Spamhaus flags record risky domains — and adds a CSS fix aid

Spamhaus just dropped a fresh domain reputation snapshot, and it’s a busy one: 57.1 million new domains registered between April and September 2026, up 21.8% from the previous period, according to its latest update (Spamhaus).

China’s country-code namespaces led the surge, with .cn up 77% and .com.cn up an eye‑catching 515%, which Spamhaus says accounted for much of the overall registration growth in that six‑month window.

Risk signals rose too. Spamhaus reports malicious and suspicious domain listings jumped 56.6% to 3.37 million during April–September 2026, drawing a line under a period of heavier‑than‑usual abuse and policy violations.

September stood out as the high‑water mark: 1.15 million malicious or suspicious domain listings in a single month, which Spamhaus calls its highest monthly total on record in this dataset.

The group hints at a specific driver behind the September spike, teasing “The culprit? Find out in the latest report,” without naming it in the summary text available on its site today (Spamhaus).

Alongside the stats, Spamhaus announced a practical change to its tooling: a new troubleshooting step inside the IP & Domain Reputation Checker aimed at organizations listed on its Combined Spam Sources (CSS) blocklist (Spamhaus).

Spamhaus describes CSS as a list of IPs “associated with low‑reputation email,” and the new checker flow is designed to make it clearer why an IP ended up there and what action might resolve the listing.

The update positions the troubleshooting step explicitly for CSS cases, signaling that many sender questions land there first—“why am I on CSS?”—before teams can correct configuration, list hygiene, or sending patterns contributing to low reputation.

Spamhaus frames the feature as a faster path to diagnosis, saying users can “learn how you can diagnose the issue using this new feature,” which indicates guided prompts or steps in the checker rather than a static explanation.

The domain reputation update itself covers April through September 2026, following a previous report spanning October 2025 through March 2026 and an earlier April–September 2025 baseline, which shows Spamhaus has been tracking these metrics in half‑year blocks.

The six‑month cadence gives senders a consistent yardstick for trend comparison, with the April–September 2026 window notable for both higher domain creation and a sharp rise in domains flagged for malicious or suspicious behavior.

For senders running multi‑domain strategies, the .cn and .com.cn increases matter because Spamhaus attributes much of the overall registration growth to those namespaces, changing the mix of what brand‑new domains look like in global traffic during that period.

The 3.37 million total for malicious and suspicious listings underlines that blocklist ecosystems weren’t quiet during April–September 2026; Spamhaus’ figures imply more frequent identification of domains linked to harmful or policy‑breaking activity.

The single‑month record of 1.15 million such listings in September 2026 punctuates the period, signaling that risk concentration can peak quickly and that monthly monitoring offers more timely warning than waiting for a half‑year roll‑up.

Spamhaus’ note that .com.cn grew 515% stands out as the most extreme percentage change mentioned, and it sits alongside a substantial 77% rise for .cn, which together are cited as responsible for much of the net increase in registrations.

Because the update lists both “malicious” and “suspicious” together, the 3.37 million figure spans confirmed abuse and domains with indicators of risk, making the headline number a blended risk count rather than only confirmed malicious assets.

The CSS‑focused troubleshooting step lives within Spamhaus’ existing IP & Domain Reputation Checker, which the group positions as the first stop for anyone finding their IP or domain listed and unsure about the underlying signal.

Spamhaus notes the new step was added “specifically for those whose IPs have been listed on the Combined Spam Sources (CSS) Blocklist,” clarifying that it targets the email‑sending IP layer rather than domain‑only listings in this release.

The framing “IPs associated with low‑reputation email” for CSS aligns the tool with operational senders who need to interpret what “low‑reputation” meant in their case—volume patterns, recipient reactions, or misconfigurations that a checker workflow can help tease out.

For teams accustomed to looking only at open rates or clickthrough, Spamhaus’ emphasis on reputation diagnostics reinforces that deliverability issues often surface first in listings and reputation checks rather than campaign performance metrics.

The cadence of prior updates—April–September 2025 and October 2025–March 2026—provides historical anchors that make the April–September 2026 spike in both registrations and risky listings stand out more starkly in context.

Spamhaus characterizes September 2026 as its “highest month on record” for these malicious/suspicious listings, which implies earlier months in the dataset did not approach the 1.15 million mark referenced in this summary.

