Blacklists Compared

2 November 2002

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the xbl.selwerd.cx zone because it is too aggressive to be widely useful, and excludes the blocktest.relays.osirusoft.com zone because it is not a blacklist.

HitsDNS Zone
8962(total number of IP addresses tested, including 476 at SDSC)
5615(union of most IP zones)
3899xbl.selwerd.cx
2775blackholes.five-ten-sg.com (union of all results)
1532block.blars.org
1515relays.osirusoft.com (union of all results)
1459blackholes.wirehub.net
1423no-more-funn.moensted.dk (union of all results)
1215bl.spamcop.net
1087blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
1010ztl.dorkslayers.com
993work.drbl.croco.net
842ipwhois.rfc-ignorant.org
817dnsbl.njabl.org (union of all results)
806cn-kr.blackholes.us (union of all results)
796no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
772relays.osirusoft.com (result 127.0.0.4 = spam source)
766cw.blackholes.us
711unconfirmed.dsbl.org
684blackholes.intersil.net
625blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
595vox.schpider.com
589spam.dnsrbl.net
567blackholes.five-ten-sg.com (result 127.0.0.3 = dialup)
548proxies.relays.monkeys.com
512spews.relays.osirusoft.com
504ybl.megacity.org
495cn-kr.blackholes.us (result 127.0.0.3 = Korea)
495korea.blackholes.us
492korea.services.net
481blackholes.uceb.org (union of all results)
430dnsbl.njabl.org (result 127.0.0.2 = source or relay)
403spamsources.relays.osirusoft.com (union of all results)
392t1.bl.reynolds.net.au
392list.dsbl.org
384blocktest.relays.osirusoft.com (not a blacklist!)
373blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
372spamsources.relays.osirusoft.com (result 127.0.0.4 = spam source)
328relays.osirusoft.com (result 127.0.0.9 = open proxy)
321socks.relays.osirusoft.com
313assholes.madscience.nl
311cn-kr.blackholes.us (result 127.0.0.2 = China)
311china.blackholes.us
309relays.osirusoft.com (result 127.0.0.2 = relay)
309inputs.relays.osirusoft.com
302no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
301dnsbl.njabl.org (result 127.0.0.4 = spam source)
298blackholes.uceb.org (result 127.0.0.4 = spam organization)
291mail-abuse.blacklist.jippg.org
285multihop.dsbl.org
274sbl.spamhaus.org
269relays.osirusoft.com (result 127.0.0.6 = spamsites)
265spamhaus.relays.osirusoft.com
261spamsources.fabel.dk
255relays.bl.kundenserver.de
249no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
240spam.wytnij.to
225blacklist.spambag.org
221flowgoaway.com
220relays.ordb.org
206dnsbl.delink.net
204opm.blitzed.org
202relays.visi.com
168verio.blackholes.us
164brazil.blackholes.us
162http.opm.blitzed.org
1583y.spam.mrs.kithrup.com
149orbs.dorkslayers.com
135dev.null.dk
109blackholes.uceb.org (result 127.0.0.3 = spam source)
105internap.blackholes.us
103level3.blackholes.us
100blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
100spamguard.leadmon.net (union of all results)
99blackholes.uceb.org (result 127.0.0.2 = relay)
98dialups.visi.com
95dun.dnsrbl.net
87taiwan.blackholes.us
87spamguard.leadmon.net (result 127.0.0.2 = dialup)
86rr.blackholes.us
78blackhole.compu.net
77xo.blackholes.us
67rackspace.blackholes.us
64socks.opm.blitzed.org
62dnsbl.njabl.org (result 127.0.0.3 = dialup)
61ciberlynx.blackholes.us
58formmail.relays.monkeys.com
58no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
57japan.blackholes.us
53dialups.relays.osirusoft.com (union of all results)
49argentina.blackholes.us
43dialups.relays.osirusoft.com (result 127.0.0.3 = dialup)
42dynablock.wirehub.net (result 127.0.0.2 = dialup)
42dynablock.wirehub.net (union of all results)
38inflow.blackholes.us
38inflow.noflow.org
37relays.osirusoft.com (result 127.0.0.3 = dialup)
35russia.blackholes.us
29cybercon.blackholes.us
28singapore.blackholes.us
28hongkong.blackholes.us
25spamsources.relays.osirusoft.com (result 127.0.0.6 = spamhaus)
24nigeria.blackholes.us
23yipes.blackholes.us
23above.blackholes.us
22relays.dorkslayers.com
21interbusiness.blackholes.us
19eli.blackholes.us
19spam.exsilia.net (result 127.0.0.2 = spam source)
19spam.exsilia.net (union of all results)
18dnsbl.njabl.org (result 127.0.0.9 = open proxy)
17malaysia.blackholes.us
17blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
16he.blackholes.us
14covad.blackholes.us
12valuenet.blackholes.us
12spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
11broadwing.blackholes.us
10pajo.blackholes.us
10epoch.blackholes.us
10dialups.relays.osirusoft.com (result 127.0.0.4 = no reverse DNS)
9dialup.blacklist.jippg.org (result 127.0.0.3 = dialup outside Japan)
9dialup.blacklist.jippg.org (union of all results)
8wanadoo-fr.blackholes.us
8no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
7proxies.relays.osirusoft.com
7no-more-funn.moensted.dk (result 127.0.0.8 = open web form)
5thailand.blackholes.us
5blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
4wingate.opm.blitzed.org
4spamsources.relays.osirusoft.com (result 127.0.0.9 = unconfirmed opt-in)
4dnsbl.njabl.org (result 127.0.0.5 = relay output)
3spamsources.relays.osirusoft.com (result 127.0.0.7 = unconfirmed opt-in)
3relays.osirusoft.com (result 127.0.0.5 = relay output)
3no-more-funn.moensted.dk (result 127.0.0.9 = misc)
2dnsbl.njabl.org (result 127.0.0.8 = open formmail.cgi)
1skynetweb.blackholes.us
1spamsites.relays.osirusoft.com (result 127.0.0.6)
1relays.osirusoft.com (result 127.0.0.7 = unconfirmed opt-in)
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1blackholes.five-ten-sg.com (result 127.0.0.6 = relay)
1spamsites.relays.osirusoft.com (union of all results)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems. The blackhole.compu.net zone "is primarily for hosts which were not blocked by other blackhole sites and spammed compu.net."

