# UCEPROTECT Level 3 lists 204M addresses, 87% of them ISPs

We measured the UCEPROTECT Level 3 zone: 752 networks and 204M IPv4 addresses, 87% of them in ISPs. AWS, Google and Azure aren't on it; DigitalOcean is.

On October 5, a [Tell HN post](https://news.ycombinator.com/item?id=49964045) reported a website blocked by Orange's security filters because its address was on UCEPROTECT Level 3, which listed all of DigitalOcean's network. The poster found that UCEPROTECT would whitelist the site for about $30 a month. The thread argued over what Level 3 is for, and nobody in it measured what it lists.

We downloaded the Level 3 zone on 2026-10-09 and matched every address in it to the network that announces it.

## What Level 3 is

UCEPROTECT publishes three blocklists: Level 1 lists single addresses, Level 2 allocations and Level 3 whole networks, by ASN. Its [policy](http://www.uceprotect.net/en/index.php?m=3&s=5) lists every address of an ASN once the ASN's spamscore reaches 50, the network's Level 1 listings per 100,000 of its addresses, with at least 50 listings in the last 7 days. An ASN can also be listed by hand, when UCEPROTECT suspects it was set up for spamming.

The policy calls Level 3 "Draconic", made "for HARDLINERS", and warns that it "can, and probably will cause collateral damage to innocent users when used to block email". It recommends using it as one input to a spam score.

## What it lists

On 2026-10-09, Level 3 listed 752 ASNs in 115,580 CIDRs: 203,866,528 IPv4 addresses once merged, 6.5% of the IPv4 space networks announce, and no IPv6. For 751 of the 752 ASNs, it lists at least 90% of what the ASN announces, so it really is whole networks.

By the type of network that announces each address:

| Network type | ASNs listed | IPv4 listed | Share |
|---|---|---|---|
| ISP | 485 | 178.1M | 87.4% |
| Hosting | 68 | 14.7M | 7.2% |
| Business | 182 | 9.7M | 4.8% |
| Education | 7 | 0.7M | 0.4% |
| Government | 10 | 0.6M | 0.3% |

The largest listings are mostly broadband and mobile providers:

| Network | IPv4 listed |
|---|---|
| Korea Telecom (AS4766) | 47.2M |
| China Mobile (AS9808) | 36.6M |
| Cox Communications (AS22773) | 13.7M |
| Telia (AS3301) | 6.5M |
| National Internet Backbone, India (AS9829) | 6.1M |
| Viettel (AS7552) | 5.5M |
| OVH (AS16276) | 4.6M |
| Telefônica Brasil (AS18881) | 4.6M |
| China Mobile (AS56046) | 3.6M |
| TPG Telecom (AS7545) | 3.4M |

DigitalOcean (AS14061) comes next, with 3.1M. OVH and DigitalOcean are the largest hosting listings. AWS, Google Cloud, Microsoft Azure, Cloudflare, Hetzner and Linode aren't on it. The zone also exempts 10,529 single addresses, 5,989 of them inside listed networks.

Level 3 changes every day, since it counts only the last 7 days of Level 1 listings.

## Who it catches

58,466,607 of its addresses, 28.7%, are in mobile operators' networks, by our [Carrier IP](https://internetdata.io/databases/carrier-ip) database.

It catches little of what a web or app team usually wants kept out. Only 3.4% of what our [Hosting IP](https://internetdata.io/databases/hosting-ip) database holds at `high` confidence is on it, 14.1M of 420.0M addresses. Of the 4,999,688 addresses our [Residential Proxy IP](https://internetdata.io/databases/residential-proxy-ip) database saw as proxy exits on 2026-10-09, 611,402 (12.2%) are on it.

## Using it

For mail, use it the way UCEPROTECT recommends: as points toward a spam score, never as a block on its own.

For web and app traffic, don't use it at all. A Level 3 block turns away ISP and mobile customers by the network, and still lets through 96.6% of Hosting IP's `high` ranges and 87.8% of residential proxy exits. Datacenter and proxy traffic is better caught with data built for that question, which works at the level of each range: Hosting IP for servers, Residential Proxy IP for proxy exits.

## How we measured

The Level 3 zone is a public rbldnsd file, `http://wget-mirrors.uceprotect.net/rbldnsd-all/dnsbl-3.uceprotect.net.gz`, and each of its lines names the ASN it lists and that ASN's spamscore. We took serial 2026100917 and merged its CIDRs. Each address's announcing network comes from [IP ASN](https://docs.internetdata.io/database/ip-asn) and each network's type from the `type` column of our free [ASN](https://docs.internetdata.io/database/asn) database, both from the same day, as are Carrier IP, Hosting IP's `high` tier and the residential proxy exits.

To license any of these databases, see [pricing](https://internetdata.io/pricing) or [talk to us](https://internetdata.io/contact).