Blacklists Compared

25 October 2003

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the query.bondedsender.org zone because it is not a blacklist, and because they are too aggressive to be widely useful the xbl.selwerd.cx and block.blars.org zones are also excluded.

HitsDNS Zone
14969(total number of IP addresses tested, including 405 at SDSC)
10875(union of most IP zones)
7992xbl.selwerd.cx
7136t1.bl.reynolds.net.au
5234block.blars.org
5164blackholes.five-ten-sg.com (union of all results)
4159blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
3653cbl.abuseat.org
3359wdl.bl.reynolds.net.au
3356dynablock.easynet.nl (result 127.0.0.2 = dialup)
3356dynablock.easynet.nl (union of all results)
3260no-more-funn.moensted.dk (union of all results)
3256unconfirmed.dsbl.org
3049dnsbl.sorbs.net (union of all results)
2980dsbl.bl.reynolds.net.au
2980list.dsbl.org
2736blackholes.easynet.nl
2735wpb.bl.reynolds.net.au
2336bl.spamcop.net
2224psbl.surriel.com
2222dnsbl.njabl.org (union of all results)
1921cn-kr.blackholes.us (union of all results)
1627no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
1544ipwhois.rfc-ignorant.org
1457l2.spews.dnsbl.sorbs.net
1422proxies.blackholes.easynet.nl
1223cn-kr.blackholes.us (result 127.0.0.2 = China)
1223china.blackholes.us
1132bl.csma.biz
1103ricn.bl.reynolds.net.au
1080l1.spews.dnsbl.sorbs.net
1080spews.bl.reynolds.net.au
1069sbl.spamhaus.org
1027dnsbl.njabl.org (result 127.0.0.9 = open proxy)
1011no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
1001unsure.nether.net
880dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
847dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
845pdl.bl.reynolds.net.au
736pss.spambusters.org.ar
700blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
698cn-kr.blackholes.us (result 127.0.0.3 = Korea)
698korea.blackholes.us
692korea.services.net
685spamsources.fabel.dk
643ybl.megacity.org
531cw.blackholes.us
515dnsbl.njabl.org (result 127.0.0.4 = spam source)
513spam.wytnij.to
486dialups.visi.com
471blackholes.intersil.net
443dnsbl.sorbs.net (result 127.0.0.10 = dialup)
413dnsbl.njabl.org (result 127.0.0.3 = dialup)
407rmst.bl.reynolds.net.au
394sbbl.they.com
387relays.visi.com
360dnsbl.sorbs.net (result 127.0.0.6 = spam source)
356opm.blitzed.org
341blacklist.spambag.org
329spamguard.leadmon.net (union of all results)
319rr.blackholes.us
317work.drbl.croco.net
314spamguard.leadmon.net (result 127.0.0.2 = dialup)
311comcast.blackholes.us
310brazil.blackholes.us
286level3.blackholes.us
279dnsbl.njabl.org (result 127.0.0.2 = source or relay)
243no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
236multihop.dsbl.org
229no-more-funn.moensted.dk (result 127.0.0.9 = misc)
229blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
223taiwan.blackholes.us
194relays.ordb.org
158japan.blackholes.us
1463y.spam.mrs.kithrup.com
145dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
144verio.blackholes.us
140charter.blackholes.us
136osrs.bl.reynolds.net.au
127russia.blackholes.us
127mail-abuse.blacklist.jippg.org
122qwest.blackholes.us
122ohps.bl.reynolds.net.au
116xo.blackholes.us
113relays.bl.kundenserver.de
108query.bondedsender.org (not a blacklist!)
103osps.bl.reynolds.net.au
100mexico.blackholes.us
97dnsbl.antispam.or.id
96no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
88argentina.blackholes.us
87relays.nether.net
87blackholes.brainerd.net
85flowgoaway.com
79internap.blackholes.us
77dun.dnsrbl.net
77blackholes.uceb.org (union of all results)
74interbusiness.blackholes.us
74hongkong.blackholes.us
69dialup.blacklist.jippg.org (result 127.0.0.3 = dialup outside Japan)
69dialup.blacklist.jippg.org (union of all results)
64wanadoo-fr.blackholes.us
57nigeria.blackholes.us
57tr.countries.nerd.dk
55turkey.blackholes.us
48above.blackholes.us
43he.blackholes.us
43dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
41vox.schpider.com
41bellsouth.blackholes.us
40inflow.blackholes.us
39no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
38singapore.blackholes.us
36a2000.blackholes.us
35blackholes.uceb.org (result 127.0.0.3 = spam source)
34telstra.blackholes.us
33rdts.bl.reynolds.net.au
31spam.exsilia.net (union of all results)
29blackholes.uceb.org (result 127.0.0.2 = open relay)
28cybercon.blackholes.us
26rogers.blackholes.us
26blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
25thailand.blackholes.us
25satos.rbl.cluecentral.net
24t3direct.bl.reynolds.net.au
23lauderdale.blackholes.us
23covad.blackholes.us
22rackspace.blackholes.us
22bl.deadbeef.com
21spam.exsilia.net (result 127.0.0.2 = spam source)
20ph.rbl.cluecentral.net
19malaysia.blackholes.us
18broadwing.blackholes.us
18blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
16yipes.blackholes.us
16blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
15spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
13spam.shri.net
13blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
10spam.exsilia.net (result 127.0.0.3 = virus source)
9pajo.blackholes.us
9eli.blackholes.us
8blackholes.uceb.org (result 127.0.0.8 = spam source with fake sender)
7maxim.blackholes.us
7no-more-funn.moensted.dk (result 127.0.0.8 = open web form)
7no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
6spamsources.yamta.org (result 127.0.0.2 = spam source)
6burst.blackholes.us
5olm.blackholes.us
5affinity.blackholes.us
5blackholes.uceb.org (result 127.0.0.4 = spam source network)
5dev.null.dk
4epoch.blackholes.us
4owps.bl.reynolds.net.au
3navisite.blackholes.us
3infolink.blackholes.us
3dnsbl.sorbs.net (result 127.0.0.7 = open formmail.cgi)
3blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
2ciberlynx.blackholes.us
1spamsites.bl.reynolds.net.au
1dnsbl.njabl.org (result 127.0.0.8 = open formmail.cgi)
1no-more-funn.moensted.dk (result 127.0.0.11 = repeated probes)
1spam.dnsrbl.net

