Blacklists Compared

25 May 2002

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the xbl.selwerd.cx zone because it is too aggressive to be widely useful, and excludes the blocktest.relays.osirusoft.com zone because it is not a blacklist.

HitsDNS Zone
8149(total number of IP addresses tested, including 399 at SDSC)
3931(union of most IP zones)
2939xbl.selwerd.cx
1821blackholes.five-ten-sg.com (union of all results)
1469blocktest.relays.osirusoft.com (not a blacklist!)
1122no-more-funn.moensted.dk (union of all results)
1067bl.spamcop.net
990relays.osirusoft.com (union of all results)
988blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
873dnsbl.njabl.org (union of all results)
870dnsbl.njabl.org (result 127.0.0.2 = source or relay)
797no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
739unconfirmed.dsbl.org
668block.blars.org
620korea.services.net
565work.drbl.croco.net
535ztl.dorkslayers.com
514relays.osirusoft.com (result 127.0.0.2 = relay)
512inputs.relays.osirusoft.com
450blackholes.wirehub.net
441blackholes.intersil.net
440list.dsbl.org
355relays.visi.com
338ipwhois.rfc-ignorant.org
328relays.osirusoft.com (result 127.0.0.4 = spam source)
325blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
302spews.relays.osirusoft.com
301t1.bl.reynolds.net.au
288relays.ordb.org
272multihop.dsbl.org
266orbs.dorkslayers.com
251blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
237blacklist.spambag.org
188blackholes.five-ten-sg.com (result 127.0.0.3 = dialup)
184spamsources.fabel.dk
173flowgoaway.com
1573y.spam.mrs.kithrup.com
151proxies.relays.monkeys.com
150relays.osirusoft.com (result 127.0.0.9 = open proxy)
143no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
125spam.wytnij.to
117spamguard.leadmon.net (union of all results)
110no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
84spamhaus.relays.osirusoft.com
83sbl.spamhaus.org
74relays.osirusoft.com (result 127.0.0.6 = spamsites)
69spamguard.leadmon.net (result 127.0.0.2 = dialup)
65blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
64dews.qmail.org
64spamsources.relays.osirusoft.com (union of all results)
62opm.blitzed.org
60spamsources.relays.osirusoft.com (result 127.0.0.4 = spam source)
60formmail.relays.monkeys.com
52relays.dorkslayers.com
48no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
42http.opm.blitzed.org
40spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
37spammers.v6net.org
24no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
23socks.opm.blitzed.org
15socks.relays.osirusoft.com
14dynablock.wirehub.net (result 127.0.0.2 = dialup)
14dynablock.wirehub.net (union of all results)
13dialups.relays.osirusoft.com
13relays.osirusoft.com (result 127.0.0.3 = dialup)
8spamguard.leadmon.net (result 127.0.0.3 = spam source)
5dnsbl.njabl.org (result 127.0.0.3 = dialup)
5blackhole.compu.net
4spamsources.relays.osirusoft.com (result 127.0.0.6 = spamhaus)
3wingate.opm.blitzed.org
3blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
1blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
1ex.dnsbl.org (result 127.0.0.2 = spamsites)
1pm0-no-more.compu.net

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems. The blackhole.compu.net zone "is primarily for hosts which were not blocked by other blackhole sites and spammed compu.net" and the pm0-no-more.compu.net zone "blocks all pm0 email."


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
8149(total number of IP addresses whose names were tested, including 399 at SDSC)
1321(union of all domain zones)
964abuse.rfc-ignorant.org
858whois.rfc-ignorant.org (union of all results)
645whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
213whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
11postmaster.rfc-ignorant.org
6client-domain.sjesl.monkeys.com
5sender-domain.sjesl.monkeys.com (zone not intended for this use)
3helo-domain.sjesl.monkeys.com (zone not intended for this use)
1dsn.rfc-ignorant.org (zone not intended for this use)
1ex.dnsbl.org (result 127.0.0.2 = spamsites)
1ex.dnsbl.org (union of all results)


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
5293(total number of domains tested, including 194 at SDSC)
754(union of all domain zones)
317whois.rfc-ignorant.org (union of all results)
272abuse.rfc-ignorant.org
224whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
147postmaster.rfc-ignorant.org
136sender-domain.sjesl.monkeys.com
93whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
88helo-domain.sjesl.monkeys.com (zone not intended for this use)
59dsn.rfc-ignorant.org
57client-domain.sjesl.monkeys.com (zone not intended for this use)
30ex.dnsbl.org (union of all results)
27ex.dnsbl.org (result 127.0.0.2 = spamsites)
4bandwidth-pigs.monkeys.com
3ex.dnsbl.org (result 127.0.0.3 = spam source)


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 26 May 2002.