Spamhaus is a threat intelligence provider that tracks IP addresses and domains involved in spam, malware distribution and botnet activity. The Spamhaus transforms query the Spamhaus Intelligence API and return reputation data for IPv4 addresses and domains: which Spamhaus block lists an IP address is (or was) listed on, when it was last seen, the country, whether it is abused or shared, and related indicators such as domains, HELO strings, botnet names, heuristics, email subjects, URLs and file hashes (MD5, SHA256). For domains, the transforms return the abuse status, last-seen date, score and Spamhaus tags.
Spamhaus Transforms
Look Up Records for 12 Months [Spamhaus]
Retrieves reputation data of the IP address provided, for the past 12 months. The input IP address is returned as a child entity enriched with the Spamhaus listing information (abused/shared flags, last seen, country, Spamhaus lists, and a red or yellow overlay indicating whether the listing is still valid or has expired), together with the related indicators found in the matching Spamhaus records.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
Dataset (Available options: ALL, BCL, CSS, XBL) | string | ALL | true | false | false |
Mode (Available options: listed, listings) | string | listed | true | false | false |
Type (Available options: live, history) | string | history | true | false | false |
Username / Email | string | - | true | false | false |
Password | string | - | true | false | false |
Username / Email and Password are global transform settings (shared across all Spamhaus transforms).
Transform Meta Info
Information | Value |
Display Name | Look Up Records for 12 Months [Spamhaus] |
Author | Maltego Technologies GmbH |
Data Source | Spamhaus |
Input Entities | maltego.IPv4Address |
Output Entities | maltego.IPv4Address, maltego.Domain, maltego.Phrase, maltego.Tag, maltego.URL, maltego.Hash |
Short Description | Retrieves reputation data of the IP address provided, for the past 12 months. |
Output details
Output Entity | Link label | Description |
maltego.IPv4Address | - | The input address, enriched with the properties Abused, Shared, Last Seen, Country and Spamhaus Lists, and a "Found in lists" detail view. |
maltego.Domain | - | Domains associated with the listing. |
maltego.Phrase | helo | HELO strings seen for the IP address. |
maltego.Tag | botname | Botnet names. |
maltego.Tag | heuristic | Detection heuristics. |
maltego.Phrase | subject | Email subjects. |
maltego.URL | url | URLs associated with the listing. |
maltego.Hash | - | MD5 and SHA256 hashes of samples (Hash Type set to MD5 or SHA256). |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
maltego.jinxpy_spamhaus.get_ip_reputation_twelve_months | maltego.IPv4Address | IP reputation and related indicators for the past 12 months. |
Look Up Records for 60 Months [Spamhaus]
Retrieves reputation data of the IP address provided, for the past 60 months. Behaves like *Look Up Records for 12 Months [Spamhaus]* but searches a five-year period (queried in 12-month chunks).
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
Dataset (Available options: ALL, BCL, CSS, XBL) | string | ALL | true | false | false |
Mode (Available options: listed, listings) | string | listed | true | false | false |
Type (Available options: live, history) | string | history | true | false | false |
Username / Email | string | - | true | false | false |
Password | string | - | true | false | false |
Transform Meta Info
Information | Value |
Display Name | Look Up Records for 60 Months [Spamhaus] |
Author | Maltego Technologies GmbH |
Data Source | Spamhaus |
Input Entities | maltego.IPv4Address |
Output Entities | maltego.IPv4Address, maltego.Domain, maltego.Phrase, maltego.Tag, maltego.URL, maltego.Hash |
Short Description | Retrieves reputation data of the IP address provided, for the past 60 months. |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
maltego.jinxpy_spamhaus.get_ip_reputation_sixty_months | maltego.IPv4Address | IP reputation and related indicators for the past 60 months. |
Look Up Domain [Spamhaus]
Retrieves reputation data for the domain provided. The domain is returned enriched with the Spamhaus Abused flag, Last Seen date and Score, and any tags Spamhaus has assigned to it are returned as child Tag entities.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
Username / Email | string | - | true | false | false |
Password | string | - | true | false | false |
Transform Meta Info
Information | Value |
Display Name | Look Up Domain [Spamhaus] |
Author | Maltego Technologies GmbH |
Data Source | Spamhaus |
Input Entities | maltego.Domain |
Output Entities | maltego.Domain, maltego.Tag |
Short Description | Retrieves reputation data for the domain provided. |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
maltego.jinxpy_spamhaus.lookup_domain | maltego.Domain | The enriched domain and its Spamhaus tags (maltego.Tag). |
Notes
- Dataset values: ALL, XBL (Exploits Block List), CSS (Compromised Systems List) and BCL (Botnet Controller List). Values are case-insensitive.
- Type values: live or history. Mode values: listed or listings. Values are case-insensitive. An unrecognised value causes a partial result listing the allowed values.
- Result limit: the transform limit is capped at 2000 results.
- The IP transforms accept IPv4 addresses only.