Blacklists Compared

15 June 2002

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the xbl.selwerd.cx zone because it is too aggressive to be widely useful, and excludes the blocktest.relays.osirusoft.com zone because it is not a blacklist.

HitsDNS Zone
7895(total number of IP addresses tested, including 333 at SDSC)
3938(union of most IP zones)
3102xbl.selwerd.cx
1819blackholes.five-ten-sg.com (union of all results)
1120no-more-funn.moensted.dk (union of all results)
995bl.spamcop.net
964relays.osirusoft.com (union of all results)
914blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
744ztl.dorkslayers.com
736dnsbl.njabl.org (union of all results)
717dnsbl.njabl.org (result 127.0.0.2 = source or relay)
703no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
690blocktest.relays.osirusoft.com (not a blacklist!)
687block.blars.org
644unconfirmed.dsbl.org
577korea.services.net
545work.drbl.croco.net
498blackholes.intersil.net
417blackholes.wirehub.net
416relays.osirusoft.com (result 127.0.0.4 = spam source)
381ipwhois.rfc-ignorant.org
378spews.relays.osirusoft.com
376ybl.megacity.org
355list.dsbl.org
329t1.bl.reynolds.net.au
328blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
301blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
282relays.osirusoft.com (result 127.0.0.2 = relay)
275proxies.relays.monkeys.com
267inputs.relays.osirusoft.com
252relays.ordb.org
252relays.osirusoft.com (result 127.0.0.9 = open proxy)
250socks.relays.osirusoft.com
245multihop.dsbl.org
230blackholes.five-ten-sg.com (result 127.0.0.3 = dialup)
227no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
227orbs.dorkslayers.com
209blacklist.spambag.org
197relays.visi.com
177flowgoaway.com
153spamsources.fabel.dk
140no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
138spam.wytnij.to
138spamhaus.relays.osirusoft.com
133relays.osirusoft.com (result 127.0.0.6 = spamsites)
1313y.spam.mrs.kithrup.com
126opm.blitzed.org
123sbl.spamhaus.org
80http.opm.blitzed.org
68spamguard.leadmon.net (union of all results)
63spamsources.relays.osirusoft.com (union of all results)
61spamsources.relays.osirusoft.com (result 127.0.0.4 = spam source)
52socks.opm.blitzed.org
47spamguard.leadmon.net (result 127.0.0.2 = dialup)
41formmail.relays.monkeys.com
41blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
38spammers.v6net.org
32relays.dorkslayers.com
31dynablock.wirehub.net (result 127.0.0.2 = dialup)
31no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
31dynablock.wirehub.net (union of all results)
19dnsbl.njabl.org (result 127.0.0.3 = dialup)
19no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
17dialups.relays.osirusoft.com
16relays.osirusoft.com (result 127.0.0.3 = dialup)
15spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
11proxies.relays.osirusoft.com
6spamguard.leadmon.net (result 127.0.0.3 = spam source)
5blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
5blackhole.compu.net
2wingate.opm.blitzed.org
2spamsources.relays.osirusoft.com (result 127.0.0.6 = spamhaus)
1spamsites.relays.osirusoft.com (result 127.0.0.6)
1ex.dnsbl.org (result 127.0.0.2 = spamsites)
1pm0-no-more.compu.net
1spamsites.relays.osirusoft.com (union of all results)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems. The blackhole.compu.net zone "is primarily for hosts which were not blocked by other blackhole sites and spammed compu.net" and the pm0-no-more.compu.net zone "blocks all pm0 email."

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
7895(total number of IP addresses whose names were tested, including 333 at SDSC)
1257(union of all domain zones)
881abuse.rfc-ignorant.org
871whois.rfc-ignorant.org (union of all results)
641whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
230whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
11postmaster.rfc-ignorant.org
4sender-domain.sjesl.monkeys.com (zone not intended for this use)
4client-domain.sjesl.monkeys.com
3dsn.rfc-ignorant.org (zone not intended for this use)
1helo-domain.sjesl.monkeys.com (zone not intended for this use)
1ex.dnsbl.org (result 127.0.0.2 = spamsites)
1ex.dnsbl.org (union of all results)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
5312(total number of domains tested, including 142 at SDSC)
781(union of all domain zones)
302whois.rfc-ignorant.org (union of all results)
287abuse.rfc-ignorant.org
215whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
152sender-domain.sjesl.monkeys.com
135postmaster.rfc-ignorant.org
90helo-domain.sjesl.monkeys.com (zone not intended for this use)
87whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
78dsn.rfc-ignorant.org
67client-domain.sjesl.monkeys.com (zone not intended for this use)
25ex.dnsbl.org (union of all results)
21ex.dnsbl.org (result 127.0.0.2 = spamsites)
7bandwidth-pigs.monkeys.com
4ex.dnsbl.org (result 127.0.0.3 = spam source)
2in.dnsbl.org (result 127.0.0.2 = spam source)
2in.dnsbl.org (union of all results)

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 17 June 2002.