# Spamhaus DROP Blocklist Scraper (`parseforge/spamhaus-drop-blocklist-scraper`) Actor

Scrapes the Spamhaus DROP and EDROP blocklists, IPv4 or IPv6, with optional regional registry filter. Returns each netblock as a flat row with CIDR and registry.

- **URL**: https://apify.com/parseforge/spamhaus-drop-blocklist-scraper.md
- **Developed by:** [ParseForge](https://apify.com/parseforge) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

[![ParseForge](https://raw.githubusercontent.com/ParseForge/apify-assets/main/banner-v4.webp)](https://apify.com/parseforge?fpr=vmoqkp)

### Spamhaus DROP Blocklist Scraper

**Scrape the Spamhaus DROP blocklist, IPv4 or IPv6, up to a million netblocks per run.** Every entry comes with its CIDR, regional registry, and the raw blocklist line. No login or API key. Export to CSV, JSON, Excel, or XML.

Spamhaus publishes the DROP and EDROP lists of netblocks controlled by spammers and cyber criminals, but the raw text feeds are awkward to parse and merge. This Actor fetches the drop_v4 or drop_v6 list, filters by regional internet registry, and returns each netblock as one flat row. Use it to feed firewalls, routers, or threat-intel pipelines without writing a parser.

| Who uses it | What they scrape Spamhaus for |
|---|---|
| Network security engineers | Build an up-to-date blocklist for firewall or router ACLs |
| SOC analysts | Enrich alerts with known malicious netblocks |
| Threat intelligence teams | Track which netblocks Spamhaus currently lists |
| Email administrators | Block mail from hijacked IP ranges at the edge |
| Researchers | Study the geography and allocation of listed netblocks |

### What it does

This Actor collects Spamhaus DROP blocklist entries by list version and optional regional registry, and returns each netblock as a flat row.

- 📋 **List version:** IPv4 (drop_v4), IPv6 (drop_v6), or both merged into one dataset.
- 🌍 **Regional registry filter:** keep only ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC, or other allocations.
- 🔢 **Maximum entries:** cap the run from 1 to 1,000,000 rows.
- 📄 **Flat rows:** each netblock is one record with its CIDR and registry, ready for CSV or JSON export.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

### What you can do with Spamhaus data

**🛡️ Feed a firewall blocklist.**

A network engineer runs the Actor daily for the IPv4 list, exports CSV, and pushes the CIDRs into a firewall rule to drop traffic from criminal netblocks.

**📧 Block spam at the edge.**

An email administrator pulls the merged IPv4 and IPv6 lists and adds the netblocks to the mail server's deny list to reject connections from hijacked ranges.

**🔍 Enrich SIEM alerts.**

A SOC analyst loads the latest blocklist into the SIEM and tags any alert whose source IP falls inside a listed CIDR as a known bad actor.

**📊 Track blocklist changes.**

A threat researcher schedules weekly runs and diffs the datasets to see which netblocks Spamhaus added or removed over time.

### Why choose this scraper

|  | What you get |
|---|---|
| **No parsing** | The raw Spamhaus text feed is parsed into clean rows |
| **IPv4 and IPv6** | Fetch either list or merge both in one run |
| **Registry filter** | Keep only the netblocks allocated to a specific RIR |
| **Export anywhere** | CSV, JSON, Excel, or XML for firewall and SIEM tools |

### How it compares

This Actor focuses on the Spamhaus DROP netblock feeds, while the Email Domain Blacklist Checker checks a single domain against multiple email blacklists.

| Feature | ParseForge | Email Domain Blacklist Checker |
|---|---|---|
| Scrapes Spamhaus DROP netblock list | Yes | Not listed |
| Supports IPv4 and IPv6 lists | Yes | Not listed |
| Filters by regional internet registry | Yes | Not listed |
| Checks domain against 15 email blacklists | Not listed | Yes |
| Validates SPF, DMARC, and MX records | Not listed | Yes |

### Configure the run

Drive the Actor from the list version and optional regional registry, and cap the number of entries per run. The Input tab lists every parameter.

A first run with the defaults:

```json
{
  "maxItems": 10
}
```

A larger pull:

```json
{
  "maxItems": 200
}
```

### Pricing

Pay-per-result: **$0.002 per result** collected. You pay only for the results written to your dataset.

| Results collected | Approximate cost |
|---|---|
| 100 results | $0.20 |
| 1,000 results | $2.00 |
| 10,000 results | $20.00 |

New Apify accounts start with $5 in free credit.

### Free users

Free-plan runs return up to 10 results as a preview. [Upgrade your Apify plan](https://console.apify.com/sign-up?fpr=vmoqkp) to collect up to 1,000,000 results per run.

