Blacklists Compared

3 August 2002

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the xbl.selwerd.cx zone because it is too aggressive to be widely useful, and excludes the blocktest.relays.osirusoft.com zone because it is not a blacklist.

HitsDNS Zone
7627(total number of IP addresses tested, including 439 at SDSC)
4277(union of most IP zones)
2995xbl.selwerd.cx
1856blackholes.five-ten-sg.com (union of all results)
1468bl.spamcop.net
1148relays.osirusoft.com (union of all results)
1009no-more-funn.moensted.dk (union of all results)
910block.blars.org
800dnsbl.njabl.org (union of all results)
797spam.dnsrbl.net
775dnsbl.njabl.org (result 127.0.0.2 = source or relay)
726blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
679ztl.dorkslayers.com
628unconfirmed.dsbl.org
609no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
607blackholes.wirehub.net
606cn-kr.blackholes.us (union of all results)
500blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
499relays.osirusoft.com (result 127.0.0.4 = spam source)
486t1.bl.reynolds.net.au
448ybl.megacity.org
445ipwhois.rfc-ignorant.org
429inputs.relays.osirusoft.com
428relays.osirusoft.com (result 127.0.0.2 = relay)
411cn-kr.blackholes.us (result 127.0.0.3 = Korea)
411korea.blackholes.us
403list.dsbl.org
401korea.services.net
400spews.relays.osirusoft.com
382blackholes.intersil.net
350work.drbl.croco.net
329relays.visi.com
329relays.bl.kundenserver.de
318assholes.madscience.nl
310relays.ordb.org
303blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
280mail-abuse.blacklist.jippg.org
265proxies.relays.monkeys.com
264blocktest.relays.osirusoft.com (not a blacklist!)
256blackholes.five-ten-sg.com (result 127.0.0.3 = dialup)
214blacklist.spambag.org
206flowgoaway.com
199no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
196multihop.dsbl.org
195cn-kr.blackholes.us (result 127.0.0.2 = China)
195china.blackholes.us
180relays.osirusoft.com (result 127.0.0.9 = open proxy)
174spamsources.relays.osirusoft.com (union of all results)
173socks.relays.osirusoft.com
164no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
162orbs.dorkslayers.com
160spam.wytnij.to
156verio.blackholes.us
154dev.null.dk
145spamsources.relays.osirusoft.com (result 127.0.0.4 = spam source)
1433y.spam.mrs.kithrup.com
123opm.blitzed.org
117spamsources.fabel.dk
115dun.dnsrbl.net
100sbl.spamhaus.org
99relays.osirusoft.com (result 127.0.0.6 = spamsites)
95spamhaus.relays.osirusoft.com
90http.opm.blitzed.org
88xo.blackholes.us
74spamguard.leadmon.net (union of all results)
72taiwan.blackholes.us
68brazil.blackholes.us
63blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
58japan.blackholes.us
55spamguard.leadmon.net (result 127.0.0.2 = dialup)
45socks.opm.blitzed.org
42rackspace.blackholes.us
41inflow.blackholes.us
35argentina.blackholes.us
35formmail.relays.monkeys.com
32dynablock.wirehub.net (result 127.0.0.2 = dialup)
32dynablock.wirehub.net (union of all results)
31blackhole.compu.net
30dialups.relays.osirusoft.com
29relays.osirusoft.com (result 127.0.0.3 = dialup)
27relays.dorkslayers.com
25dnsbl.njabl.org (result 127.0.0.3 = dialup)
23eli.blackholes.us
22no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
20spammers.v6net.org
18spamsources.relays.osirusoft.com (result 127.0.0.6 = spamhaus)
16broadwing.blackholes.us
15spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
11epoch.blackholes.us
11spamsources.relays.osirusoft.com (result 127.0.0.7 = unconfirmed opt-in)
10relays.osirusoft.com (result 127.0.0.7 = unconfirmed opt-in)
9no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
8spamsites.relays.osirusoft.com (result 127.0.0.6)
8spamsites.relays.osirusoft.com (union of all results)
7blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
6proxies.relays.osirusoft.com
5dialup.blacklist.jippg.org (result 127.0.0.3 = dialup outside Japan)
5dialup.blacklist.jippg.org (union of all results)
4valueweb.blackholes.us
4wingate.opm.blitzed.org
4spamguard.leadmon.net (result 127.0.0.3 = spam source)
3no-more-funn.moensted.dk (result 127.0.0.9 = misc)
3no-more-funn.moensted.dk (result 127.0.0.8 = open web form)
2dnsbl.delink.net
1blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
1ex.dnsbl.org (result 127.0.0.2 = spamsites)
1pm0-no-more.compu.net

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems. The blackhole.compu.net zone "is primarily for hosts which were not blocked by other blackhole sites and spammed compu.net" and the pm0-no-more.compu.net zone "blocks all pm0 email."

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
7627(total number of IP addresses whose names were tested, including 439 at SDSC)
1307(union of all domain zones)
996abuse.rfc-ignorant.org
401whois.rfc-ignorant.org (union of all results)
249whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
152whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
10postmaster.rfc-ignorant.org
10client-domain.sjesl.monkeys.com
9dsn.rfc-ignorant.org (zone not intended for this use)
7sender-domain.sjesl.monkeys.com (zone not intended for this use)
6helo-domain.sjesl.monkeys.com (zone not intended for this use)
1ex.dnsbl.org (result 127.0.0.2 = spamsites)
1ex.dnsbl.org (union of all results)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
5170(total number of domains tested, including 231 at SDSC)
747(union of all domain zones)
307abuse.rfc-ignorant.org
209whois.rfc-ignorant.org (union of all results)
174postmaster.rfc-ignorant.org
166sender-domain.sjesl.monkeys.com
130whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
109helo-domain.sjesl.monkeys.com (zone not intended for this use)
90dsn.rfc-ignorant.org
79whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
72client-domain.sjesl.monkeys.com (zone not intended for this use)
29ex.dnsbl.org (union of all results)
21ex.dnsbl.org (result 127.0.0.2 = spamsites)
8ex.dnsbl.org (result 127.0.0.3 = spam source)
6bandwidth-pigs.monkeys.com

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 5 August 2002.