---
name: spamhaus-drop-intelligence-ingestion
description: "How to get Spamhaus DROP and Intelligence API data into a pandas DataFrame and Parquet: access, the request, the format, limits, quirks and terms."
---

# Load keyless Spamhaus IPv4 DROP data into pandas and Parquet

Source entry: https://signal-lab-jet.vercel.app/datasets/spamhaus-drop-intelligence
Provider: https://www.spamhaus.org/blocklists/do-not-route-or-peer/
Checked against the provider's documentation: 2026-11-01

## Access
- No account or key is needed for the DROP JSON files.
- The Intelligence API is separate and needs an account plus a bearer token.

## Request
```bash
curl 'https://www.spamhaus.org/drop/drop_v4.json'
```

## Format
Line-delimited JSON range records with cidr, sblid and rir, followed by a metadata object containing timestamp and copyright fields.

## Load into pandas and Parquet
Needs Python 3 with requests, pandas and pyarrow.
```python
"""Spamhaus IPv4 DROP JSON lines -> pandas -> Parquet. No key."""
import json
import requests
import pandas as pd

URL = "https://www.spamhaus.org/drop/drop_v4.json"
HEADERS = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) SignalLabCheck/1.0"}
r = requests.get(URL, headers=HEADERS, timeout=60)
r.raise_for_status()
records = [json.loads(line) for line in r.text.splitlines() if line.strip()]
rows = [record for record in records if "cidr" in record]
metadata = next(record for record in reversed(records) if "timestamp" in record)
df = pd.DataFrame(rows)
df["list_timestamp"] = pd.to_datetime(metadata["timestamp"], unit="s", utc=True)
df.to_parquet("spamhaus_drop_v4.parquet", index=False)
print(len(df), "IPv4 ranges", "list timestamp", df["list_timestamp"].iloc[0].isoformat())
```
Run by us on 2026-11-01 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 1754 IPv4 ranges list timestamp 2026-11-01T16:44:02+00:00

## Limits
- Automated DROP downloads must be at least one hour apart; once per day is sufficient for most uses.
- The free Intelligence API Developer License allows 5,000 queries per month for six months.
- The Intelligence API exposes account-specific hourly, minute and second counters through its limits endpoint.

## Quirks
- The DROP JSON is line-delimited rather than one JSON array, and its final object carries list metadata rather than cidr.
- eDROP was merged into DROP on 10 April 2024 and is no longer a separate current list.
- Do not visit or fetch a listed host; retrieve only the Spamhaus file or API metadata.

## Terms and attribution
- DROP is free to download and use; product use must credit The Spamhaus Project and retain date and copyright text.
- The Intelligence API Developer License is limited to development and evaluation, not commercial or production deployment.
- Terms page: https://www.spamhaus.org/blocklists/do-not-route-or-peer/

## Sources
- https://www.spamhaus.org/blocklists/do-not-route-or-peer/: "Automated downloads must be at least one hour apart."
- https://www.spamhaus.org/blocklists/do-not-route-or-peer/: "is also open for all to download and use, there is no fee for usage."
- https://www.spamhaus.com/data-access/intelligence-api-developer-license/: "This will give you 6-months free access for up to 5,000 queries per month."
- https://docs.spamhaus.com/sia/docs/source/10-API-Interface/110-API.html: "To access the API, every request requires a proper"

## Help improve this skill
Missing a source, or see something to improve? Call the MCP tool suggest_source or feedback (or POST /api/suggest or /api/feedback). Reviewed ideas: https://signal-lab-jet.vercel.app/agent-suggestions

Information for educational purposes only. Free tiers, limits and licenses belong to the providers and may change; check the provider's own terms before using the data.