Spamhaus DROP and ASN-DROP
Threat blocklists. What Spamhaus DROP and ASN-DROP is, on what terms it is used, which fields of the IP answer it feeds, how big it is today and when it was last synced.
| Kind | Threat blocklists |
|---|---|
| Publisher | https://www.spamhaus.org/blocklists/do-not-route-or-peer/ |
| Terms | Free to use in a product with credit to The Spamhaus Project; the copyright line stays with the file. |
| Refresh | daily |
| Size today | 1,745 IPv4 ranges and 92 IPv6 ranges and 434 autonomous systems compiled from the 3 feeds. |
| Last synced | 2026-09-12 |
| Answers | is_blocklisted, blocklist |
What it is
Spamhaus DROP lists netblocks hijacked or leased by spam and cybercrime operations, IPv4 and IPv6, and ASN-DROP the operators behind them, matched by the address's autonomous system. A hit is the 80-point blocklist signal and names the list.
What it answers
In the IP response this source feeds is_blocklisted, blocklist. Every answer names the datasets it read in its sources block with the date each was synced, so the figure on this page and the one in an answer are the same figure.
curl https://spaw.co/api/v1/ip \
-H "Authorization: Bearer $SPAW_KEY" \
-H "Content-Type: application/json" \
-d '{"ip": "203.0.113.9"}'How to read this page
A source names a network or an operator, never a person. An address inside one of these ranges tells you what the connection is — a cloud instance, a VPN exit, a gateway, a listed host — and nothing about who is behind it.
More sources in threat blocklists
counts and dates read from the installed feed · checked 2026-09-13
More free tools
All free toolsNeed this at scale?
The Spaw API runs the same checks plus mailbox-level SMTP verification, batch and bulk endpoints, and list monitoring — 10 free lookups a month, no card required.