Spamhaus DROP Blocklist Scraper
Pricing
from $1.00 / 1,000 results
Spamhaus DROP Blocklist Scraper
Scrapes the Spamhaus DROP and EDROP blocklists, IPv4 or IPv6, with optional regional registry filter. Returns each netblock as a flat row with CIDR and registry.
Pricing
from $1.00 / 1,000 results
Rating
0.0
(0)
Developer
ParseForge
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
14 days ago
Last modified
Categories
Share
Spamhaus DROP Blocklist Scraper
Scrape the Spamhaus DROP blocklist, IPv4 or IPv6, up to a million netblocks per run. Every entry comes with its CIDR, regional registry, and the raw blocklist line. No login or API key. Export to CSV, JSON, Excel, or XML.
Spamhaus publishes the DROP and EDROP lists of netblocks controlled by spammers and cyber criminals, but the raw text feeds are awkward to parse and merge. This Actor fetches the drop_v4 or drop_v6 list, filters by regional internet registry, and returns each netblock as one flat row. Use it to feed firewalls, routers, or threat-intel pipelines without writing a parser.
| Who uses it | What they scrape Spamhaus for |
|---|---|
| Network security engineers | Build an up-to-date blocklist for firewall or router ACLs |
| SOC analysts | Enrich alerts with known malicious netblocks |
| Threat intelligence teams | Track which netblocks Spamhaus currently lists |
| Email administrators | Block mail from hijacked IP ranges at the edge |
| Researchers | Study the geography and allocation of listed netblocks |
What it does
This Actor collects Spamhaus DROP blocklist entries by list version and optional regional registry, and returns each netblock as a flat row.
- 📋 List version: IPv4 (drop_v4), IPv6 (drop_v6), or both merged into one dataset.
- 🌍 Regional registry filter: keep only ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC, or other allocations.
- 🔢 Maximum entries: cap the run from 1 to 1,000,000 rows.
- 📄 Flat rows: each netblock is one record with its CIDR and registry, ready for CSV or JSON export.
Results export to CSV, JSON, Excel, or XML, or straight from the API.
What you can do with Spamhaus data
🛡️ Feed a firewall blocklist.
A network engineer runs the Actor daily for the IPv4 list, exports CSV, and pushes the CIDRs into a firewall rule to drop traffic from criminal netblocks.
📧 Block spam at the edge.
An email administrator pulls the merged IPv4 and IPv6 lists and adds the netblocks to the mail server's deny list to reject connections from hijacked ranges.
🔍 Enrich SIEM alerts.
A SOC analyst loads the latest blocklist into the SIEM and tags any alert whose source IP falls inside a listed CIDR as a known bad actor.
📊 Track blocklist changes.
A threat researcher schedules weekly runs and diffs the datasets to see which netblocks Spamhaus added or removed over time.
Why choose this scraper
| What you get | |
|---|---|
| No parsing | The raw Spamhaus text feed is parsed into clean rows |
| IPv4 and IPv6 | Fetch either list or merge both in one run |
| Registry filter | Keep only the netblocks allocated to a specific RIR |
| Export anywhere | CSV, JSON, Excel, or XML for firewall and SIEM tools |
How it compares
This Actor focuses on the Spamhaus DROP netblock feeds, while the Email Domain Blacklist Checker checks a single domain against multiple email blacklists.
| Feature | ParseForge | Email Domain Blacklist Checker |
|---|---|---|
| Scrapes Spamhaus DROP netblock list | Yes | Not listed |
| Supports IPv4 and IPv6 lists | Yes | Not listed |
| Filters by regional internet registry | Yes | Not listed |
| Checks domain against 15 email blacklists | Not listed | Yes |
| Validates SPF, DMARC, and MX records | Not listed | Yes |
Configure the run
Drive the Actor from the list version and optional regional registry, and cap the number of entries per run. The Input tab lists every parameter.
A first run with the defaults:
A larger pull:
Pricing
Pay-per-result: $0.002 per result collected. You pay only for the results written to your dataset.
| Results collected | Approximate cost |
|---|---|
| 100 results | $0.20 |
| 1,000 results | $2.00 |
| 10,000 results | $20.00 |
New Apify accounts start with $5 in free credit.
Free users
Free-plan runs return up to 10 results as a preview. Upgrade your Apify plan to collect up to 1,000,000 results per run.
Run it
- Create a free Apify account with $5 in credit.
- Open the Spamhaus DROP Blocklist Scraper.
- Set your inputs and any filters, then click Start.
- Export the results as CSV, Excel, JSON, or XML from the Dataset tab.
Run it programmatically through the Apify API (run-sync-get-dataset-items) or the ApifyClient for JavaScript and Python.
Use with AI agents (MCP)
Give an AI agent live access to Spamhaus through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:
Then prompt it in plain language to run the scraper and read back the results.
Troubleshooting
Why am I getting no results?
Check the regional registry filter. If you selected a registry that has no entries in the current list, the result will be empty. Set it to 'Any registry' and try again.
Why does the run stop before my maximum entries?
The Actor collects only the entries that exist in the selected list. If the list has fewer entries than your maximum, you will get all of them.
Can I get the raw text feed instead of parsed rows?
The Actor returns parsed rows, but each row includes the raw line from the feed. If you need the original file, you can download it directly from Spamhaus.
Why are some netblocks missing from the merged list?
The IPv4 and IPv6 lists are separate feeds. If you choose 'Both', the Actor merges them, but duplicate or overlapping entries are not removed.
How do I use the output in a firewall?
Export the dataset to CSV, then convert the CIDR column to your firewall's blocklist format. Most firewalls accept CIDR notation directly.
FAQ
| Question | Answer |
|---|---|
| What is the Spamhaus DROP list? | DROP (Don't Route Or Peer) is a public list of IP netblocks that Spamhaus says are controlled by spammers or cyber criminals. It is meant for defensive blocking at the firewall or routing layer. |
| Does this Actor need a Spamhaus API key? | No. It reads the public DROP text feeds directly, so there is no registration or key required. |
| Can I get both IPv4 and IPv6 lists in one run? | Yes. Set the list version to 'Both' and the Actor merges the drop_v4 and drop_v6 entries into one dataset. |
| How do I filter by regional registry? | Use the 'Regional registry' input. Choose ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC, or Other to keep only netblocks allocated by that registry. |
| What does each row contain? | Each row is one netblock entry with its CIDR notation and the regional registry that allocated it, plus the raw line from the feed. |
| How many entries can I collect? | You can set a maximum from 1 to 1,000,000 entries per run. The default is 10. |
| Can I schedule this Actor to run automatically? | Yes. On Apify you can schedule runs daily, weekly, or on any cron expression, and export the results to a dataset or key-value store. |
| What export formats are supported? | The dataset can be exported to CSV, JSON, Excel, or XML from the Apify console or via API. |
| Is this the same as the Spamhaus ZEN or DBL lists? | No. ZEN is a DNS-based blocklist for email, and DBL is a domain blocklist. This Actor only fetches the DROP and EDROP netblock lists. |
| Can I use this to block email from listed IPs? | Yes, but DROP is designed for routing and firewall blocking. For email-specific blocking, Spamhaus recommends ZEN or DBL. |
Related actors
Browse the full ParseForge collection for more scrapers.
🆘 Need help? Email parseforge@protonmail.com with your run ID, your input, and what you expected.
⚠️ Disclaimer. This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by The Spamhaus Project. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.
