Blacklists Compared

8 November 2003

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the query.bondedsender.org zone because it is not a blacklist, and because it is too aggressive to be widely useful the block.blars.org zone is also excluded.

HitsDNS Zone
15651(total number of IP addresses tested, including 441 at SDSC)
11337(union of most IP zones)
7551t1.dnsbl.net.au
5606block.blars.org
5356blackholes.five-ten-sg.com (union of all results)
4344blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
4042cbl.abuseat.org
3757unconfirmed.dsbl.org
3750dynablock.easynet.nl (result 127.0.0.2 = dialup)
3750dynablock.easynet.nl (union of all results)
3749wdl.dnsbl.net.au
3478list.dsbl.org
3477dsbl.dnsbl.net.au
3449dnsbl.sorbs.net (union of all results)
3050blackholes.easynet.nl
3048wpb.dnsbl.net.au
3041no-more-funn.moensted.dk (union of all results)
2759bl.spamcop.net
2464dnsbl.njabl.org (union of all results)
2120cn-kr.blackholes.us (union of all results)
1935proxies.blackholes.easynet.nl
1636psbl.surriel.com
1602unsure.nether.net
1590no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
1458ipwhois.rfc-ignorant.org
1409l2.spews.dnsbl.sorbs.net
1375dnsbl.njabl.org (result 127.0.0.9 = open proxy)
1371cn-kr.blackholes.us (result 127.0.0.2 = China)
1371china.blackholes.us
1256dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
1206dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
1182bl.csma.biz
1048ricn.dnsbl.net.au
1042spews.dnsbl.net.au
1035l1.spews.dnsbl.sorbs.net
969no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
943spam.wytnij.to
943sbl.spamhaus.org
924pss.spambusters.org.ar
782relays.visi.com
749cn-kr.blackholes.us (result 127.0.0.3 = Korea)
749korea.blackholes.us
736korea.services.net
722spamsources.fabel.dk
704blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
647rmst.dnsbl.net.au
602ybl.megacity.org
581probes.dnsbl.net.au
512dnsbl.sorbs.net (result 127.0.0.10 = dialup)
491sbbl.they.com
461cw.blackholes.us
454dnsbl.njabl.org (result 127.0.0.3 = dialup)
416opm.blitzed.org
401blacklist.spambag.org
361dnsbl.njabl.org (result 127.0.0.4 = spam source)
355dnsbl.sorbs.net (result 127.0.0.6 = spam source)
354work.drbl.croco.net
348brazil.blackholes.us
335spamguard.leadmon.net (union of all results)
322spamguard.leadmon.net (result 127.0.0.2 = dialup)
315level3.blackholes.us
307rr.blackholes.us
297comcast.blackholes.us
295taiwan.blackholes.us
290blackholes.intersil.net
288dnsbl.njabl.org (result 127.0.0.2 = source or relay)
242no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
233multihop.dsbl.org
230blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
204relays.ordb.org
197dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
189russia.blackholes.us
185japan.blackholes.us
150relaywatcher.n13mbl.com
141verio.blackholes.us
140dnsbl.antispam.or.id
137charter.blackholes.us
129qwest.blackholes.us
127mail-abuse.blacklist.jippg.org
126no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
117osps.dnsbl.net.au
116xo.blackholes.us
115relays.bl.kundenserver.de
1133y.spam.mrs.kithrup.com
110relays.nether.net
108ohps.dnsbl.net.au
102mexico.blackholes.us
100argentina.blackholes.us
98query.bondedsender.org (not a blacklist!)
94dialup.blacklist.jippg.org (union of all results)
93osrs.dnsbl.net.au
92dialup.blacklist.jippg.org (result 127.0.0.3 = dialup outside Japan)
91internap.blackholes.us
89no-more-funn.moensted.dk (result 127.0.0.9 = misc)
85flowgoaway.com
78blackholes.brainerd.net
74hongkong.blackholes.us
72turkey.blackholes.us
72interbusiness.blackholes.us
72tr.countries.nerd.dk
70blackholes.uceb.org (union of all results)
67dun.dnsrbl.net
57bellsouth.blackholes.us
56wanadoo-fr.blackholes.us
56he.blackholes.us
47nigeria.blackholes.us
45singapore.blackholes.us
42dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
41inflow.blackholes.us
41above.blackholes.us
41no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
40spam.exsilia.net (union of all results)
38rogers.blackholes.us
36blackholes.uceb.org (result 127.0.0.3 = spam source)
34a2000.blackholes.us
30vox.schpider.com
30rackspace.blackholes.us
30covad.blackholes.us
30spam.exsilia.net (result 127.0.0.2 = spam source)
28blackholes.uceb.org (result 127.0.0.2 = open relay)
27telstra.blackholes.us
25blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
25ph.rbl.cluecentral.net
24yipes.blackholes.us
24cybercon.blackholes.us
22blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
22satos.rbl.cluecentral.net
21malaysia.blackholes.us
18thailand.blackholes.us
18rdts.dnsbl.net.au
14dnsbl.sorbs.net (result 127.0.0.5 = open relay)
14bl.deadbeef.com
13blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
12olm.blackholes.us
12spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
11pajo.blackholes.us
11broadwing.blackholes.us
11t3direct.dnsbl.net.au
10eli.blackholes.us
10blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
10spam.exsilia.net (result 127.0.0.3 = virus source)
9burst.blackholes.us
9affinity.blackholes.us
9owps.dnsbl.net.au
8dev.null.dk
7no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
6maxim.blackholes.us
6infolink.blackholes.us
6blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
5epoch.blackholes.us
4spamsources.yamta.org (result 127.0.0.2 = spam source)
4navisite.blackholes.us
4omrs.dnsbl.net.au
3blackholes.uceb.org (result 127.0.0.4 = spam source network)
3blackholes.uceb.org (result 127.0.0.8 = spam source with fake sender)
3dnsbl.sorbs.net (result 127.0.0.7 = open formmail.cgi)
2ciberlynx.blackholes.us
2spamsites.dnsbl.net.au
2dnsbl.njabl.org (result 127.0.0.8 = open formmail.cgi)
2dialup.blacklist.jippg.org (result 127.0.0.4 = dialup in Japan)
2blackholes.five-ten-sg.com (result 127.0.0.6 = open relay)
1valuenet.blackholes.us
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1no-more-funn.moensted.dk (result 127.0.0.8 = open web form)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems.

