Blacklists Compared

23 February 2002

[ Fighting Spam | Blacklists Compared | Current Blacklist Comparison ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the xbl.selwerd.cx zone because it is too aggressive to be widely useful, and excludes the blocktest.relays.osirusoft.com zone because it is not a blacklist.

HitsDNS Zone
7064(total number of IP addresses tested, including 420 at SDSC)
3073(union of most IP zones)
2095xbl.selwerd.cx
1715blocktest.relays.osirusoft.com (not a blacklist!)
1335blackholes.five-ten-sg.com (union of all results)
906bl.spamcop.net
836relays.osirusoft.com (union of all results)
734dnsbl.njabl.org (union of all results)
713dnsbl.njabl.org (result 127.0.0.2 = source or relay)
642outputs.orbz.org
583ztl.dorkslayers.com
472block.blars.org
466inputs.orbz.org
457inputs.relays.osirusoft.com
456relays.osirusoft.com (result 127.0.0.2 = relay)
436relays.ordb.org
426blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
424blackholes.intersil.net
374blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
357blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
350blackholes.wirehub.net
277relays.visi.com
265relays.osirusoft.com (result 127.0.0.4 = spam source)
265orbs.dorkslayers.com
222blacklist.spambag.org
215korea.services.net
201spews.relays.osirusoft.com
193blackholes.2mbit.com (union of all results)
183blackholes.2mbit.com (result 127.0.0.2 = source or relay)
168flowgoaway.com
149blackholes.five-ten-sg.com (result 127.0.0.3 = dialup)
142dev.null.dk
135relays.dorkslayers.com
102proxies.relays.monkeys.com
1023y.spam.mrs.kithrup.com
94spamsources.fabel.dk
91ipwhois.rfc-ignorant.org
84relays.osirusoft.com (result 127.0.0.9 = open socks proxy)
84socks.relays.osirusoft.com
75spamsources.relays.osirusoft.com (union of all results)
71spamsources.relays.osirusoft.com (result 127.0.0.4 = spam source)
68spam.wytnij.to
65t1.bl.reynolds.net.au
51spammers.v6net.org
51spamguard.leadmon.net (union of all results)
38spamguard.leadmon.net (result 127.0.0.2 = dialup)
27dynablock.wirehub.net (result 127.0.0.2 = dialup)
27sbl.spamhaus.org
27dynablock.wirehub.net (union of all results)
26dialups.relays.osirusoft.com
26blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
25relays.osirusoft.com (result 127.0.0.6 = spamsites)
25relays.osirusoft.com (result 127.0.0.3 = dialup)
23spamhaus.relays.osirusoft.com
22formmail.relays.monkeys.com
21dnsbl.njabl.org (result 127.0.0.3 = dialup)
18opm.blitzed.org
15http.opm.blitzed.org
11dews.qmail.org
10blackholes.2mbit.com (result 127.0.0.10 = spam haven)
8spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
6spamsites.relays.osirusoft.com (union of all results)
5spamsites.relays.osirusoft.com (result 127.0.0.6)
5spamguard.leadmon.net (result 127.0.0.3 = spam source)
4spamsources.relays.osirusoft.com (result 127.0.0.6 = spamhaus)
3socks.opm.blitzed.org
3blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
1spamsites.relays.osirusoft.com (result 127.0.0.7 = spamware vendor)
1relays.osirusoft.com (result 127.0.0.7 = unconfirmed opt-in)
1pm0-no-more.compu.net

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems. The blackhole.compu.net zone "is primarily for hosts which were not blocked by other blackhole sites and spammed compu.net" and the pm0-no-more.compu.net zone "blocks all pm0 email."

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
7064(total number of IP addresses whose names were tested, including 420 at SDSC)
1100(union of all domain zones)
777abuse.rfc-ignorant.org
398whois.rfc-ignorant.org
9postmaster.rfc-ignorant.org
3dsn.rfc-ignorant.org (zone not intended for this use)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
4723(total number of domains tested, including 174 at SDSC)
488(union of all domain zones)
209abuse.rfc-ignorant.org
205whois.rfc-ignorant.org
104postmaster.rfc-ignorant.org
54dsn.rfc-ignorant.org
9bandwidth-pigs.monkeys.com
1in.dnsbl.org (result 127.0.0.2 = spam source)
1in.dnsbl.org (union of all results)

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 24 February 2002.