Federated spam threat intelligence for the EP Suite. Every install that catches a bot reports the IP, every install benefits from every other install's catches. Free for all EP Email users.
The EP Blocklist is a shared threat-intelligence database powering EP Email's spam protection. Each EP Email install runs local heuristics: honeypot, time trap, URL count, keyword filter, gibberish-name detection and a no-link filter. Two of those report to this central server, the gibberish-name filter and the no-link filter. Every install can pull the aggregate list back down.
A report is only ever sent on the first sighting of an address. Once an IP is on a site's own block list it is dropped before the reporting step, so the chart above counts new bot addresses rather than blocked traffic. A flat line means few new addresses, not an idle service.
Each IP carries a severity score from 1 to 5. Every distinct site that has flagged the address adds 0.5, every individual report adds 0.1, and the total is rounded up. An address also listed by Stop Forum Spam gains one further point, capped at 5. External lists never create an entry on their own: an address is only ever added by a real install reporting it.
Default block threshold is severity 2. On peer evidence alone that needs two independent sites, or six reports from one. Most entries here currently clear the bar through external corroboration rather than peer agreement, which is why the Externally corroborated figure sits so close to the Confirmed blocks figure.
Submission content never reaches this server. Only the IP address and a reason code are sent, never names, messages or email addresses taken from a form. Individual reports are filed against a salted SHA-256 site hash rather than a site name, so the reports table alone does not say who flagged what. Registration does not store your site name or email address in readable form either. Your account carries a random nickname, and your domain, email address and sign-up IP are kept only as keyed hashes, with the key held outside the database. That is enough to stop duplicate sign-ups and enforce rate limits, but a copy of the database on its own does not say who you are. ElmsPark holds the key, so it can still check whether a particular domain or address is registered: the network is pseudonymous rather than anonymous.
Network started 10 May 2026. Running for 181 days.