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
15651(total number of IP addresses whose names were tested, including 441 at SDSC)
6527(union of all domain zones)
4380abuse.rfc-ignorant.org
2704rddn.dnsbl.net.au
1186whois.rfc-ignorant.org (union of all results)
610whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
576whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
520endn.dnsbl.net.au
509blackhole.securitysage.com
508spamdomains.blackholes.easynet.nl
496bulk.rhs.mailpolice.com
172bl.deadbeef.com
71porn.rhs.mailpolice.com
14dsn.rfc-ignorant.org (zone not intended for this use)
9postmaster.rfc-ignorant.org

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
9226(total number of domains tested, including 408 at SDSC)
3119(union of all domain zones)
944bulk.rhs.mailpolice.com
912whois.rfc-ignorant.org (union of all results)
902abuse.rfc-ignorant.org
770whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
767endn.dnsbl.net.au
706spamdomains.blackholes.easynet.nl
697blackhole.securitysage.com
436postmaster.rfc-ignorant.org
392dsn.rfc-ignorant.org
142whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
64bl.deadbeef.com
54rddn.dnsbl.net.au (zone not intended for this use)
35ex.dnsbl.org (union of all results)
31porn.rhs.mailpolice.com
30ex.dnsbl.org (result 127.0.0.2 = spamsites)
5ex.dnsbl.org (result 127.0.0.3 = spam source)
2rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
2rhsbl.sorbs.net (union of all results)

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 16 November 2003.