What are the abuse.ch blocklists?

Most blocklists exist because someone sent too much spam. abuse.ch is different. It tracks malware, botnets, and compromised infrastructure. Spam is almost beside the point for them. So why should an email sender care?

Because if your server ends up on one of their lists, it means something seriously wrong is happening on your end. A compromised machine, an infected server, a botnet using your IP to distribute malware. Security filters that query abuse.ch will block your outbound email not because you're a bad marketer, but because your infrastructure looks like a crime scene.

Here's what abuse.ch actually tracks:

• URLhaus flags URLs that are actively distributing malware. If a link from your domain shows up here, it's bad.
• Feodo Tracker tracks command-and-control servers used by banking trojans. These are the servers cybercriminals use to run infected machines remotely.
• spam.abuse.ch covers IPs directly tied to spam campaigns, often botnet-driven.
• drone.abuse.ch lists botnet drone machines, computers or servers that have been taken over and are sending traffic without the owner knowing.
• combined.abuse.ch rolls all of the above into one feed.

For most legitimate email senders, appearing on an abuse.ch list isn't a deliverability problem you stumbled into by accident. It's a signal that something on your infrastructure has been compromised. The fix isn't submitting a delisting request. The fix is cleaning up whatever got infected or hijacked, then reaching out to them once your systems are genuinely secure.

That said, shared hosting environments and smaller ESPs can sometimes carry collateral damage. If another tenant on your shared IP gets flagged, your mail can be caught in the same net. That's worth knowing if you're troubleshooting a block you didn't expect.

You can check whether your domain or IP appears on any major blocklist, including security-focused ones, with our free Blocklist Checker. If something turns up that you can't explain, the SOS hotline is a good next call.