Please share this article in social media';let help_text = '

We are very sorry. How can we improve the article?';let langfaq = '' == '' ? 83 : 85;let chartmonths = '';let chartvalues = '';let bannerLimit = 0;let barChartData = {labels: chartmonths,datasets: [{label: "Spam active",strokeColor: "#CC3300",pointColor: "#CC3300",data: chartvalues},]};let chart_month = ["Jan 2024","Feb 2024","Mar 2024","Apr 2024","May 2024","Jun 2024","Jul 2024","Aug 2024","Sep 2024","Oct 2024","Nov 2024","Dec 2024","Jan 2025","Feb 2025","Mar 2025","Apr 2025","May 2025","Jun 2025","Jul 2025","Aug 2025","Sep 2025","Oct 2025","Nov 2025","Dec 2025","Jan 2026"];let charts = {"bl_ips":[15158,16654,14270,14686,26581,16851,14711,14773,17525,11843,13350,13857,19778,16182,18391,27457,16363,11589,15478,39092,50622,43303,38589,32447,19132],"bl_emails":[93512,74362,78053,82235,93572,94225,83886,79365,107243,86871,94262,69352,55601,49151,56043,56092,39883,38171,38182,52059,76955,65921,76585,64563,30749]};let labels = {bl_ips: 'IPs',bl_emails: 'Emails'};let colors = {bl_ips: 'rgba(74,199,59,1)',bl_emails: 'rgb(51,158,191)'};let data = {};let months_stat_chart = {labels : chart_month,datasets : [],};for (chart_name in charts) {months_stat_chart.datasets.push({label: labels[chart_name],backgroundColor: colors[chart_name],borderColor: "rgba(220,220,220,0.2)",data: charts[chart_name]});}let days_labels = ["14 Dec","15 Dec","16 Dec","17 Dec","18 Dec","19 Dec","20 Dec","21 Dec","22 Dec","23 Dec","24 Dec","25 Dec","26 Dec","27 Dec","28 Dec","29 Dec","30 Dec","31 Dec"," 1 Jan"," 2 Jan"," 3 Jan"," 4 Jan"," 5 Jan"," 6 Jan"," 7 Jan"," 8 Jan"," 9 Jan","10 Jan","11 Jan","12 Jan","13 Jan","14 Jan"];let days_data = {"bl_ips":[706,835,981,2444,1330,1682,857,626,1277,866,674,846,1891,805,823,730,1034,783,669,1671,585,618,835,1227,1468,1483,2319,2237,2603,704,1260,1453],"bl_emails":[1706,1889,2985,2420,2325,2386,2155,1711,2038,2382,2351,1915,1930,1912,2354,2111,2514,2071,1698,1718,1925,1825,2761,2461,2221,2425,2425,2114,2073,2281,2351,2471]};let days_stat_chart = {labels: days_labels,datasets: [],};for (i in days_data) {days_stat_chart.datasets.push({label: labels[i],backgroundColor: colors[i],borderColor: "rgba(220,220,220,0.2)",borderWidth: 1,data: days_data[i]});}

Check IP, email for known spam and abuse activity

Block Lists contain records of 5,103,050 IPs and 1,088,959 email addresses involved in spam and security activity over the past three years.
Block Lists contain records of 5,103,050 IPs and 1,088,959 email addresses involved in spam and security activity over the past three years.

CleanTalk Block Lists Database statistics

Number of IP and Email Addresses with Spam Activity

Yesterday7 days30 days
IPs97 512652 4162 661 910
Emails18 268124 160519 392

This table shows spam activity for all IPs and email addresses recorded by the cloud.
The activity is divided into time frames and shows the number of occurrences in the past relative to the current day.

Daily Statistics of Spam Bot IPs and Emails Added in Block Lists

This chart shows the submission of newly discovered spam-active IPs and email addresses to the database.

Monthly Statistics of Spam Bot IPs and Emails Added in Block Lists

This chart shows the submission of newly discovered spam-active IPs and email addresses to the database.

The Block Lists Database allows you to:

  • Filter spam in orders, comments, registrations, and contact messages on your website.
  • Protect your site from card fraud and card testing, thereby reducing the rate of payment chargebacks caused by unauthorized use of credit cards.

Unlike one of our Anti-Spam plugins, the Block Lists Database checks a website visitor only by their IP or email. If the IP or email has shown spam activity, you can block the visitor from interacting with your site or enable additional, customized methods of protection against spam and security threats.

