Blacklists Compared

24 August 2002

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the xbl.selwerd.cx zone because it is too aggressive to be widely useful, and excludes the blocktest.relays.osirusoft.com zone because it is not a blacklist.

HitsDNS Zone
7934(total number of IP addresses tested, including 536 at SDSC)
4464(union of most IP zones)
3328xbl.selwerd.cx
1914blackholes.five-ten-sg.com (union of all results)
1346bl.spamcop.net
1232no-more-funn.moensted.dk (union of all results)
1100relays.osirusoft.com (union of all results)
1066block.blars.org
888blocktest.relays.osirusoft.com (not a blacklist!)
865spam.dnsrbl.net
858blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
852dnsbl.njabl.org (union of all results)
826dnsbl.njabl.org (result 127.0.0.2 = source or relay)
814blackholes.wirehub.net
739cn-kr.blackholes.us (union of all results)
738no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
696unconfirmed.dsbl.org
656ztl.dorkslayers.com
520t1.bl.reynolds.net.au
519cn-kr.blackholes.us (result 127.0.0.3 = Korea)
519korea.blackholes.us
519blackholes.intersil.net
512korea.services.net
491ipwhois.rfc-ignorant.org
449inputs.relays.osirusoft.com
446ybl.megacity.org
446relays.osirusoft.com (result 127.0.0.4 = spam source)
440relays.osirusoft.com (result 127.0.0.2 = relay)
414list.dsbl.org
412blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
410relays.ordb.org
357relays.bl.kundenserver.de
343spews.relays.osirusoft.com
342assholes.madscience.nl
324relays.visi.com
284blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
278mail-abuse.blacklist.jippg.org
270no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
267blackholes.five-ten-sg.com (result 127.0.0.3 = dialup)
263proxies.relays.monkeys.com
242multihop.dsbl.org
220cn-kr.blackholes.us (result 127.0.0.2 = China)
220china.blackholes.us
220dev.null.dk
215flowgoaway.com
212spam.wytnij.to
199blacklist.spambag.org
196verio.blackholes.us
183spamsources.relays.osirusoft.com (union of all results)
176work.drbl.croco.net
171no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
167relays.osirusoft.com (result 127.0.0.9 = open proxy)
159spamsources.relays.osirusoft.com (result 127.0.0.4 = spam source)
158socks.relays.osirusoft.com
136spamsources.fabel.dk
134orbs.dorkslayers.com
1313y.spam.mrs.kithrup.com
117relays.osirusoft.com (result 127.0.0.6 = spamsites)
116spamhaus.relays.osirusoft.com
115sbl.spamhaus.org
109xo.blackholes.us
103opm.blitzed.org
97dun.dnsrbl.net
92level3.blackholes.us
89http.opm.blitzed.org
88blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
86spamguard.leadmon.net (union of all results)
82rackspace.blackholes.us
82cw.blackholes.us
71taiwan.blackholes.us
69dnsbl.delink.net
63spamguard.leadmon.net (result 127.0.0.2 = dialup)
62formmail.relays.monkeys.com
55brazil.blackholes.us
41relays.dorkslayers.com
40japan.blackholes.us
39blackhole.compu.net
37argentina.blackholes.us
35ciberlynx.blackholes.us
31inflow.blackholes.us
30no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
27dynablock.wirehub.net (result 127.0.0.2 = dialup)
27eli.blackholes.us
27dynablock.wirehub.net (union of all results)
26dnsbl.njabl.org (result 127.0.0.3 = dialup)
22spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
21spamsources.relays.osirusoft.com (result 127.0.0.6 = spamhaus)
20dialups.relays.osirusoft.com
17socks.opm.blitzed.org
17relays.osirusoft.com (result 127.0.0.3 = dialup)
14nigeria.blackholes.us
11epoch.blackholes.us
10broadwing.blackholes.us
10no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
8thailand.blackholes.us
7no-more-funn.moensted.dk (result 127.0.0.8 = open web form)
6no-more-funn.moensted.dk (result 127.0.0.9 = misc)
5proxies.relays.osirusoft.com
3spamsources.relays.osirusoft.com (result 127.0.0.7 = unconfirmed opt-in)
3blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
2valueweb.blackholes.us
2relays.osirusoft.com (result 127.0.0.7 = unconfirmed opt-in)
2dialup.blacklist.jippg.org (result 127.0.0.3 = dialup outside Japan)
2blackholes.five-ten-sg.com (result 127.0.0.6 = relay)
2dialup.blacklist.jippg.org (union of all results)
1wingate.opm.blitzed.org
1spamsites.relays.osirusoft.com (result 127.0.0.6)
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1pm0-no-more.compu.net
1spamsites.relays.osirusoft.com (union of all results)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems. The blackhole.compu.net zone "is primarily for hosts which were not blocked by other blackhole sites and spammed compu.net" and the pm0-no-more.compu.net zone "blocks all pm0 email."

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
7934(total number of IP addresses whose names were tested, including 536 at SDSC)
1402(union of all domain zones)
1065abuse.rfc-ignorant.org
469whois.rfc-ignorant.org (union of all results)
298whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
171whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
10postmaster.rfc-ignorant.org
8dsn.rfc-ignorant.org (zone not intended for this use)
5client-domain.sjesl.monkeys.com
2sender-domain.sjesl.monkeys.com (zone not intended for this use)
1helo-domain.sjesl.monkeys.com (zone not intended for this use)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
5216(total number of domains tested, including 187 at SDSC)
831(union of all domain zones)
333abuse.rfc-ignorant.org
285whois.rfc-ignorant.org (union of all results)
179whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
171postmaster.rfc-ignorant.org
166sender-domain.sjesl.monkeys.com
108helo-domain.sjesl.monkeys.com (zone not intended for this use)
106whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
101dsn.rfc-ignorant.org
70client-domain.sjesl.monkeys.com (zone not intended for this use)
33ex.dnsbl.org (union of all results)
22ex.dnsbl.org (result 127.0.0.2 = spamsites)
11ex.dnsbl.org (result 127.0.0.3 = spam source)
7bandwidth-pigs.monkeys.com
2in.dnsbl.org (result 127.0.0.2 = spam source)
2in.dnsbl.org (union of all results)

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 26 August 2002.