University of Tuzla
The distribution of malicious hosts over the IP address space is far from being uniform. In fact, malicious hosts tend to be concentrated in certain portions of the IP address space, forming the so called Bad Neighborhoods. This phenomenon has been previously exploited to filter spam by means of Bad Neighborhood blacklists. In this paper, the authors evaluate how much a network administrator can rely upon different Bad Neighborhood blacklists generated by third-party sources to fight spam. One could expect that Bad Neighborhood blacklists generated from different sources contain, to a varying degree, disjoint sets of entries.