Skip to content
Install MCP

Threat feed

Spamhaus DROP

Last fetched

General Blacklists · refreshed every 6 hours · last verified

Spamhaus DROP is a General Blacklists threat-intelligence feed, refreshed every 6 hours, indexed by WhisperGraph. WhisperGraph currently records 1,506 indicators listed by it.

What is Spamhaus DROP

Spamhaus DROP — Don't Route Or Peer — is the flagship Spamhaus deny-list of IP prefixes that Spamhaus's research team has determined should not be routed at all. Inclusion criteria are extremely strict: prefixes are added when Spamhaus has high-confidence evidence that the entire block is operated by criminal infrastructure (botnet command-and-control, bulletproof hosting providers, hijacked space announced by criminals). DROP is one of the most widely-deployed routing-policy filters in the world; large transit providers commonly null-route DROP prefixes. It is indexed here because DROP is the canonical prefix-level threat-intel reference.

Source
https://www.spamhaus.org/drop/
Refresh cadence
every 6 hours

Category drift. The curated category for this feed is General Blacklists, while WhisperGraph currently files it under blacklists.

Indicators currently listed

1,506 indicators across 1 node type.

PREFIX · 1,506

Related pages

Pivot from Spamhaus DROP into the indicators it lists.

Queries

Resolves the feed's categories.


MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categories
Run yourself →

The indicator-kind rollup and sample listed above.


MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESC
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.