Blacklists Compared

18 January 2003

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the xbl.selwerd.cx zone because it is too aggressive to be widely useful, and excludes the blocktest.relays.osirusoft.com zone because it is not a blacklist.

HitsDNS Zone
9776(total number of IP addresses tested, including 464 at SDSC)
6052(union of most IP zones)
4367xbl.selwerd.cx
3435blackholes.five-ten-sg.com (union of all results)
1968blackholes.wirehub.net
1953relays.osirusoft.com (union of all results)
1927no-more-funn.moensted.dk (union of all results)
1618block.blars.org
1153assholes.madscience.nl
1137blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
1135blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
1125bl.spamcop.net
1110unconfirmed.dsbl.org
1038ztl.dorkslayers.com
1014blackholes.intersil.net
985sbl.spamhaus.org
972no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
970spamhaus.relays.osirusoft.com
959cn-kr.blackholes.us (union of all results)
952relays.osirusoft.com (result 127.0.0.4 = spam source)
929relays.osirusoft.com (result 127.0.0.6 = spamsites)
880list.dsbl.org
869spews.relays.osirusoft.com
865dnsbl.njabl.org (union of all results)
752blocktest.relays.osirusoft.com (not a blacklist!)
734blackholes.five-ten-sg.com (result 127.0.0.3 = dialup)
717ipwhois.rfc-ignorant.org
628cw.blackholes.us
624proxies.relays.monkeys.com
624dnsbl.sorbs.net (union of all results)
595spam.dnsrbl.net
589cn-kr.blackholes.us (result 127.0.0.3 = Korea)
589korea.blackholes.us
587korea.services.net
541t1.bl.reynolds.net.au
530ybl.megacity.org
502dnsbl.njabl.org (result 127.0.0.4 = spam source)
492dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
453work.drbl.croco.net
431spamsources.fabel.dk
413blackholes.uceb.org (union of all results)
370cn-kr.blackholes.us (result 127.0.0.2 = China)
370china.blackholes.us
364opm.blitzed.org
359spamsources.relays.osirusoft.com (union of all results)
348spamsources.relays.osirusoft.com (result 127.0.0.4 = spam source)
343blacklist.spambag.org
340no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
336relays.osirusoft.com (result 127.0.0.9 = open proxy)
332blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
324socks.relays.osirusoft.com
324no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
304http.opm.blitzed.org
292dnsbl.njabl.org (result 127.0.0.2 = source or relay)
288dnsbl.delink.net
279spam.wytnij.to
277relays.osirusoft.com (result 127.0.0.2 = relay)
277inputs.relays.osirusoft.com
263rackspace.blackholes.us
263blackholes.uceb.org (result 127.0.0.4 = spam organization)
219flowgoaway.com
216mail-abuse.blacklist.jippg.org
204multihop.dsbl.org
201dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
187verio.blackholes.us
183no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
165relays.bl.kundenserver.de
1533y.spam.mrs.kithrup.com
135brazil.blackholes.us
127relays.ordb.org
119internap.blackholes.us
105taiwan.blackholes.us
103blackholes.uceb.org (result 127.0.0.3 = spam source)
98socks.opm.blitzed.org
97spamguard.leadmon.net (union of all results)
89spamguard.leadmon.net (result 127.0.0.2 = dialup)
89blackhole.compu.net
83xo.blackholes.us
82rr.blackholes.us
79dun.dnsrbl.net
77orbs.dorkslayers.com
74dynablock.wirehub.net (result 127.0.0.2 = dialup)
74level3.blackholes.us
74dynablock.wirehub.net (union of all results)
73vox.schpider.com
65japan.blackholes.us
61blackholes.uceb.org (result 127.0.0.2 = relay)
60dialups.relays.osirusoft.com (union of all results)
59dnsbl.njabl.org (result 127.0.0.3 = dialup)
58blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
57blackholes.brainerd.net
56dialups.visi.com
55dialups.relays.osirusoft.com (result 127.0.0.3 = dialup)
54formmail.relays.monkeys.com
50no-more-funn.moensted.dk (result 127.0.0.9 = misc)
