Blacklists Compared

13 July 2002

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the xbl.selwerd.cx zone because it is too aggressive to be widely useful, and excludes the blocktest.relays.osirusoft.com zone because it is not a blacklist.

HitsDNS Zone
7992(total number of IP addresses tested, including 426 at SDSC)
4230(union of most IP zones)
3189xbl.selwerd.cx
2099blackholes.five-ten-sg.com (union of all results)
1228bl.spamcop.net
1225no-more-funn.moensted.dk (union of all results)
1011spam.dnsrbl.net
847blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
823dnsbl.njabl.org (union of all results)
807ztl.dorkslayers.com
784dnsbl.njabl.org (result 127.0.0.2 = source or relay)
707block.blars.org
706no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
636unconfirmed.dsbl.org
547relays.osirusoft.com (union of all results)
535blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
510korea.services.net
504work.drbl.croco.net
496ipwhois.rfc-ignorant.org
401t1.bl.reynolds.net.au
384ybl.megacity.org
382blackholes.intersil.net
370blackholes.wirehub.net
356list.dsbl.org
328blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
321relays.ordb.org
320relays.visi.com
318relays.bl.kundenserver.de
309blackholes.five-ten-sg.com (result 127.0.0.3 = dialup)
297proxies.relays.monkeys.com
283relays.osirusoft.com (result 127.0.0.4 = spam source)
256spews.relays.osirusoft.com
245blacklist.spambag.org
243multihop.dsbl.org
237no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
215no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
187relays.osirusoft.com (result 127.0.0.2 = relay)
187inputs.relays.osirusoft.com
181dun.dnsrbl.net
180flowgoaway.com
173orbs.dorkslayers.com
1523y.spam.mrs.kithrup.com
145dev.null.dk
142opm.blitzed.org
128spam.wytnij.to
114http.opm.blitzed.org
92spamguard.leadmon.net (union of all results)
77blocktest.relays.osirusoft.com (not a blacklist!)
72blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
66spamguard.leadmon.net (result 127.0.0.2 = dialup)
63sbl.spamhaus.org
63relays.osirusoft.com (result 127.0.0.6 = spamsites)
60spamhaus.relays.osirusoft.com
60spamsources.relays.osirusoft.com (union of all results)
55socks.relays.osirusoft.com
55relays.osirusoft.com (result 127.0.0.9 = open proxy)
50spamsources.relays.osirusoft.com (result 127.0.0.4 = spam source)
49dynablock.wirehub.net (result 127.0.0.2 = dialup)
49dynablock.wirehub.net (union of all results)
47formmail.relays.monkeys.com
40socks.opm.blitzed.org
39dnsbl.njabl.org (result 127.0.0.3 = dialup)
39no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
36spammers.v6net.org
28no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
28relays.dorkslayers.com
19dialups.relays.osirusoft.com
18relays.osirusoft.com (result 127.0.0.3 = dialup)
18spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
18blackhole.compu.net
10spamsources.relays.osirusoft.com (result 127.0.0.6 = spamhaus)
8spamguard.leadmon.net (result 127.0.0.3 = spam source)
5blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
3blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
2wingate.opm.blitzed.org
2proxies.relays.osirusoft.com
1spamsites.relays.osirusoft.com (result 127.0.0.6)
1ex.dnsbl.org (result 127.0.0.2 = spamsites)
1pm0-no-more.compu.net
1spamsites.relays.osirusoft.com (union of all results)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems. The blackhole.compu.net zone "is primarily for hosts which were not blocked by other blackhole sites and spammed compu.net" and the pm0-no-more.compu.net zone "blocks all pm0 email."

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
7992(total number of IP addresses whose names were tested, including 426 at SDSC)
1288(union of all domain zones)
945abuse.rfc-ignorant.org
453whois.rfc-ignorant.org (union of all results)
273whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
180whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
7postmaster.rfc-ignorant.org
5client-domain.sjesl.monkeys.com
4dsn.rfc-ignorant.org (zone not intended for this use)
4sender-domain.sjesl.monkeys.com (zone not intended for this use)
2helo-domain.sjesl.monkeys.com (zone not intended for this use)
1ex.dnsbl.org (result 127.0.0.2 = spamsites)
1ex.dnsbl.org (union of all results)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
5215(total number of domains tested, including 224 at SDSC)
758(union of all domain zones)
310abuse.rfc-ignorant.org
262whois.rfc-ignorant.org (union of all results)
187whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
145sender-domain.sjesl.monkeys.com
144postmaster.rfc-ignorant.org
93helo-domain.sjesl.monkeys.com (zone not intended for this use)
75whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
73dsn.rfc-ignorant.org
68client-domain.sjesl.monkeys.com (zone not intended for this use)
27ex.dnsbl.org (union of all results)
19ex.dnsbl.org (result 127.0.0.2 = spamsites)
8ex.dnsbl.org (result 127.0.0.3 = spam source)
5bandwidth-pigs.monkeys.com
2in.dnsbl.org (result 127.0.0.2 = spam source)
2in.dnsbl.org (union of all results)

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 15 July 2002.