Blacklists Compared

17 August 2002

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the xbl.selwerd.cx zone because it is too aggressive to be widely useful, and excludes the blocktest.relays.osirusoft.com zone because it is not a blacklist.

HitsDNS Zone
7583(total number of IP addresses tested, including 426 at SDSC)
4298(union of most IP zones)
3157xbl.selwerd.cx
1841blackholes.five-ten-sg.com (union of all results)
1236bl.spamcop.net
1136no-more-funn.moensted.dk (union of all results)
1109relays.osirusoft.com (union of all results)
1025block.blars.org
826dnsbl.njabl.org (union of all results)
794dnsbl.njabl.org (result 127.0.0.2 = source or relay)
792spam.dnsrbl.net
773blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
760blackholes.wirehub.net
697blocktest.relays.osirusoft.com (not a blacklist!)
686ztl.dorkslayers.com
662no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
655cn-kr.blackholes.us (union of all results)
646unconfirmed.dsbl.org
495ipwhois.rfc-ignorant.org
486t1.bl.reynolds.net.au
477relays.osirusoft.com (result 127.0.0.4 = spam source)
464work.drbl.croco.net
447ybl.megacity.org
443cn-kr.blackholes.us (result 127.0.0.3 = Korea)
443korea.blackholes.us
442korea.services.net
438blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
434blackholes.intersil.net
414relays.osirusoft.com (result 127.0.0.2 = relay)
408inputs.relays.osirusoft.com
405list.dsbl.org
395assholes.madscience.nl
394spews.relays.osirusoft.com
351relays.ordb.org
311relays.bl.kundenserver.de
308relays.visi.com
304proxies.relays.monkeys.com
303mail-abuse.blacklist.jippg.org
278blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
266blackholes.five-ten-sg.com (result 127.0.0.3 = dialup)
235no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
215multihop.dsbl.org
212cn-kr.blackholes.us (result 127.0.0.2 = China)
212china.blackholes.us
206flowgoaway.com
201relays.osirusoft.com (result 127.0.0.9 = open proxy)
198socks.relays.osirusoft.com
198dev.null.dk
190no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
187spam.wytnij.to
179blacklist.spambag.org
170spamsources.relays.osirusoft.com (union of all results)
165orbs.dorkslayers.com
152spamsources.relays.osirusoft.com (result 127.0.0.4 = spam source)
145opm.blitzed.org
1453y.spam.mrs.kithrup.com
124http.opm.blitzed.org
116verio.blackholes.us
115spamsources.fabel.dk
103sbl.spamhaus.org
97level3.blackholes.us
95dun.dnsrbl.net
94spamhaus.relays.osirusoft.com
89cw.blackholes.us
82spamguard.leadmon.net (union of all results)
80relays.osirusoft.com (result 127.0.0.6 = spamsites)
78blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
77brazil.blackholes.us
64formmail.relays.monkeys.com
63xo.blackholes.us
63taiwan.blackholes.us
59dnsbl.delink.net
58blackhole.compu.net
55spamguard.leadmon.net (result 127.0.0.2 = dialup)
54japan.blackholes.us
40relays.dorkslayers.com
37socks.opm.blitzed.org
34argentina.blackholes.us
33dynablock.wirehub.net (result 127.0.0.2 = dialup)
33dynablock.wirehub.net (union of all results)
32dnsbl.njabl.org (result 127.0.0.3 = dialup)
32no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
28inflow.blackholes.us
24spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
23dialups.relays.osirusoft.com
21relays.osirusoft.com (result 127.0.0.3 = dialup)
19eli.blackholes.us
16spamsources.relays.osirusoft.com (result 127.0.0.6 = spamhaus)
11thailand.blackholes.us
11rackspace.blackholes.us
11broadwing.blackholes.us
10no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
7epoch.blackholes.us
7proxies.relays.osirusoft.com
6wingate.opm.blitzed.org
5blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
4valueweb.blackholes.us
4no-more-funn.moensted.dk (result 127.0.0.8 = open web form)
3spamguard.leadmon.net (result 127.0.0.3 = spam source)
3no-more-funn.moensted.dk (result 127.0.0.9 = misc)
3blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
2spamsources.relays.osirusoft.com (result 127.0.0.7 = unconfirmed opt-in)
1relays.osirusoft.com (result 127.0.0.7 = unconfirmed opt-in)
1dialup.blacklist.jippg.org (result 127.0.0.4 = dialup in Japan)
1ex.dnsbl.org (result 127.0.0.2 = spamsites)
1pm0-no-more.compu.net
1dialup.blacklist.jippg.org (union of all results)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems. The blackhole.compu.net zone "is primarily for hosts which were not blocked by other blackhole sites and spammed compu.net" and the pm0-no-more.compu.net zone "blocks all pm0 email."

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
7583(total number of IP addresses whose names were tested, including 426 at SDSC)
1356(union of all domain zones)
1039abuse.rfc-ignorant.org
426whois.rfc-ignorant.org (union of all results)
261whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
165whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
9dsn.rfc-ignorant.org (zone not intended for this use)
8postmaster.rfc-ignorant.org
4sender-domain.sjesl.monkeys.com (zone not intended for this use)
4client-domain.sjesl.monkeys.com
1helo-domain.sjesl.monkeys.com (zone not intended for this use)
1ex.dnsbl.org (result 127.0.0.2 = spamsites)
1ex.dnsbl.org (union of all results)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
5100(total number of domains tested, including 186 at SDSC)
820(union of all domain zones)
313abuse.rfc-ignorant.org
295whois.rfc-ignorant.org (union of all results)
199whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
172postmaster.rfc-ignorant.org
152sender-domain.sjesl.monkeys.com
105helo-domain.sjesl.monkeys.com (zone not intended for this use)
96whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
89dsn.rfc-ignorant.org
70client-domain.sjesl.monkeys.com (zone not intended for this use)
35ex.dnsbl.org (union of all results)
26ex.dnsbl.org (result 127.0.0.2 = spamsites)
9ex.dnsbl.org (result 127.0.0.3 = spam source)
6bandwidth-pigs.monkeys.com
1in.dnsbl.org (result 127.0.0.2 = spam source)
1in.dnsbl.org (union of all results)

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 19 August 2002.