How Is It Helpful for Email Marketing Services

Clients give the lists of emails of their website subscribers but some of them are spammers. At the same time spammers often use email databases of real clients or non-existent emails. A company that didn't check emails from such list risks that its IP could be blacklisted or the letters would considered as spam. But it is possible to check email lists via the CleanTalk Database and if some emails have spam activity that means that most likely a subscriber was a spammer and such emails should be deleted.

Check IP address or email address via CleanTalk DataBase for spam activity or if they have been blacklisted. It will be helpful to prevent malicious activity and fraud.

How to Download CleanTalk IP and Email Block Lists Database

CleanTalk provides the ability to download a database of spam IP and Email addresses. The data provided in the files with the IP and Email addresses that currently have the Blacklisted status. All spam IP and Email addresses in files are distributed depending on their spam activity.

  • Offline Database. Around 39 000 IPs, 35 000 Emails daily. Spam records with frequency >= 200
  • Offline Database. Around 141 000 IPs, 336 000 Emails daily. Spam records with frequency >= 150
  • Offline Database. Around 376 000 IPs, 491 000 Emails daily. Spam records with frequency >= 100
  • Offline Database. Around 938 000 IPs, 687 000 Emails daily. All spam records.

When purchasing the Block Lists API package, you can download the corresponding Offline Block Lists Database file. Go to the price list page to find out the cost of the package.
To get access for downloading, you need to register an account, select the required access level on the payment pages and pay for the package. On the Block Lists API Dashboard page you will be given access to the SFTP server with your personal username and password. The data is updated once an hour.

  • You can download a database of Block Lists of IP and Email addresses in two formats CSV and IPSet.
  • CSV format provides additional data on spam activity, update dates, spam network activity and AC.
  • The IPSet format provides the ability to automate the addition of spam IP addresses to Iptables or FirewallD.

FAQ

How to download the Block Lists Database?

Access to the Block Lists Database is available via SFTP. You can find the login details on your Block Lists Database dashboard here.

How often is it refreshed?

The information in the Database is updated once per hour.

Can we get the Block Lists Database in JSON format instead of CSV or IPSET?

For optimal performance, we provide the data in CSV and IPSET formats. JSON was considered but requires more memory for processing.

I want to use the spam_check API method. Which package is right for me?

If you plan to check around 10,000 or fewer addresses per month, you can use the minimal tariff. For higher volumes, consider the standard or professional packages.

Why do some entries show a dash (-) during a bulk check on https://cleantalk.org/spambots-check but return a detailed result when checked individually on https://cleantalk.org/email-checker?

The Email Checker (https://cleantalk.org/email-checker) performs a real-time check of an email address.

The Bulk Check (https://cleantalk.org/spambots-check) shows information from our Database. If a specific email address has never been checked before, there will be no information for it.

What do you mean by Spam records frequency?

It is a number of websites that reported spam activity from IP or email. It can be from 0 up to 9999 (shows total activity from the first time the record was caught).

How do you collect data and identify malicious IPs or emails?

The way we collect our Block Lists of IPs and emails is too complicated and also can't be disclosed. Here is the information you can read to slightly understand some of the mechanisms of the system: https://cleantalk.org/blacklists#princip.

Would you be able to tell us approximate amount of *new* entries per day?

You can see the approximate number of records added to the Database daily on this page: https://cleantalk.org/blacklists.
Please check the Daily Statistics of Spam Bot IPs and Emails Added in Block Lists paragraph at the bottom of the page.

I have records with frequency >=200. Is the API only returning 200+ frequency IPs?

No, the API returns the freshest data possible and the limits of the Offline Database do not apply to the API calls.

waves

Your Website Deserves Better Protection

Eliminate spam before it even reaches your inbox.

Get full access to databaseLearn more about API

How Does the CleanTalk Database of Spam IP & Email Work

Blacklisted IPs, emails, domains are being put into the database automatically based on spam activity of anyone who posts something on the Internet. Database records are being created in real-time.

The CleanTalk Anti-Spam and Security Services analyze data of IP and mail addresses activity and if they have such spam activity on several websites for a certain amount of time then after reaching the critical activity threshold the IP/email will be blacklisted.

The service gets data of activity from more than 320,000 websites in real-time. This allows us to discover new spam IPs and emails in short time periods and keep high data relevance for already caught spam IPs/emails.

Each email address is checked for existence. That makes possible to Block Lists fake emails within a few hours after we get the first spam check request.

Information about blacklisted records is very accurate as data of spam activity were received from different websites simultaneously.

Methods That Can Be Used When Working with CleanTalk