Blacklists Compared

27 September 2003

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the query.bondedsender.org zone because it is not a blacklist, and because they are too aggressive to be widely useful the xbl.selwerd.cx and block.blars.org zones are also excluded.

HitsDNS Zone
16264(total number of IP addresses tested, including 403 at SDSC)
11887(union of most IP zones)
9021xbl.selwerd.cx
7128t1.bl.reynolds.net.au
5377blackholes.five-ten-sg.com (union of all results)
5108block.blars.org
4843psbl.surriel.com
4253blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
4016cbl.abuseat.org
3681no-more-funn.moensted.dk (union of all results)
3453dynablock.easynet.nl (result 127.0.0.2 = dialup)
3453wdl.bl.reynolds.net.au
3453dynablock.easynet.nl (union of all results)
3202unconfirmed.dsbl.org
3197dnsbl.sorbs.net (union of all results)
2786dsbl.bl.reynolds.net.au
2786list.dsbl.org
2718wpb.bl.reynolds.net.au
2717blackholes.easynet.nl
2454dnsbl.njabl.org (union of all results)
2367bl.spamcop.net
1952cn-kr.blackholes.us (union of all results)
1851no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
1492l2.spews.dnsbl.sorbs.net
1490proxies.blackholes.easynet.nl
1307ipwhois.rfc-ignorant.org
1200dnsbl.njabl.org (result 127.0.0.9 = open proxy)
1198unsure.nether.net
1163no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
1049cn-kr.blackholes.us (result 127.0.0.2 = China)
1049china.blackholes.us
1028l1.spews.dnsbl.sorbs.net
1028spews.bl.reynolds.net.au
1018dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
999dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
946sbl.spamhaus.org
903cn-kr.blackholes.us (result 127.0.0.3 = Korea)
903korea.blackholes.us
892korea.services.net
870pdl.bl.reynolds.net.au
747dialups.visi.com
729blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
636relays.visi.com
616ybl.megacity.org
520dnsbl.sorbs.net (result 127.0.0.10 = dialup)
504cw.blackholes.us
480blackholes.intersil.net
469dnsbl.njabl.org (result 127.0.0.4 = spam source)
466blacklist.spambag.org
459dnsbl.njabl.org (result 127.0.0.3 = dialup)
458pss.spambusters.org.ar
418spam.wytnij.to
372rr.blackholes.us
365comcast.blackholes.us
353lbl.lagengymnastik.dk
353work.drbl.croco.net
349spamguard.leadmon.net (union of all results)
346multihop.dsbl.org
342brazil.blackholes.us
328dnsbl.njabl.org (result 127.0.0.2 = source or relay)
327opm.blitzed.org
326spamguard.leadmon.net (result 127.0.0.2 = dialup)
298level3.blackholes.us
293dnsbl.sorbs.net (result 127.0.0.6 = spam source)
291no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
274blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
242relays.ordb.org
216no-more-funn.moensted.dk (result 127.0.0.9 = misc)
210spamsources.fabel.dk
187taiwan.blackholes.us
1843y.spam.mrs.kithrup.com
167verio.blackholes.us
163japan.blackholes.us
155sbbl.they.com
154probes.bl.reynolds.net.au
153qwest.blackholes.us
152dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
151mail-abuse.blacklist.jippg.org
140osrs.bl.reynolds.net.au
136xo.blackholes.us
131relays.bl.kundenserver.de
130argentina.blackholes.us
123charter.blackholes.us
122mexico.blackholes.us
119rmst.bl.reynolds.net.au
117query.bondedsender.org (not a blacklist!)
107dnsbl.antispam.or.id
100relays.nether.net
92internap.blackholes.us
90russia.blackholes.us
85tr.countries.nerd.dk
85flowgoaway.com
84turkey.blackholes.us
84blackholes.brainerd.net
84blackholes.uceb.org (union of all results)
83hongkong.blackholes.us
79dialup.blacklist.jippg.org (union of all results)
78dialup.blacklist.jippg.org (result 127.0.0.3 = dialup outside Japan)
77no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
74ricn.bl.reynolds.net.au
72ohps.bl.reynolds.net.au
66spam.shri.net
64wanadoo-fr.blackholes.us
62osps.bl.reynolds.net.au
61infolink.blackholes.us
60no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
59interbusiness.blackholes.us
58bellsouth.blackholes.us
57blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
52dun.dnsrbl.net
51he.blackholes.us
50nigeria.blackholes.us
48singapore.blackholes.us
41inflow.blackholes.us
40blackholes.uceb.org (result 127.0.0.2 = open relay)
39above.blackholes.us
38blackholes.uceb.org (result 127.0.0.3 = spam source)
33satos.rbl.cluecentral.net
33spam.exsilia.net (union of all results)
32vox.schpider.com
30rackspace.blackholes.us
29telstra.blackholes.us
29rogers.blackholes.us
29malaysia.blackholes.us
29ph.rbl.cluecentral.net
28covad.blackholes.us
27spam.exsilia.net (result 127.0.0.2 = spam source)
26blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
22blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
21a2000.blackholes.us
21spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
21bl.deadbeef.com
20thailand.blackholes.us
20cybercon.blackholes.us
20dev.null.dk
19eli.blackholes.us
17broadwing.blackholes.us
16pajo.blackholes.us
15no-more-funn.moensted.dk (result 127.0.0.8 = open web form)
14blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
13yipes.blackholes.us
10spamsources.yamta.org (result 127.0.0.2 = spam source)
8maxim.blackholes.us
8burst.blackholes.us
6no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
6spam.exsilia.net (result 127.0.0.3 = virus source)
5olm.blackholes.us
5epoch.blackholes.us
4lauderdale.blackholes.us
4blackholes.uceb.org (result 127.0.0.8 = spam source with fake sender)
4spamsites.bl.reynolds.net.au
4omrs.bl.reynolds.net.au
3navisite.blackholes.us
2affinity.blackholes.us
2blackholes.uceb.org (result 127.0.0.4 = spam source network)
2dnsbl.sorbs.net (result 127.0.0.5 = open relay)
2dnsbl.sorbs.net (result 127.0.0.7 = open formmail.cgi)
2t3direct.bl.reynolds.net.au
2dnsbl.njabl.org (result 127.0.0.8 = open formmail.cgi)
2spamguard.leadmon.net (result 127.0.0.3 = spam source)
2no-more-funn.moensted.dk (result 127.0.0.11 = repeated probes)
2blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
1ciberlynx.blackholes.us
1owps.bl.reynolds.net.au
1owfs.bl.reynolds.net.au
1dialup.blacklist.jippg.org (result 127.0.0.4 = dialup in Japan)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems.

