Blacklists Compared

26 April 2003

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the xbl.selwerd.cx and block.blars.org zones zone because they are too aggressive to be widely useful, and the blocktest.relays.osirusoft.com and query.bondedsender.org zones are also excluded because they are not blacklists.

HitsDNS Zone
12271(total number of IP addresses tested, including 428 at SDSC)
8137(union of most IP zones)
6351xbl.selwerd.cx
5099blackholes.five-ten-sg.com (union of all results)
3739t1.bl.reynolds.net.au
3101block.blars.org
2947blackholes.wirehub.net
2859no-more-funn.moensted.dk (union of all results)
2353unconfirmed.dsbl.org
2331relays.osirusoft.com (union of all results)
2302dnsbl.njabl.org (union of all results)
2028list.dsbl.org
1972blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
1927bl.spamcop.net
1833dnsbl.sorbs.net (union of all results)
1801proxies.blackholes.wirehub.net
1656blackholes.five-ten-sg.com (result 127.0.0.3 = dialup)
1634proxies.relays.monkeys.com (result 127.0.0.2 = open proxy)
1634proxies.relays.monkeys.com (union of all results)
1559no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
1494cn-kr.blackholes.us (union of all results)
1428dnsbl.njabl.org (result 127.0.0.9 = open proxy)
1371ztl.dorkslayers.com
1280opm.blitzed.org
1200dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
1191ipwhois.rfc-ignorant.org
1181dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
1049spews.bl.reynolds.net.au
1036spews.relays.osirusoft.com
1034blocktest.relays.osirusoft.com (not a blacklist!)
1012relays.osirusoft.com (result 127.0.0.4 = spam source)
984blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
874cn-kr.blackholes.us (result 127.0.0.2 = China)
874china.blackholes.us
870work.drbl.croco.net
773spam.dnsrbl.net
709no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
704relays.osirusoft.com (result 127.0.0.9 = open proxy)
693socks.relays.osirusoft.com
688spamhaus.relays.osirusoft.com
684blackholes.intersil.net
675sbl.spamhaus.org
634korea.services.net
630relays.osirusoft.com (result 127.0.0.6 = spamsites)
620cn-kr.blackholes.us (result 127.0.0.3 = Korea)
620korea.blackholes.us
595cw.blackholes.us
552ybl.megacity.org
538spamsources.fabel.dk
495dnsbl.delink.net
488dnsbl.njabl.org (result 127.0.0.4 = spam source)
407blacklist.spambag.org
351blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
314spam.wytnij.to
305level3.blackholes.us
301no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
279relays.osirusoft.com (result 127.0.0.2 = relay)
279inputs.relays.osirusoft.com
272dnsbl.njabl.org (result 127.0.0.2 = source or relay)
260blackholes.uceb.org (union of all results)
241flowgoaway.com
236spamguard.leadmon.net (union of all results)
221multihop.dsbl.org
216spamguard.leadmon.net (result 127.0.0.2 = dialup)
191brazil.blackholes.us
191mail-abuse.blacklist.jippg.org
179taiwan.blackholes.us
176dialups.relays.osirusoft.com (union of all results)
170dialups.relays.osirusoft.com (result 127.0.0.3 = dialup)
168verio.blackholes.us
158spamsources.relays.osirusoft.com (union of all results)
150rr.blackholes.us
150query.bondedsender.org (not a blacklist!)
147relays.bl.kundenserver.de
144dnsbl.sorbs.net (result 127.0.0.6 = spam source)
143dynablock.wirehub.net (result 127.0.0.2 = dialup)
143dynablock.wirehub.net (union of all results)
139spamsources.relays.osirusoft.com (result 127.0.0.4 = spam source)
137relays.osirusoft.com (result 127.0.0.3 = dialup)
134blackholes.uceb.org (result 127.0.0.3 = spam source)
133dialups.visi.com
1333y.spam.mrs.kithrup.com
126no-more-funn.moensted.dk (result 127.0.0.9 = misc)
125bl.deadbeef.com
119dun.dnsrbl.net
113dnsbl.njabl.org (result 127.0.0.3 = dialup)
111no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
107xo.blackholes.us
107internap.blackholes.us
99japan.blackholes.us
97dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
92argentina.blackholes.us
