Blacklists Compared

15 September 2001

[ Fighting Spam | Blacklists Compared | Current Blacklist Comparison ]

Survey results for all known public IP-based DNS blacklists.

  Hits   DNS Zone
  5496  (total number of IP addresses tested, including 263 at SDSC)
  1160  xbl.selwerd.cx
  1136  (union of all IP zones except xbl.selwerd.cx)
   542  outputs.orbz.org
   351  relays.ordb.org
   336  inputs.orbz.org
   288  blackholes.five-ten-sg.com (union of all results)
   230  relays.osirusoft.com (union of all results)
   221  relays.mail-abuse.org
   184  relays.osirusoft.com (result 127.0.0.2 = relay)
   184  inputs.relays.osirusoft.com
   157  blackholes.intersil.net
   155  blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
   152  orbs.dorkslayers.com
   148  ztl.dorkslayers.com
   142  relays.dorkslayers.com
   120  dev.null.dk
   105  flowgoaway.com
   103  block.blars.org
    96  blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
    51  spammers.v6net.org
    36  relays.osirusoft.com (result 127.0.0.4 = spam source)
    33  spews.relays.osirusoft.com
    33  blocktest.relays.osirusoft.com (not a blacklist!)
    33  blackholes.five-ten-sg.com (result 127.0.0.3 = dialup)
    12  ipwhois.rfc-ignorant.org
     8  dialups.mail-abuse.org
     5  relays.osirusoft.com (result 127.0.0.6 = spamware vendor)
     5  dialups.relays.osirusoft.com
     5  relays.osirusoft.com (result 127.0.0.3 = dialup)
     4  spamsites.relays.osirusoft.com
     4  blackholes.five-ten-sg.com (result 127.0.0.5 = should be listed at MAPS)
     3  blackholes.mail-abuse.org
     3  spamhaus.relays.osirusoft.com
     3  orbz.gst-group.co.uk (union of all results)
     2  orbz.gst-group.co.uk (result 127.0.0.3 = relay)
     1  orbz.gst-group.co.uk (result 127.0.0.2 = relay output)
Survey results for all known public domain-name-based DNS blacklists.

  Hits   DNS Zone
  3971  (total number of domains tested, including 178 at SDSC)
   214  (union of all domain zones)
   142  whois.rfc-ignorant.org
    33  postmaster.rfc-ignorant.org
    33  abuse.rfc-ignorant.org
    28  dsn.rfc-ignorant.org
The web sites listed below provide detailed information about the DNS zones listed above, including their listing policies.

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems.

The DNS lists maintained at the 4 sites marked with an asterisk ("*") were suspended after the destruction of the World Trade Center to avoid any collateral blocking of communications by the survivors. All of the lists have already returned to normal except ORBL, which is why there were no hits in it this week.

The XBL is excluded from the zone union because of of its extremely aggressive listing policy, but otherwise is shown for completeness.

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 16 September 2001.