### Run it

1. [Create a free Apify account with $5 in credit](https://console.apify.com/sign-up?fpr=vmoqkp).
2. Open the [Spamhaus DROP Blocklist Scraper](https://apify.com/parseforge/spamhaus-drop-blocklist-scraper?fpr=vmoqkp).
3. Set your inputs and any filters, then click **Start**.
4. Export the results as CSV, Excel, JSON, or XML from the **Dataset** tab.

Run it programmatically through the [Apify API](https://docs.apify.com/api/v2) (`run-sync-get-dataset-items`) or the [ApifyClient](https://docs.apify.com/api/client/js) for JavaScript and Python.

### Use with AI agents (MCP)

Give an AI agent live access to Spamhaus through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

```bash
claude mcp add --transport http apify "https://mcp.apify.com?tools=parseforge/spamhaus-drop-blocklist-scraper"
```

Then prompt it in plain language to run the scraper and read back the results.

### Troubleshooting

**Why am I getting no results?**

Check the regional registry filter. If you selected a registry that has no entries in the current list, the result will be empty. Set it to 'Any registry' and try again.

**Why does the run stop before my maximum entries?**

The Actor collects only the entries that exist in the selected list. If the list has fewer entries than your maximum, you will get all of them.

**Can I get the raw text feed instead of parsed rows?**

The Actor returns parsed rows, but each row includes the raw line from the feed. If you need the original file, you can download it directly from Spamhaus.

**Why are some netblocks missing from the merged list?**

The IPv4 and IPv6 lists are separate feeds. If you choose 'Both', the Actor merges them, but duplicate or overlapping entries are not removed.

**How do I use the output in a firewall?**

Export the dataset to CSV, then convert the CIDR column to your firewall's blocklist format. Most firewalls accept CIDR notation directly.

### FAQ

| Question | Answer |
|---|---|
| What is the Spamhaus DROP list? | DROP (Don't Route Or Peer) is a public list of IP netblocks that Spamhaus says are controlled by spammers or cyber criminals. It is meant for defensive blocking at the firewall or routing layer. |
| Does this Actor need a Spamhaus API key? | No. It reads the public DROP text feeds directly, so there is no registration or key required. |
| Can I get both IPv4 and IPv6 lists in one run? | Yes. Set the list version to 'Both' and the Actor merges the drop_v4 and drop_v6 entries into one dataset. |
| How do I filter by regional registry? | Use the 'Regional registry' input. Choose ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC, or Other to keep only netblocks allocated by that registry. |
| What does each row contain? | Each row is one netblock entry with its CIDR notation and the regional registry that allocated it, plus the raw line from the feed. |
| How many entries can I collect? | You can set a maximum from 1 to 1,000,000 entries per run. The default is 10. |
| Can I schedule this Actor to run automatically? | Yes. On Apify you can schedule runs daily, weekly, or on any cron expression, and export the results to a dataset or key-value store. |
| What export formats are supported? | The dataset can be exported to CSV, JSON, Excel, or XML from the Apify console or via API. |
| Is this the same as the Spamhaus ZEN or DBL lists? | No. ZEN is a DNS-based blocklist for email, and DBL is a domain blocklist. This Actor only fetches the DROP and EDROP netblock lists. |
| Can I use this to block email from listed IPs? | Yes, but DROP is designed for routing and firewall blocking. For email-specific blocking, Spamhaus recommends ZEN or DBL. |

### Related actors

Browse the full [ParseForge collection](https://apify.com/parseforge?fpr=vmoqkp) for more scrapers.

🆘 **Need help?** Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ **Disclaimer.** This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by The Spamhaus Project. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.

# Actor input Schema

## `listVersion` (type: `string`):

Which Spamhaus DROP feed to fetch. 'IPv4' pulls the drop_v4 list of hijacked or criminal IPv4 netblocks. 'IPv6' pulls the drop_v6 list. 'Both' merges the IPv4 and IPv6 lists into one result set.

## `rir` (type: `string`):

Optional. Keep only netblocks allocated by this regional internet registry. 'Any' returns all registries.

## `maxItems` (type: `integer`):

How many blocklist entries to collect per run.

## Actor input object example

```json
{
  "listVersion": "v4",
  "rir": "any",
  "maxItems": 10
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "maxItems": 10
};

// Run the Actor and wait for it to finish
const run = await client.actor("parseforge/spamhaus-drop-blocklist-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "maxItems": 10 }

# Run the Actor and wait for it to finish
run = client.actor("parseforge/spamhaus-drop-blocklist-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "maxItems": 10
}' |
apify call parseforge/spamhaus-drop-blocklist-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,parseforge/spamhaus-drop-blocklist-scraper"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/YjXGkjBO8ZoCa2f5K/builds/NXQmi3MUTMqx4VbBv/openapi.json