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems.

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
14969(total number of IP addresses whose names were tested, including 405 at SDSC)
6415(union of all domain zones)
4099abuse.rfc-ignorant.org
2499rddn.bl.reynolds.net.au
1190whois.rfc-ignorant.org (union of all results)
682whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
672bulk.rhs.mailpolice.com
562endn.bl.reynolds.net.au
544spamdomains.blackholes.easynet.nl
508whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
139bl.deadbeef.com
102blackhole.securitysage.com
60porn.rhs.mailpolice.com
11postmaster.rfc-ignorant.org
8dsn.rfc-ignorant.org (zone not intended for this use)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
9283(total number of domains tested, including 360 at SDSC)
3399(union of all domain zones)
1330bulk.rhs.mailpolice.com
909abuse.rfc-ignorant.org
856whois.rfc-ignorant.org (union of all results)
782endn.bl.reynolds.net.au
755spamdomains.blackholes.easynet.nl
716whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
415postmaster.rfc-ignorant.org
358dsn.rfc-ignorant.org
227blackhole.securitysage.com
140whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
140rddn.bl.reynolds.net.au (zone not intended for this use)
61bl.deadbeef.com
44ex.dnsbl.org (union of all results)
42porn.rhs.mailpolice.com
33ex.dnsbl.org (result 127.0.0.2 = spamsites)
11ex.dnsbl.org (result 127.0.0.3 = spam source)
1rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
1rhsbl.sorbs.net (union of all results)

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 1 November 2003.