Blacklists Compared

17 November 2001

[ Fighting Spam | Blacklists Compared | Current Blacklist Comparison ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the xbl.selwerd.cx zone because it is too aggressive to be widely useful, and excludes the blocktest.relays.osirusoft.com zone because it is not a blacklist.

  Hits   DNS Zone
  6287  (total number of IP addresses tested, including 275 at SDSC)
  1951  (union of most IP zones)
  1617  xbl.selwerd.cx
  1281  blocktest.relays.osirusoft.com (not a blacklist!)
   889  bl.spamcop.net
   774  blackholes.five-ten-sg.com (union of all results)
   570  relays.osirusoft.com (union of all results)
   532  outputs.orbz.org
   397  relays.ordb.org
   362  inputs.orbz.org
   359  blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
   331  relays.osirusoft.com (result 127.0.0.2 = relay)
   329  inputs.relays.osirusoft.com
   292  ztl.dorkslayers.com
   275  blackholes.intersil.net
   229  blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
   221  block.blars.org
   215  relays.osirusoft.com (result 127.0.0.4 = spam source)
   206  orbs.dorkslayers.com
   141  flowgoaway.com
   136  spews.relays.osirusoft.com
   134  pm0-no-more.compu.net
   121  blackholes.five-ten-sg.com (result 127.0.0.3 = dialup)
   111  dev.null.dk
   107  relays.dorkslayers.com
   101  spamsources.relays.osirusoft.com (union of all results)
    94  relays.visi.com
    93  spamsources.relays.osirusoft.com (result 127.0.0.4 = spam source)
    76  spammers.v6net.org
    60  ipwhois.rfc-ignorant.org
    37  ss.blackholes.five-ten-sg.com
    26  blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
    24  blackhole.compu.net
    22  dialups.relays.osirusoft.com
    22  relays.osirusoft.com (result 127.0.0.3 = dialup)
     9  relays.osirusoft.com (result 127.0.0.6 = spamsites)
     7  spamhaus.relays.osirusoft.com
     6  blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
     5  spamsources.relays.osirusoft.com (result 127.0.0.6 = spamhaus)
     5  orbz.gst-group.co.uk (union of all results)
     3  spamsources.relays.osirusoft.com (result 127.0.0.9 = unconfirmed opt-in)
     3  relays.osirusoft.com (result 127.0.0.9 = open socks proxy)
     2  orbz.gst-group.co.uk (result 127.0.0.3 = relay)
     2  orbz.gst-group.co.uk (result 127.0.0.2 = relay output)
     1  orbz.gst-group.co.uk (result 127.0.0.127 = no abuse mailbox)
     1  spamsites.relays.osirusoft.com (result 127.0.0.6)
     1  blackholes.five-ten-sg.com (result 127.0.0.6 = relay)
     1  spamsites.relays.osirusoft.com (union of all results)
Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

  Hits   DNS Zone
  6287  (total number of IP addresses whose names were tested, including 275 at SDSC)
   473  (union of all domain zones)
   312  whois.rfc-ignorant.org
   200  abuse.rfc-ignorant.org
     4  dsn.rfc-ignorant.org
     1  postmaster.rfc-ignorant.org
Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

  Hits   DNS Zone
  4432  (total number of domains tested, including 78 at SDSC)
   346  (union of all domain zones)
   184  whois.rfc-ignorant.org
   101  abuse.rfc-ignorant.org
    71  postmaster.rfc-ignorant.org
    44  dsn.rfc-ignorant.org
The web sites listed below provide detailed information about the DNS zones listed above, including their listing policies and suggestions for appropriate use.

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems. The blackhole.compu.net zone "is primarily for hosts which were not blocked by other blackhole sites and spammed compu.net" and the pm0-no-more.compu.net zone "blocks all pm0 email."

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 18 November 2001.