47russia.blackholes.us
47tr.countries.nerd.dk
40spam.exsilia.net (result 127.0.0.2 = spam source)
40spam.exsilia.net (union of all results)
38relays.osirusoft.com (result 127.0.0.3 = dialup)
36argentina.blackholes.us
34hongkong.blackholes.us
32no-more-funn.moensted.dk (result 127.0.0.8 = open web form)
31inflow.blackholes.us
31proxies.relays.osirusoft.com
31inflow.noflow.org
30dnsbl.sorbs.net (result 127.0.0.6 = spam source)
28interbusiness.blackholes.us
24above.blackholes.us
23blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
22spammers.v6net.org
22no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
21singapore.blackholes.us
21eli.blackholes.us
21cybercon.blackholes.us
20dev.null.dk
19nigeria.blackholes.us
18ciberlynx.blackholes.us
17relays.dorkslayers.com
16he.blackholes.us
16blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
15covad.blackholes.us
13thailand.blackholes.us
12valuenet.blackholes.us
12pajo.blackholes.us
12broadwing.blackholes.us
10ph.rbl.cluecentral.net
9malaysia.blackholes.us
9affinity.blackholes.us
9dnsbl.njabl.org (result 127.0.0.9 = open proxy)
8epoch.blackholes.us
8dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
7yipes.blackholes.us
7wanadoo-fr.blackholes.us
7valueweb.blackholes.us
7spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
6spamsources.relays.osirusoft.com (result 127.0.0.7 = unconfirmed opt-in)
6relays.osirusoft.com (result 127.0.0.7 = unconfirmed opt-in)
5spamsources.relays.osirusoft.com (result 127.0.0.6 = spamhaus)
5dialups.relays.osirusoft.com (result 127.0.0.4 = no reverse DNS)
3wingate.opm.blitzed.org
3spamsites.relays.osirusoft.com (result 127.0.0.6)
3no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
3proxies.exsilia.net
3spamsites.relays.osirusoft.com (union of all results)
3dialup.blacklist.jippg.org (union of all results)
2spews.bl.reynolds.net.au
2dnsbl.njabl.org (result 127.0.0.8 = open formmail.cgi)
2dialup.blacklist.jippg.org (result 127.0.0.3 = dialup outside Japan)
1skynetweb.blackholes.us
1dnsbl.sorbs.net (result 127.0.0.5 = open relay)
1dnsbl.sorbs.net (result 127.0.0.7 = open formmail.cgi)
1dnsbl.njabl.org (result 127.0.0.5 = relay output)
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1dialup.blacklist.jippg.org (result 127.0.0.4 = dialup in Japan)
1no-more-funn.moensted.dk (result 127.0.0.11 = repeated probes)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems. The blackhole.compu.net zone "is primarily for hosts which were not blocked by other blackhole sites and spammed compu.net."

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
9776(total number of IP addresses whose names were tested, including 464 at SDSC)
1621(union of all domain zones)
1326abuse.rfc-ignorant.org
961whois.rfc-ignorant.org (union of all results)
709whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
252whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
15dsn.rfc-ignorant.org (zone not intended for this use)
13postmaster.rfc-ignorant.org

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
6456(total number of domains tested, including 228 at SDSC)
1007(union of all domain zones)
490abuse.rfc-ignorant.org
378whois.rfc-ignorant.org (union of all results)
298whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
263postmaster.rfc-ignorant.org
180dsn.rfc-ignorant.org
80whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
24ex.dnsbl.org (union of all results)
20ex.dnsbl.org (result 127.0.0.2 = spamsites)
7bandwidth-pigs.monkeys.com
4ex.dnsbl.org (result 127.0.0.3 = spam source)
2in.dnsbl.org (union of all results)
1in.dnsbl.org (result 127.0.0.2 = spam source)
1in.dnsbl.org (result 127.0.0.6 = unconfirmed opt-in)

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 21 January 2003.