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
8962(total number of IP addresses whose names were tested, including 476 at SDSC)
1740(union of all domain zones)
1375abuse.rfc-ignorant.org
510whois.rfc-ignorant.org (union of all results)
303whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
207whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
8postmaster.rfc-ignorant.org
7dsn.rfc-ignorant.org (zone not intended for this use)
7client-domain.sjesl.monkeys.com
4sender-domain.sjesl.monkeys.com (zone not intended for this use)
3helo-domain.sjesl.monkeys.com (zone not intended for this use)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
6069(total number of domains tested, including 219 at SDSC)
1084(union of all domain zones)
455abuse.rfc-ignorant.org
398whois.rfc-ignorant.org (union of all results)
312whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
202postmaster.rfc-ignorant.org
178sender-domain.sjesl.monkeys.com
119dsn.rfc-ignorant.org
115helo-domain.sjesl.monkeys.com (zone not intended for this use)
86whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
78client-domain.sjesl.monkeys.com (zone not intended for this use)
32ex.dnsbl.org (union of all results)
27ex.dnsbl.org (result 127.0.0.2 = spamsites)
9bandwidth-pigs.monkeys.com
5ex.dnsbl.org (result 127.0.0.3 = spam source)
2in.dnsbl.org (union of all results)
1in.dnsbl.org (result 127.0.0.2 = spam source)
1in.dnsbl.org (result 127.0.0.6 = unconfirmed opt-in)

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 5 November 2002.