Spamhaus adds enriched botnet C&C data to CERT Insight Portal
News
Updated on 22 Oct 2026: We clarified CERT portal access, report triage, and the checks needed to assess email delivery after cleanup.
Spamhaus updated its free CERT Insight Portal for government-funded national and regional CERTs and CSIRTs with enriched botnet C&C reporting, JSON and API access, and improved portal workflows. Spamhaus published the announcement on June 14, 2026. At the time, Spamhaus said more than 100 CERTs and CSIRTs used its data to help remediate malware infections in their countries. The added context helps them investigate command-and-control infrastructure within their own constituencies.
In its June announcement, Spamhaus cited a 56% rise in detected botnet C&C activity during 2025. That figure is historical context for the portal changes. National response teams need faster ways to turn raw listing data into owner notifications and cleanup tickets, with enough context to route each incident to the responsible operator.
Portal access and reporting
- Eligible teams: Government-funded national and regional CERTs and CSIRTs can use the free portal for their constituency.
- New data: The Botnet C&C report now includes enriched BCL metadata, including Spamhaus bot names and Malpedia malware-family mappings.
- Better access: CERT teams can view the enriched C&C report as JSON or use an API key to download its JSON file.
- Existing alert coverage: Portal alerts can cover BCL and SBL, with SBL covering IPs involved in sending or supporting spam operations.
What changed in the CERT Insight Portal
The CERT Insight Portal already gave qualified CERTs and CSIRTs access to regional reporting on bot activity. The main change is richer context for botnet C&C infrastructure. A single IP address by itself often creates a slow investigation: who owns it, which network is responsible, what malware family is involved, when it was last seen, and which team needs the escalation.
The updated portal supports watched resources that match a CERT's scope: ISO 3166-1 two-letter country codes, 16-bit or 32-bit ASNs, and IPv4 CIDR blocks. Once those resources are configured, teams can review relevant IPs in portal reports and export the data for internal tooling. That supports repeatable work such as daily triage queues, incident routing, owner notifications, and regional trend reviews.
When reporting volume increases, prioritization becomes the bottleneck. Teams must distinguish infected hosts from controller infrastructure and decide which cases need owner contact first. The new enrichment supports those decisions.
|
|
|
|
|---|---|---|---|
Bot Report | XBL | Infected hosts | Endpoint cleanup |
Botnet C&C | BCL | Controller IPs | Infrastructure takedown |
Alerts | BCL, SBL | Watched assets | Fast triage |
CERT Insight Portal reports and alerts
How XBL and BCL reports differ
The two report types answer different questions and point to different remediation paths. The Bot Report is sourced from XBL, the Spamhaus Exploits Blocklist, and focuses on infected machines. An IP there usually points to a compromised host or device that needs containment and cleanup. If it is a shared public IP behind network address translation (NAT), use connection logs to identify the affected internal device. The Spamhaus XBL explainer provides more background on that list.
The enriched Botnet C&C report is sourced from BCL, the Spamhaus Botnet Controller List. It points to infrastructure used to coordinate infected machines. Its context includes protocol, country code, ASN, the bot name assigned by Spamhaus, a corresponding Malpedia malware-family name, the C&C IP address, and the last-seen date. That helps a CERT place a recently observed controller in the right network and attach a consistent malware-family reference to the case. Use controller IPs as indicators of compromise (IOCs) when correlating firewall logs with the reported malware family. The last-seen date records an observation; confirm current activity before treating an older export as a live incident.
Bot Report
- Source: XBL, based on Spamhaus observations of infected machines.
- Primary signal: A host in the watched resource appears to be infected.
- Typical action: Notify the network owner, clean the host, and verify the infection has stopped.
Enriched Botnet C&C report
- Source: BCL, based on infrastructure used for botnet command and control.
- Primary signal: A controller server appears inside the CERT's watched country, ASN, or CIDR.
- Typical action: Escalate to hosting, abuse, or network teams with metadata attached.
