Threat feed
Blocklist.de Mail
Last fetched
Spam · refreshed hourly · last verified
Blocklist.de Mail is a Spam threat-intelligence feed, refreshed hourly, indexed by WhisperGraph. WhisperGraph currently records 7,543 indicators listed by it.
What is Blocklist.de Mail
Blocklist.de Mail is the mail-server-targeting subset of Blocklist.de's fail2ban-derived reputation feed. It enumerates IP addresses observed performing SMTP brute force, dictionary harvesting, or relay abuse against participating mail operators. Mail teams deploy it as an additional pre-greylisting deny-list alongside Spamhaus DBL and PSBL; the per-category split is helpful when an operator wants to block mail abuse without affecting general web traffic. Source data is contributed by volunteer fail2ban operators across Europe, North America, and Asia. It is indexed here because it appears in many open-source mail-server hardening guides.
- Refresh cadence
- hourly
Category drift. The curated category for this feed is Spam, while WhisperGraph currently files it under spam.
Indicators currently listed
7,543 indicators across 3 node types.
IPV6 · 8
- 2a01:239:4e4:7e00:0:0:0:1
- 2a01:111:f403:c209:0:0:0:0
- 2a0f:b6c0:c200:0:0:0:0:68
- 2a01:111:f403:c10d:0:0:0:3
- 2a01:111:f403:c107:0:0:0:9
Related pages
Pivot from Blocklist.de Mail into the indicators it lists.
Queries
Resolves the feed's categories.
MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categoriesThe indicator-kind rollup and sample listed above.
MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESCOr query Whisper from your own LLM workflow via the Whisper MCP server.