Threat-intelligence feed
General BlacklistsLast verified Page fetched
Spamhaus DROP is a general blacklists threat-intelligence feed tracked by WhisperGraph as a FEED_SOURCE node. The Whisper Internet Directory publishes this page so security analysts and LLM agents can link to it as a stable record for Spamhaus DROP.
Spamhaus DROP — Don't Route Or Peer — is the flagship Spamhaus deny-list of IP prefixes that Spamhaus's research team has determined should not be routed at all. Inclusion criteria are extremely strict: prefixes are added when Spamhaus has high-confidence evidence that the entire block is operated by criminal infrastructure (botnet command-and-control, bulletproof hosting providers, hijacked space announced by criminals). DROP is one of the most widely-deployed routing-policy filters in the world; large transit providers commonly null-route DROP prefixes. It is indexed here because DROP is the canonical prefix-level threat-intel reference.
Live data unavailable. WhisperGraph returned an error (WhisperGraph 530) while looking up this FEED_SOURCE node. The editorial content above is authoritative; the live-data check will retry on the next page revalidation.
Indicators: Computing — check back later. The precompute pipeline is building this feed's indicator sample from the host corpus and will populate the count and representative addresses on an upcoming run.
Look up which threat feeds list a given IP — the indicator-anchored query that powers the threat card:
MATCH (ip:IPV4 {name: $ip})-[:LISTED_IN]->(f:FEED_SOURCE)
WHERE f.name = "Spamhaus DROP"
WITH f
MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.name AS feed, c.name AS categoryVerify the feed's graph-side identity directly:
MATCH (f:FEED_SOURCE {name: "Spamhaus DROP"})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.id AS id, f.name AS name, c.name AS categoryOr query Whisper from your own LLM workflow via the Whisper MCP server.
Pivot from Spamhaus DROP into adjacent entities.