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
16264(total number of IP addresses whose names were tested, including 403 at SDSC)
6363(union of all domain zones)
3872abuse.rfc-ignorant.org
2608rddn.bl.reynolds.net.au
1273whois.rfc-ignorant.org (union of all results)
839whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
667bulk.rhs.mailpolice.com
557spamdomains.blackholes.easynet.nl
556endn.bl.reynolds.net.au
435whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
178blackhole.securitysage.com
151bl.deadbeef.com
92porn.rhs.mailpolice.com
38dsn.rfc-ignorant.org (zone not intended for this use)
17postmaster.rfc-ignorant.org

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
9638(total number of domains tested, including 200 at SDSC)
3374(union of all domain zones)
1047bulk.rhs.mailpolice.com
970whois.rfc-ignorant.org (union of all results)
953abuse.rfc-ignorant.org
829whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
645endn.bl.reynolds.net.au
623spamdomains.blackholes.easynet.nl
446postmaster.rfc-ignorant.org
366dsn.rfc-ignorant.org
204rddn.bl.reynolds.net.au (zone not intended for this use)
141whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
126blackhole.securitysage.com
72porn.rhs.mailpolice.com
57bl.deadbeef.com
34ex.dnsbl.org (union of all results)
32ex.dnsbl.org (result 127.0.0.2 = spamsites)
7in.dnsbl.org (union of all results)
5in.dnsbl.org (result 127.0.0.6 = unconfirmed opt-in)
2in.dnsbl.org (result 127.0.0.2 = spam source)
2ex.dnsbl.org (result 127.0.0.3 = spam source)

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 6 October 2003.