exploit

IP Exploit blocklist (exploit.mail.abusix.zone)

Description

This list is built by observing the behaviour of hosts connecting to our traps and to our partners mail services.

It contains any IP address we observe that behaves in certain ways that a genuine SMTP client never would, so any IPs found on this list will either be compromised, botnet/virus infected, proxies, VPNs, TOR exit nodes or IPs that are NAT'ing for these hosts.

This list can also be safely used to check each "Received" header hop found within a message.

Example query:

$ host 2.0.0.127.<key>.exploit.mail.abusix.zone.
2.0.0.127.<key>.exploit.mail.abusix.zone has address 127.0.0.4