90vox.schpider.com
88orbs.dorkslayers.com
87blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
85rackspace.blackholes.us
74hongkong.blackholes.us
66tr.countries.nerd.dk
64blackholes.uceb.org (result 127.0.0.2 = relay)
62blackholes.brainerd.net
60bl.deadbeef.com
57blackhole.compu.net
49russia.blackholes.us
49interbusiness.blackholes.us
47blackholes.uceb.org (result 127.0.0.8 = spam source with fake sender)
37spam.exsilia.net (union of all results)
36inflow.blackholes.us
33blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
32relays.ordb.org
32proxies.relays.osirusoft.com
31spam.exsilia.net (result 127.0.0.2 = spam source)
28no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
27above.blackholes.us
26cybercon.blackholes.us
24singapore.blackholes.us
24he.blackholes.us
21telstra.blackholes.us
21eli.blackholes.us
21ph.rbl.cluecentral.net
19wanadoo-fr.blackholes.us
18spammers.v6net.org
18thailand.blackholes.us
18nigeria.blackholes.us
18malaysia.blackholes.us
18spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
18no-more-funn.moensted.dk (result 127.0.0.8 = open web form)
15blackholes.uceb.org (result 127.0.0.4 = spam source network)
15spamsources.relays.osirusoft.com (result 127.0.0.6 = spamhaus)
14relays.dorkslayers.com
13broadwing.blackholes.us
12yipes.blackholes.us
12valuenet.blackholes.us
12covad.blackholes.us
12dialup.blacklist.jippg.org (result 127.0.0.3 = dialup outside Japan)
12blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
12dialup.blacklist.jippg.org (union of all results)
9epoch.blackholes.us
7no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
6affinity.blackholes.us
6dialups.relays.osirusoft.com (result 127.0.0.4 = no reverse DNS)
6dev.null.dk
5pajo.blackholes.us
5spamsources.relays.osirusoft.com (result 127.0.0.7 = unconfirmed opt-in)
5spam.exsilia.net (result 127.0.0.3 = virus source)
4dnsbl.sorbs.net (result 127.0.0.5 = open relay)
4dnsbl.sorbs.net (result 127.0.0.7 = open formmail.cgi)
4relays.osirusoft.com (result 127.0.0.7 = unconfirmed opt-in)
3spamsites.relays.osirusoft.com (result 127.0.0.6)
3blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
3spamsites.relays.osirusoft.com (union of all results)
2valueweb.blackholes.us
2ciberlynx.blackholes.us
2spamguard.leadmon.net (result 127.0.0.3 = spam source)
1skynetweb.blackholes.us
1dnsbl.njabl.org (result 127.0.0.8 = open formmail.cgi)
1blackholes.five-ten-sg.com (result 127.0.0.6 = relay)
1proxies.exsilia.net
1spam.exsilia.net (result 127.0.0.5 = no role contacts)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems. The blackhole.compu.net zone "is primarily for hosts which were not blocked by other blackhole sites and spammed compu.net."

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
12271(total number of IP addresses whose names were tested, including 428 at SDSC)
2924(union of all domain zones)
2502abuse.rfc-ignorant.org
707whois.rfc-ignorant.org (union of all results)
406whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
301whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
16postmaster.rfc-ignorant.org
16dsn.rfc-ignorant.org (zone not intended for this use)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
7757(total number of domains tested, including 212 at SDSC)
1475(union of all domain zones)
697abuse.rfc-ignorant.org
626whois.rfc-ignorant.org (union of all results)
458whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
361postmaster.rfc-ignorant.org
256dsn.rfc-ignorant.org
168whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
86bl.deadbeef.com
25ex.dnsbl.org (union of all results)
22ex.dnsbl.org (result 127.0.0.2 = spamsites)
7bandwidth-pigs.monkeys.com
4in.dnsbl.org (union of all results)
3ex.dnsbl.org (result 127.0.0.3 = spam source)
3in.dnsbl.org (result 127.0.0.6 = unconfirmed opt-in)
1in.dnsbl.org (result 127.0.0.2 = spam source)

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 30 April 2003.