Illustrative normalized case data, not the API schemajson
{ "source": "BCL", "protocol": "TCP", "country_code": "US", "asn": 64500, "botname": "example-family", "botname_malpedia": "mapped-family", "ip_address": "192.0.2.10", "last_seen": "2026-06-14" }
The example uses invented field names for an internal case record. Map the actual downloaded JSON fields to your own schema before ingesting them into a ticket, SIEM event, abuse workflow, or network owner notification. The API and JSON access let the same evidence move through several teams without manual copying.
Why this matters for email security
Botnet C&C data is primarily a security operations signal, but it connects to email security and sender reputation. Compromised infrastructure and controller systems can drive spam, phishing, malware delivery, blocklist listings, and poor IP reputation. Mail acceptance can degrade when the sending IP or a range that includes it is listed, even when email authentication records are technically valid. BCL identifies controller infrastructure for network protection; assess the listed asset's relationship to mail delivery before assuming an email impact.
This is where blocklist (blacklist) workflows matter. A mail server can have correct DNS records and still suffer if its sending IP has a bad reputation. A listing on a shared sending IP can affect every customer using that IP. An ESP can have authenticated mail that still lands poorly because the underlying IP reputation is damaged. Authentication checks domain authorization. Reputation assesses observed behavior.
Diagram linking infected hosts and C&C servers to blocklist listings, mail rejection, and reputation repair.
Email impact
A passing DMARC result does not cancel out IP reputation damage. If a sending IP or a range containing it appears on a blocklist (blacklist) used by the receiver, that receiver can still reject, defer, or filter the mail.
- Compromise risk: Infected hosts can send unwanted mail or support malicious traffic.
- Reputation risk: Customers sharing a listed sending IP can experience delivery problems until abuse is contained and the listing is resolved.
- Delivery risk: Receivers can act on blocklist data before a sender sees complaints.
- Authentication gap: Passing email authentication does not prove that an IP has good behavior.
For security teams that own mail infrastructure, the Spamhaus update should feed into the same control loop as blocklists, DMARC reporting, and sender reputation monitoring. Teams need to link each listing to an owner and fix its source before receivers change how they treat legitimate mail.
Who needs to act
CERTs and CSIRTs are the direct audience. Spamhaus says the free portal is available to government-funded teams responsible for a national or regional constituency. The operating model is to watch defined resources, receive relevant list activity, export reports, and coordinate remediation with the people who can remove an infected host or controller system.
Network operators, hosting providers, ESPs, mailbox and security teams, and abuse desk owners form the indirect audience. They need the data to move quickly once a CERT escalates a case. Waiting until mail is rejected turns an infrastructure incident into a customer-facing delivery problem. The better workflow begins when the infected host, controller server, or spam-supporting infrastructure first appears in the intelligence stream.
- CERTs and CSIRTs: Configure watched resources and use the reports to drive national or regional remediation.
- Network operators: Map alerts to customers, routers, servers, or hosting segments and remove the cause.
- Hosting providers: Use BCL context to identify controller systems and suspend or clean abusive resources.
- ESPs: Watch sending pools for reputation damage before it becomes a mail acceptance problem.
- Security teams: Tie bot and C&C signals to incident response, customer notification, and abuse handling.
The SBL alert is especially relevant for mail teams. Spamhaus describes SBL as covering IPs involved in sending or supporting spam operations. If a listed IP or range includes your sending infrastructure, receivers that use the relevant Spamhaus data can change their acceptance decisions. The Spamhaus SBL background page explains the list when an alert moves into sender reputation remediation.
Operational priority bands
An illustrative internal triage framework for watched resources, not Spamhaus severity ratings.
Monitor
Low
Older observation; validate current activity and asset ownership.
Triage
Medium
Recent infected host or unknown owner.
Escalate
High
Active C&C or SBL-listed mail asset.
Close
Done
Cleanup verified, listing status checked, and any mail impact reassessed.
How eligible CERTs can request access
Spamhaus' access requirements limit the free portal to government-funded national or regional CERTs and CSIRTs with a defined constituency. Contact cert-team@spamhaus.org to request access or confirm eligibility. The CERT Outreach team verifies the organisation before providing next steps.
Include the team's area of responsibility and an operational contact in the request. After approval, configure resources within that remit and retrieve the API key through the account. Keep the key out of shared tickets and public repositories.
