On October 5, a Tell HN post reported a website blocked by Orange's security filters because its address was on UCEPROTECT Level 3, which listed all of DigitalOcean's network. The poster found that UCEPROTECT would whitelist the site for about $30 a month. The thread argued over what Level 3 is for, and nobody in it measured what it lists.
We downloaded the Level 3 zone on 2026-10-09 and matched every address in it to the network that announces it.
What Level 3 is
UCEPROTECT publishes three blocklists: Level 1 lists single addresses, Level 2 allocations and Level 3 whole networks, by ASN. Its policy lists every address of an ASN once the ASN's spamscore reaches 50, the network's Level 1 listings per 100,000 of its addresses, with at least 50 listings in the last 7 days. An ASN can also be listed by hand, when UCEPROTECT suspects it was set up for spamming.
The policy calls Level 3 "Draconic", made "for HARDLINERS", and warns that it "can, and probably will cause collateral damage to innocent users when used to block email". It recommends using it as one input to a spam score.
What it lists
On 2026-10-09, Level 3 listed 752 ASNs in 115,580 CIDRs: 203,866,528 IPv4 addresses once merged, 6.5% of the IPv4 space networks announce, and no IPv6. For 751 of the 752 ASNs, it lists at least 90% of what the ASN announces, so it really is whole networks.
By the type of network that announces each address:
| Network type | ASNs listed | IPv4 listed | Share |
|---|---|---|---|
| ISP | 485 | 178.1M | 87.4% |
| Hosting | 68 | 14.7M | 7.2% |
| Business | 182 | 9.7M | 4.8% |
| Education | 7 | 0.7M | 0.4% |
| Government | 10 | 0.6M | 0.3% |
The largest listings are mostly broadband and mobile providers:
| Network | IPv4 listed |
|---|---|
| Korea Telecom (AS4766) | 47.2M |
| China Mobile (AS9808) | 36.6M |
| Cox Communications (AS22773) | 13.7M |
| Telia (AS3301) | 6.5M |
| National Internet Backbone, India (AS9829) | 6.1M |
| Viettel (AS7552) | 5.5M |
| OVH (AS16276) | 4.6M |
| Telefônica Brasil (AS18881) | 4.6M |
| China Mobile (AS56046) | 3.6M |
| TPG Telecom (AS7545) | 3.4M |
DigitalOcean (AS14061) comes next, with 3.1M. OVH and DigitalOcean are the largest hosting listings. AWS, Google Cloud, Microsoft Azure, Cloudflare, Hetzner and Linode aren't on it. The zone also exempts 10,529 single addresses, 5,989 of them inside listed networks.
Level 3 changes every day, since it counts only the last 7 days of Level 1 listings.
Who it catches
58,466,607 of its addresses, 28.7%, are in mobile operators' networks, by our Carrier IP database.
It catches little of what a web or app team usually wants kept out. Only 3.4% of what our Hosting IP database holds at high confidence is on it, 14.1M of 420.0M addresses. Of the 4,999,688 addresses our Residential Proxy IP database saw as proxy exits on 2026-10-09, 611,402 (12.2%) are on it.
Using it
For mail, use it the way UCEPROTECT recommends: as points toward a spam score, never as a block on its own.
For web and app traffic, don't use it at all. A Level 3 block turns away ISP and mobile customers by the network, and still lets through 96.6% of Hosting IP's high ranges and 87.8% of residential proxy exits. Datacenter and proxy traffic is better caught with data built for that question, which works at the level of each range: Hosting IP for servers, Residential Proxy IP for proxy exits.
How we measured
The Level 3 zone is a public rbldnsd file, http://wget-mirrors.uceprotect.net/rbldnsd-all/dnsbl-3.uceprotect.net.gz, and each of its lines names the ASN it lists and that ASN's spamscore. We took serial 2026100917 and merged its CIDRs. Each address's announcing network comes from IP ASN and each network's type from the type column of our free ASN database, both from the same day, as are Carrier IP, Hosting IP's high tier and the residential proxy exits.
To license any of these databases, see pricing or talk to us.
