Blacklists Compared

9 February 2002

[ Fighting Spam | Blacklists Compared | Current Blacklist Comparison ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the xbl.selwerd.cx zone because it is too aggressive to be widely useful, and excludes the blocktest.relays.osirusoft.com zone because it is not a blacklist.

HitsDNS Zone
7126(total number of IP addresses tested, including 305 at SDSC)
3182(union of most IP zones)
2149xbl.selwerd.cx
1499bl.spamcop.net
1280blackholes.five-ten-sg.com (union of all results)
807dnsbl.njabl.org (union of all results)
785dnsbl.njabl.org (result 127.0.0.2 = source or relay)
749outputs.orbz.org
584relays.ordb.org
580inputs.orbz.org
505block.blars.org
472ztl.dorkslayers.com
435relays.visi.com
399blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
379blackholes.wirehub.net
375blackholes.intersil.net
375blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
339blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
258orbs.dorkslayers.com
222blackholes.2mbit.com (union of all results)
219blacklist.spambag.org
219dev.null.dk
150flowgoaway.com
147blackholes.five-ten-sg.com (result 127.0.0.3 = dialup)
142blackholes.2mbit.com (result 127.0.0.2 = source or relay)
102ipwhois.rfc-ignorant.org
953y.spam.mrs.kithrup.com
89relays.osirusoft.com (union of all results)
86spamguard.leadmon.net (union of all results)
80blackholes.2mbit.com (result 127.0.0.10 = spam haven)
78blocktest.relays.osirusoft.com (not a blacklist!)
74pm0-no-more.compu.net
73relays.dorkslayers.com
56spammers.v6net.org
56relays.osirusoft.com (result 127.0.0.2 = relay)
52inputs.relays.osirusoft.com
50spamsources.fabel.dk
40spamguard.leadmon.net (result 127.0.0.2 = dialup)
36spamguard.leadmon.net (result 127.0.0.3 = spam source)
28dynablock.wirehub.net (result 127.0.0.2 = dialup)
28dynablock.wirehub.net (union of all results)
25relays.osirusoft.com (result 127.0.0.4 = spam source)
22dnsbl.njabl.org (result 127.0.0.3 = dialup)
19blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
18spews.relays.osirusoft.com
17dews.qmail.org
16opm.blitzed.org
12http.opm.blitzed.org
12blackhole.compu.net
10spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
7spamsources.relays.osirusoft.com (union of all results)
6socks.opm.blitzed.org
6spamsources.relays.osirusoft.com (result 127.0.0.4 = spam source)
4relays.osirusoft.com (result 127.0.0.9 = open socks proxy)
2socks.relays.osirusoft.com
2dialups.relays.osirusoft.com
2relays.osirusoft.com (result 127.0.0.3 = dialup)
1spamsources.relays.osirusoft.com (result 127.0.0.7 = unconfirmed opt-in)
1relays.osirusoft.com (result 127.0.0.6 = spamsites)
1spamhaus.relays.osirusoft.com
1relays.osirusoft.com (result 127.0.0.7 = unconfirmed opt-in)
1blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems. The blackhole.compu.net zone "is primarily for hosts which were not blocked by other blackhole sites and spammed compu.net" and the pm0-no-more.compu.net zone "blocks all pm0 email."


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
7126(total number of IP addresses whose names were tested, including 305 at SDSC)
1044(union of all domain zones)
751abuse.rfc-ignorant.org
353whois.rfc-ignorant.org
7postmaster.rfc-ignorant.org
2dsn.rfc-ignorant.org (zone not intended for this use)


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
4827(total number of domains tested, including 72 at SDSC)
524(union of all domain zones)
247whois.rfc-ignorant.org
204abuse.rfc-ignorant.org
100postmaster.rfc-ignorant.org
57dsn.rfc-ignorant.org
7bandwidth-pigs.monkeys.com
1in.dnsbl.org (result 127.0.0.2 = spam source)
1in.dnsbl.org (union of all results)


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 10 February 2002.