Practical next steps for CERTs and operators
Eligible CERTs should start by checking portal access and confirming that watched resources match their actual responsibility. A country code can be too broad for some teams, while ASNs and CIDR ranges can support direct owner routing. The strongest setup maps cleanly to the teams that can fix affected assets.
Flowchart showing resource monitoring, JSON intake, list triage, owner routing, remediation, and reputation checks.
The API and JSON export support consistent handling. A manual portal check can help during an investigation, but recurring alerts need a repeatable queue with ownership, priority, status, and closure evidence.
- Access review: Confirm the CERT or CSIRT account, users, API key handling, and escalation contacts.
- Resource setup: Add the watched country, ASN, and CIDR resources that match the team's mandate.
- Data intake: Use the Bot Report API and the enriched C&C JSON download in the existing incident workflow. Retain the source list and observation time when deduplicating repeated entries.
- Alert triage: Route BCL and SBL alerts separately from XBL Bot Report findings because each source points to a different remediation path.
- Owner contact: Coordinate with network owners, hosting providers, ESPs, and abuse desks.
- Reputation check: Verify cleanup and current listing status, follow the list operator removal process where needed, and check SMTP responses for affected mail streams.
For any team handling mail, include a reputation check alongside host cleanup evidence. Use Suped's domain health check workflows to review authentication, DNS, and reputation signals together, then use email testing when the question is whether a real message passes the checks receivers apply.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
If an affected IP is part of a sending pool, act before customer complaints arrive. Check the listed IP or prefix and the sending domains actually connected to the incident for blacklist exposure. Attach listing status and SMTP rejection or deferral responses to the cleanup ticket so the team can track delivery recovery. A cleared listing alone does not guarantee inbox placement.
Where Suped fits for sender reputation
Spamhaus' portal is built for eligible CERT and CSIRT workflows. Suped's product supports the mail-side work around those cases by combining DMARC reporting, authentication visibility, blocklist monitoring, and sender reputation alerts. This helps mail teams connect an infrastructure incident with changes in authentication or delivery.
Blocklist monitoring page showing domain and IP checks across blocklists with importance and status
CERT or security teams use the Spamhaus portal to identify infected hosts, controller infrastructure, and SBL alerts in their constituency. Mail operations teams can use Suped to monitor whether sending IPs or domains show reputation trouble, whether DMARC failures are rising, and whether authentication changes are needed. Keep the CERT case and Suped sender checks linked by the affected IP or domain.
Suped's blocklist monitoring helps mail teams track email blocklist status after a related infrastructure incident. Use those checks alongside the CERT investigation and fix authentication only when separate evidence identifies an authentication problem.
Suped workflow
- Monitor authentication: Track email authentication health across active sending domains.
- Watch reputation: Monitor sending IPs and domains across supported email blocklists (blacklists).
- Route incidents: Record the affected sender, list source, and responsible operator in the cleanup ticket.
- Verify recovery: Review listing status and delivery evidence after the operator fixes the source.
Frequently asked questions
The free portal is for government-funded national or regional CERTs and CSIRTs with a defined constituency. Contact cert-team@spamhaus.org to request access; Spamhaus verifies eligibility before providing next steps.
The Bot Report is sourced from XBL and focuses on infected machines. The enriched Botnet C&C report is sourced from BCL and focuses on controller infrastructure, with context including protocol, country code, ASN, Spamhaus bot name, Malpedia malware-family mapping, IP address, and last-seen date.
Compromised infrastructure can send spam, host controller systems, support abuse, and trigger blocklist or blacklist listings. Receivers can reject or filter mail when the sending IP or a containing range is listed on a source they use, even when email authentication passes. A controller alert requires investigation of the affected asset before assuming mail impact.
An ESP should identify whether the affected asset touches sending infrastructure, isolate or clean the source, coordinate with the network owner, and monitor IP and domain reputation until the risk is resolved.
Suped's product helps mail teams monitor email authentication and email blocklist status alongside security cleanup. Match the affected IP or domain to the CERT case, then review listing changes and delivery evidence to assess recovery.