The update’s emphasis on registration surges and a corresponding rise in risky domains suggests that rapid growth in the domain landscape can correlate with larger volumes of domains that later trigger blocklist or suspicion criteria.

Senders encountering CSS listings now have a clearer next step to interpret the “why,” thanks to the added troubleshooting path in the Reputation Checker, which Spamhaus highlights as a new feature in this period’s write‑up.

The checker addition arrives in the same summary that cites unusual September activity, a pairing that makes the guidance timely for teams that might be triaging reputation issues discovered during or shortly after that record month.

Spamhaus’ snapshot places the registration number—57.1 million—alongside the 3.37 million risk listings, making it easier to appreciate both the scale of the domain churn and the absolute count of domains drawing negative attention.

The organization’s callout that growth was “responsible for much of the growth” in .cn and .com.cn underscores that the surge was not evenly distributed across top‑level domains, which can affect how global filtering baselines interpret new‑domain traffic.

The April–September 2026 window’s 21.8% overall registration increase ties this period’s activity directly to the preceding six months, anchoring the report as a comparative rather than isolated snapshot.

The CSS description in the summary—“IPs associated with low‑reputation email”—sets the operational scope of the new troubleshooting feature squarely on sending infrastructure rather than on content or brand alone.

Related guidance from our coverage can help teams translate this into practice: use our rundown on Gmail reputation monitoring after color badges vanished to baseline signals, and revisit how blocklists scrutinize lookalike domains before launching on fresh assets.

For ongoing deliverability context, the deliverability hub collects our recent coverage, including practical checks that complement Spamhaus’ troubleshooting step.

What happened

• Spamhaus counted 57.1 million new domains registered between April and September 2026, a 21.8% increase over the prior six months (Spamhaus).
• China’s .cn grew 77%, and .com.cn jumped 515%, which Spamhaus credits for much of the overall growth.
• Malicious and suspicious domain listings rose 56.6% to 3.37 million in the same period, with September alone reaching 1.15 million—its highest month on record.
• Spamhaus added a new troubleshooting step to its IP & Domain Reputation Checker, aimed at IPs listed on the Combined Spam Sources (CSS) blocklist.
• CSS is described by Spamhaus as listing IPs “associated with low‑reputation email,” and the feature helps diagnose why an IP is listed and how to fix it.

The background

Spamhaus references earlier updates covering April–September 2025 and October 2025–March 2026, indicating a steady six‑month cadence for its domain reputation reporting over multiple consecutive periods.

By presenting both creation volume and risk listings, the report pairs the 57.1 million new registrations with a 3.37 million count of malicious/suspicious listings, showing how growth in domain inventory coexisted with a rise in negative signals.

The outlier month—September 2026—reached 1.15 million malicious/suspicious listings, which Spamhaus labels a record in its reporting, making it the key inflection inside the six‑month window.

The cited 77% growth for .cn and 515% for .com.cn indicate the registration surge clustered in those namespaces, a distribution detail Spamhaus highlights as accounting for much of the period’s net increase.

What people are saying

Spamhaus’ own summary text credits .cn and .com.cn growth for much of the uptick, and it explicitly calls out September 2026’s 1.15 million risky listings as a record month in its dataset.

In introducing the tool update, Spamhaus says it has added a “troubleshooting” step to the IP & Domain Reputation Checker “specifically for those whose IPs have been listed on the Combined Spam Sources (CSS) Blocklist,” positioning it as a practical guide for listed senders.

Spamhaus characterizes CSS as “IPs associated with low‑reputation email,” framing the troubleshooting as a way to understand and remediate the signals that led to a CSS placement rather than a generic pointer to documentation.

What happens next

Senders encountering CSS listings can now use the Reputation Checker’s new workflow to investigate why an IP is flagged and identify steps toward resolution, according to Spamhaus’ feature note.

Monitoring September‑level spikes in malicious/suspicious listings becomes more important when negative signals compress into a single month, and Spamhaus’ record mark sets a recognizable threshold for future comparisons.

As registration surges continue in specific namespaces, the mix of brand‑new domains on the internet shifts, and Spamhaus’ half‑year updates will remain a reference point for whether risk listings track that growth or diverge in future periods.

For teams planning new sending domains, pairing Spamhaus’ diagnostics with practical tuning—like the workflows we outlined after Gmail retired reputation colors—can shorten time to resolution when reputation issues surface.