Blacklists Compared

3 November 2001

[ Fighting Spam | Blacklists Compared | Current Blacklist Comparison ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the xbl.selwerd.cx zone because it is too aggressive to be widely useful, and excludes the blocktest.relays.osirusoft.com zone because it is not a blacklist.

There were intermittent difficulties getting results from all of the relays.osirusoft.com zones during the survey this week, so their hit counts are lower than they would otherwise be.

  Hits   DNS Zone
  6404  (total number of IP addresses tested, including 286 at SDSC)
  1820  (union of most IP zones)
  1677  xbl.selwerd.cx
   722  blackholes.five-ten-sg.com (union of all results)
   704  outputs.orbz.org
   638  blocktest.relays.osirusoft.com (not a blacklist!)
   539  relays.ordb.org
   507  inputs.orbz.org
   370  relays.osirusoft.com (union of all results)
   362  blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
   298  ztl.dorkslayers.com
   276  relays.osirusoft.com (result 127.0.0.2 = relay)
   263  orbs.dorkslayers.com
   254  blackholes.intersil.net
   232  block.blars.org
   203  blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
   152  dev.null.dk
   149  inputs.relays.osirusoft.com
   136  flowgoaway.com
   133  relays.dorkslayers.com
   105  blackholes.five-ten-sg.com (result 127.0.0.3 = dialup)
    86  relays.osirusoft.com (result 127.0.0.4 = spam source)
    75  spammers.v6net.org
    58  spews.relays.osirusoft.com
    51  ipwhois.rfc-ignorant.org
    42  blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
    33  blackhole.compu.net
    24  spamsources.relays.osirusoft.com (result 127.0.0.4 = spam source)
    24  spamsources.relays.osirusoft.com (union of all results)
    13  dialups.relays.osirusoft.com
     9  relays.osirusoft.com (result 127.0.0.3 = dialup)
     9  blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
     7  orbz.gst-group.co.uk (union of all results)
     5  orbz.gst-group.co.uk (result 127.0.0.3 = relay)
     2  orbz.gst-group.co.uk (result 127.0.0.2 = relay output)
     2  spamhaus.relays.osirusoft.com
     1  spamsites.relays.osirusoft.com (result 127.0.0.6)
     1  blackholes.five-ten-sg.com (result 127.0.0.6 = relay)
     1  spamsites.relays.osirusoft.com (union of all results)
Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

  Hits   DNS Zone
  6404  (total number of IP addresses whose names were tested, including 286 at SDSC)
   412  (union of all domain zones)
   294  whois.rfc-ignorant.org
   150  abuse.rfc-ignorant.org
     5  postmaster.rfc-ignorant.org
     1  dsn.rfc-ignorant.org
Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

  Hits   DNS Zone
  4372  (total number of domains tested, including 55 at SDSC)
   303  (union of all domain zones)
   187  whois.rfc-ignorant.org
    62  abuse.rfc-ignorant.org
    50  postmaster.rfc-ignorant.org
    47  dsn.rfc-ignorant.org
The web sites listed below provide detailed information about the DNS zones listed above, including their listing policies.

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems.

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 3 November 2001.