Blacklists Compared

10 November 2001

[ Fighting Spam | Blacklists Compared | Current Blacklist Comparison ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the xbl.selwerd.cx zone because it is too aggressive to be widely useful, and excludes the blocktest.relays.osirusoft.com zone because it is not a blacklist.

There were intermittent difficulties getting results from the new ss.blackholes.five-ten-sg.com zone during the survey this week, so its hit count is lower than it would otherwise be.

  Hits   DNS Zone
  6512  (total number of IP addresses tested, including 283 at SDSC)
  2088  (union of most IP zones)
  1695  xbl.selwerd.cx
  1333  blocktest.relays.osirusoft.com (not a blacklist!)
   975  bl.spamcop.net
   741  blackholes.five-ten-sg.com (union of all results)
   682  outputs.orbz.org
   673  relays.osirusoft.com (union of all results)
   530  relays.ordb.org
   500  inputs.orbz.org
   439  relays.osirusoft.com (result 127.0.0.2 = relay)
   438  inputs.relays.osirusoft.com
   372  blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
   288  ztl.dorkslayers.com
   247  blackholes.intersil.net
   225  block.blars.org
   220  orbs.dorkslayers.com
   215  relays.osirusoft.com (result 127.0.0.4 = spam source)
   199  blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
   131  spews.relays.osirusoft.com
   130  flowgoaway.com
   129  dev.null.dk
   123  blackholes.five-ten-sg.com (result 127.0.0.3 = dialup)
   119  pm0-no-more.compu.net
    96  spamsources.relays.osirusoft.com (union of all results)
    95  relays.dorkslayers.com
    93  spamsources.relays.osirusoft.com (result 127.0.0.4 = spam source)
    78  spammers.v6net.org
    54  ipwhois.rfc-ignorant.org
    37  blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
    28  blackhole.compu.net
    24  dialups.relays.osirusoft.com
    24  relays.osirusoft.com (result 127.0.0.3 = dialup)
    13  ss.blackholes.five-ten-sg.com
     9  blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
     8  relays.osirusoft.com (result 127.0.0.6 = spamsites)
     7  orbz.gst-group.co.uk (union of all results)
     6  spamhaus.relays.osirusoft.com
     4  orbz.gst-group.co.uk (result 127.0.0.3 = relay)
     3  orbz.gst-group.co.uk (result 127.0.0.2 = relay output)
     3  spamsources.relays.osirusoft.com (result 127.0.0.6 = spamhaus)
     2  spamsites.relays.osirusoft.com (result 127.0.0.6)
     2  spamsites.relays.osirusoft.com (union of all results)
Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

  Hits   DNS Zone
  6512  (total number of IP addresses whose names were tested, including 283 at SDSC)
   457  (union of all domain zones)
   310  whois.rfc-ignorant.org
   185  abuse.rfc-ignorant.org
     4  postmaster.rfc-ignorant.org
Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

  Hits   DNS Zone
  4543  (total number of domains tested, including 82 at SDSC)
   328  (union of all domain zones)
   187  whois.rfc-ignorant.org
    85  abuse.rfc-ignorant.org
    62  postmaster.rfc-ignorant.org
    41  dsn.rfc-ignorant.org
The web sites listed below provide detailed information about the DNS zones listed above, including their listing policies and suggestions for appropriate use.

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems. The blackhole.compu.net zone "is primarily for hosts which were not blocked by other blackhole sites and spammed compu.net" and the pm0-no-more.compu.net zone "blocks all pm0 email."

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 11 November 2001.