Spamhaus DROP Blocklist Scraper

Spamhaus DROP Blocklist Scraper

Scrape the Spamhaus DROP blocklist, IPv4 or IPv6, up to a million netblocks per run. Every entry comes with its CIDR, regional registry, and the raw blocklist line. No login or API key. Export to CSV, JSON, Excel, or XML.

Spamhaus publishes the DROP and EDROP lists of netblocks controlled by spammers and cyber criminals, but the raw text feeds are awkward to parse and merge. This Actor fetches the drop_v4 or drop_v6 list, filters by regional internet registry, and returns each netblock as one flat row. Use it to feed firewalls, routers, or threat-intel pipelines without writing a parser.

Who uses it	What they scrape Spamhaus for
Network security engineers	Build an up-to-date blocklist for firewall or router ACLs
SOC analysts	Enrich alerts with known malicious netblocks
Threat intelligence teams	Track which netblocks Spamhaus currently lists
Email administrators	Block mail from hijacked IP ranges at the edge
Researchers	Study the geography and allocation of listed netblocks

What it does

This Actor collects Spamhaus DROP blocklist entries by list version and optional regional registry, and returns each netblock as a flat row.

• 📋 List version: IPv4 (drop_v4), IPv6 (drop_v6), or both merged into one dataset.
• 🌍 Regional registry filter: keep only ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC, or other allocations.
• 🔢 Maximum entries: cap the run from 1 to 1,000,000 rows.
• 📄 Flat rows: each netblock is one record with its CIDR and registry, ready for CSV or JSON export.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

What you can do with Spamhaus data

🛡️ Feed a firewall blocklist.

A network engineer runs the Actor daily for the IPv4 list, exports CSV, and pushes the CIDRs into a firewall rule to drop traffic from criminal netblocks.

📧 Block spam at the edge.

An email administrator pulls the merged IPv4 and IPv6 lists and adds the netblocks to the mail server's deny list to reject connections from hijacked ranges.

🔍 Enrich SIEM alerts.

A SOC analyst loads the latest blocklist into the SIEM and tags any alert whose source IP falls inside a listed CIDR as a known bad actor.

📊 Track blocklist changes.

A threat researcher schedules weekly runs and diffs the datasets to see which netblocks Spamhaus added or removed over time.

Why choose this scraper

	What you get
No parsing	The raw Spamhaus text feed is parsed into clean rows
IPv4 and IPv6	Fetch either list or merge both in one run
Registry filter	Keep only the netblocks allocated to a specific RIR
Export anywhere	CSV, JSON, Excel, or XML for firewall and SIEM tools

How it compares

This Actor focuses on the Spamhaus DROP netblock feeds, while the Email Domain Blacklist Checker checks a single domain against multiple email blacklists.

Feature	ParseForge	Email Domain Blacklist Checker
Scrapes Spamhaus DROP netblock list	Yes	Not listed
Supports IPv4 and IPv6 lists	Yes	Not listed
Filters by regional internet registry	Yes	Not listed
Checks domain against 15 email blacklists	Not listed	Yes
Validates SPF, DMARC, and MX records	Not listed	Yes

Configure the run

Drive the Actor from the list version and optional regional registry, and cap the number of entries per run. The Input tab lists every parameter.

A first run with the defaults:

{
  "maxItems": 10
}

A larger pull:

{
  "maxItems": 200
}

Pricing

Pay-per-result: $0.002 per result collected. You pay only for the results written to your dataset.

Results collected	Approximate cost
100 results	$0.20
1,000 results	$2.00
10,000 results	$20.00

New Apify accounts start with $5 in free credit.

Free users

Free-plan runs return up to 10 results as a preview. Upgrade your Apify plan to collect up to 1,000,000 results per run.

Run it

1. Create a free Apify account with $5 in credit.
2. Open the Spamhaus DROP Blocklist Scraper.
3. Set your inputs and any filters, then click Start.
4. Export the results as CSV, Excel, JSON, or XML from the Dataset tab.

Run it programmatically through the Apify API (run-sync-get-dataset-items) or the ApifyClient for JavaScript and Python.

Use with AI agents (MCP)

Give an AI agent live access to Spamhaus through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

claude mcp add --transport http apify "https://mcp.apify.com?tools=parseforge/spamhaus-drop-blocklist-scraper"

Then prompt it in plain language to run the scraper and read back the results.

Troubleshooting

Why am I getting no results?

Check the regional registry filter. If you selected a registry that has no entries in the current list, the result will be empty. Set it to 'Any registry' and try again.

Why does the run stop before my maximum entries?

The Actor collects only the entries that exist in the selected list. If the list has fewer entries than your maximum, you will get all of them.

Can I get the raw text feed instead of parsed rows?

The Actor returns parsed rows, but each row includes the raw line from the feed. If you need the original file, you can download it directly from Spamhaus.

Why are some netblocks missing from the merged list?

The IPv4 and IPv6 lists are separate feeds. If you choose 'Both', the Actor merges them, but duplicate or overlapping entries are not removed.

How do I use the output in a firewall?

Export the dataset to CSV, then convert the CIDR column to your firewall's blocklist format. Most firewalls accept CIDR notation directly.

FAQ

Question	Answer
What is the Spamhaus DROP list?	DROP (Don't Route Or Peer) is a public list of IP netblocks that Spamhaus says are controlled by spammers or cyber criminals. It is meant for defensive blocking at the firewall or routing layer.
Does this Actor need a Spamhaus API key?	No. It reads the public DROP text feeds directly, so there is no registration or key required.
Can I get both IPv4 and IPv6 lists in one run?	Yes. Set the list version to 'Both' and the Actor merges the drop_v4 and drop_v6 entries into one dataset.
How do I filter by regional registry?	Use the 'Regional registry' input. Choose ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC, or Other to keep only netblocks allocated by that registry.
What does each row contain?	Each row is one netblock entry with its CIDR notation and the regional registry that allocated it, plus the raw line from the feed.
How many entries can I collect?	You can set a maximum from 1 to 1,000,000 entries per run. The default is 10.
Can I schedule this Actor to run automatically?	Yes. On Apify you can schedule runs daily, weekly, or on any cron expression, and export the results to a dataset or key-value store.
What export formats are supported?	The dataset can be exported to CSV, JSON, Excel, or XML from the Apify console or via API.
Is this the same as the Spamhaus ZEN or DBL lists?	No. ZEN is a DNS-based blocklist for email, and DBL is a domain blocklist. This Actor only fetches the DROP and EDROP netblock lists.
Can I use this to block email from listed IPs?	Yes, but DROP is designed for routing and firewall blocking. For email-specific blocking, Spamhaus recommends ZEN or DBL.

Related actors

Browse the full ParseForge collection for more scrapers.

🆘 Need help? Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ Disclaimer. This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by The Spamhaus Project. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.