SpamRATS RATS Auth Blacklist
The SpamRATS RATS Auth blacklist tracks IPs involved in BEC and password attacks to help secure authenticated services.
Updated on 17 Jun 2026: We updated this guide to clarify RATS-Auth lookups, removal proof, and the difference between IP reputation and domain authentication.
Summarize with
Check if you are listed on SpamRATS RATS Auth Blacklist
And 143 other blocklists.
Spamhaus
0Spam
Cisco
NoSolicitado
URIBL
abuse.ro
ALPHANET
Anonmails
Ascams
BLOCKEDSERVERS
Calivent Networks
EFnet
JustSpam
Kempt.net
NordSpam
RV-SOFT Technology
Scientific Spam
Spamikaze
SpamRATS
SPFBL
Suomispam
System 5 Hosting
Team Cymru
Validity
www.blocklist.de Fail2Ban-Reporting Service
ZapBL
2stepback.dk
Fayntic Services
ORB UK
technoirc.org
TechTheftSpamhaus0SpamCiscoNoSolicitadoURIBLabuse.roALPHANETAnonmailsAscamsBLOCKEDSERVERSCalivent NetworksEFnetJustSpamKempt.netNordSpamRV-SOFT TechnologyScientific SpamSpamikazeSpamRATSSPFBLSuomispamSystem 5 HostingTeam CymruValiditywww.blocklist.de Fail2Ban-Reporting ServiceZapBL2stepback.dkFayntic ServicesORB UKtechnoirc.orgTechTheftSpamhaus0SpamCiscoNoSolicitadoURIBLabuse.roALPHANETAnonmailsAscamsBLOCKEDSERVERSCalivent NetworksEFnetJustSpamKempt.netNordSpamRV-SOFT TechnologyScientific SpamSpamikazeSpamRATSSPFBLSuomispamSystem 5 HostingTeam CymruValiditywww.blocklist.de Fail2Ban-Reporting ServiceZapBL2stepback.dkFayntic ServicesORB UKtechnoirc.orgTechTheftSpamhaus0SpamCiscoNoSolicitadoURIBLabuse.roALPHANETAnonmailsAscamsBLOCKEDSERVERSCalivent NetworksEFnetJustSpamKempt.netNordSpamRV-SOFT TechnologyScientific SpamSpamikazeSpamRATSSPFBLSuomispamSystem 5 HostingTeam CymruValiditywww.blocklist.de Fail2Ban-Reporting ServiceZapBL2stepback.dkFayntic ServicesORB UKtechnoirc.orgTechTheftSpamhaus0SpamCiscoNoSolicitadoURIBLabuse.roALPHANETAnonmailsAscamsBLOCKEDSERVERSCalivent NetworksEFnetJustSpamKempt.netNordSpamRV-SOFT TechnologyScientific SpamSpamikazeSpamRATSSPFBLSuomispamSystem 5 HostingTeam CymruValiditywww.blocklist.de Fail2Ban-Reporting ServiceZapBL2stepback.dkFayntic ServicesORB UKtechnoirc.orgTechTheftWhat is the SpamRATS RATS-Auth blacklist?
The SpamRATS RATS-Auth blacklist is an IP-based blocklist for IP addresses detected in business email compromise (BEC) attacks or other authentication abuse. It lists IPs observed in malicious activity such as password guessing attacks.
According to SpamRATS, this blacklist contains IPs from static sources or networks operated by those engaged in criminal behavior, including compromised servers. It is intended for protecting services that require authentication, not just email services. System administrators commonly apply it to:
- Email servers using SMTP, IMAP, or POP authentication
- SSH services
- XMPP services
- Web forms or other login systems that can safely query an IP reputation list
Unlike some other blacklists, SpamRATS says RATS-Auth typically does not list dynamic IPs or Carrier-Grade NAT (CGNAT) IPs. Its focus is compromised servers, static sources of abuse, and networks tied to credential attacks.
Who runs SpamRATS RATS-Auth blacklist?
The SpamRATS RATS-Auth blacklist is operated by SpamRATS. SpamRATS says its IP reputation data has been used in production environments for more than 15 years, and SpamRATS is a registered trademark of mThreat Technology Inc.
SpamRATS publishes several DNSBL/RBL zones for different IP reputation signals, including RATS-Dyna, RATS-NoPtr, RATS-Spam, and RATS-Auth.
How SpamRATS RATS-Auth is queried
SpamRATS publishes RATS-Auth as a DNSBL/RBL zone. Queries use the normal reversed-IP DNSBL format against the API-key hostname below.
RATS-Auth DNSBL zone
[YOUR_API_KEY].auth.spamrats.com
Use RATS-Auth at authentication checks, such as SMTP AUTH, IMAP, POP, SSH, XMPP, or web login decisions. For mail transit, SpamRATS calls out X-Originating-IP as the in-transit IP that can be checked against RATS-Auth.
- Register an API key before querying the public mirrors.
- Use your own DNS resolver or a local resolver. SpamRATS says open resolvers are not allowed for public mirror access.
- Apply the result to login or authentication policy, rather than treating RATS-Auth as a general-purpose domain or URL blacklist.
How do I get removed and delisted from SpamRATS RATS-Auth blacklist?
To get an IP address removed from the SpamRATS RATS-Auth blacklist, first resolve the security issue that caused the listing. Then start with the SpamRATS removal page to check the IP status and follow the removal path shown there.
Before you submit a delisting request, prepare the following:
- Proof that you are the owner or operator of the listed server, such as rWhois or SWIP information for the IP address.
- A clear explanation of the abusive authentication activity, including whether it involved BEC, password guessing, a compromised server, or exposed credentials.
- The cleanup steps already completed, such as disabling compromised accounts, rotating credentials, patching exposed services, and restricting authentication access.
- The controls added to prevent the same activity again, such as stronger password policy, multi-factor authentication, rate limits, log review, and firewall rules.
If the automated path does not remove the IP, SpamRATS directs operators to use its contact process and provide details for review. If you do not own or manage the listed server, contact the ISP or hosting provider instead.
What is the impact of being listed on SpamRATS RATS-Auth blacklist?
The impact of being listed on the SpamRATS RATS-Auth blacklist is usually lower for standard email marketing delivery than for server security and login access. Because this blocklist focuses on authentication abuse, a listing can cause services that query RATS-Auth to block or challenge authentication attempts from the listed IP.
For a mail platform, that can affect SMTP AUTH, IMAP, or POP logins. For other services, it can affect SSH, XMPP, web forms, or any authentication flow where the operator uses RATS-Auth as an IP reputation signal.
A RATS-Auth listing is not fixed by changing DMARC, SPF, or DKIM alone, because those records authenticate domain-level mail streams rather than proving that an IP is no longer involved in login abuse. Suped's product can monitor DMARC reports during cleanup so legitimate domain authentication issues stay separate from the IP reputation investigation.
Treat the listing as evidence that the IP needs a security review. Close the compromise, document the remediation, and then request delisting once the abuse has stopped.
Other SpamRATS blocklists
SpamRATS RATS Dyna Blacklist
Organization
SpamRATS
Zone
dyna.spamrats.com
Type
IP
Impact
Low
Delisting
Manual
SpamRATS RATS NoPtr Blacklist
Organization
SpamRATS
Zone
noptr.spamrats.com
Type
IP
Impact
Low
Delisting
Manual
SpamRATS RATS Spam Blacklist
Organization
SpamRATS
Zone
spam.spamrats.com
Type
IP
Impact
Low
Delisting
Manual
