/parseforge). **๐Ÿ†˜ Need Help?** [Open our contact form](https://tally.so/r/BzdKgA) > **โš ๏ธ Disclaimer:** This is an independent tool and is not affiliated with The Spamhaus Project. Only publicly available data is collected, and it is provided for defensive security and research purposes. # Actor input Schema ## `listVersion` (type: `string`): Which Spamhaus DROP feed to fetch. 'IPv4' pulls the drop\_v4 list of hijacked or criminal IPv4 netblocks. 'IPv6' pulls the drop\_v6 list. 'Both' merges the IPv4 and IPv6 lists into one result set. ## `rir` (type: `string`): Optional. Keep only netblocks allocated by this regional internet registry. 'Any' returns all registries. ## `maxItems` (type: `integer`): Free users: Limited to 10 items (preview). Paid users: Optional, max 1,000,000 ## Actor input object example ```json { "listVersion": "v4", "rir": "any", "maxItems": 10 } ``` # Actor output Schema ## `results` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "maxItems": 10 }; // Run the Actor and wait for it to finish const run = await client.actor("parseforge/spamhaus-drop-blocklist-scraper").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`๐Ÿ’พ Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // ๐Ÿ“š Want to learn more ๐Ÿ“–? Go to โ†’ https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "maxItems": 10 } # Run the Actor and wait for it to finish run = client.actor("parseforge/spamhaus-drop-blocklist-scraper").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("๐Ÿ’พ Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # ๐Ÿ“š Want to learn more ๐Ÿ“–? Go to โ†’ https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "maxItems": 10 }' | apify call parseforge/spamhaus-drop-blocklist-scraper --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=parseforge/spamhaus-drop-blocklist-scraper", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Spamhaus DROP Blocklist Scraper", "description": "Pull the Spamhaus DROP and EDROP blocklists of hijacked and criminal netblocks. Each row carries the CIDR prefix, the Spamhaus SBL reference, the allocating regional internet registry, and IP version. Filter by registry across IPv4 and IPv6 for firewall and routing defense.", "version": "0.1", "x-build-id": "PS70wB4lYblAeynuk" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/parseforge~spamhaus-drop-blocklist-scraper/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-parseforge-spamhaus-drop-blocklist-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/parseforge~spamhaus-drop-blocklist-scraper/runs": { "post": { "operationId": "runs-sync-parseforge-spamhaus-drop-blocklist-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/parseforge~spamhaus-drop-blocklist-scraper/run-sync": { "post": { "operationId": "run-sync-parseforge-spamhaus-drop-blocklist-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "listVersion": { "title": "List version", "enum": [ "v4", "v6", "both" ], "type": "string", "description": "Which Spamhaus DROP feed to fetch. 'IPv4' pulls the drop_v4 list of hijacked or criminal IPv4 netblocks. 'IPv6' pulls the drop_v6 list. 'Both' merges the IPv4 and IPv6 lists into one result set.", "default": "v4" }, "rir": { "title": "Regional registry", "enum": [ "any", "arin", "ripencc", "apnic", "lacnic", "afrinic", "other" ], "type": "string", "description": "Optional. Keep only netblocks allocated by this regional internet registry. 'Any' returns all registries.", "default": "any" }, "maxItems": { "title": "Max Items", "minimum": 1, "maximum": 1000000, "type": "integer", "description": "Free users: Limited to 10 items (preview). Paid users: Optional, max 1,000,000" } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```