Howto Block the Spamhaus DROP Lists with ufw
The Spamhaus Do Not Route Or Peer (DROP) lists are the worst of the worst: netblocks that are leased, hijacked, or outright owned by professional spam and cyber-crime operations. Spamhaus calls them an advisory “drop all traffic” dataset, and that is exactly how you should treat them. No SMTP session, no HTTP request, no SSH login attempt from those ranges is ever going to be something you want.
DROP is a small subset of the Spamhaus Blocklist (SBL) - roughly 1,700 IPv4 networks and 90 IPv6 networks at the time of writing - and false positives are extremely low, because address space under the control of a legitimate network is never listed. That makes it one of the very few public lists you can safely drop at the firewall instead of only scoring it in your mail filter.