Blacklists Compared

22 November 2003

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the exemptions.ahbl.org and query.bondedsender.org zones because they are not blacklists, and because it is too aggressive to be widely useful the block.blars.org zone is also excluded.

HitsDNS Zone
16596(total number of IP addresses tested, including 371 at SDSC)
12646(union of most IP zones)
8776t1.dnsbl.net.au
6553block.blars.org
6341dnsbl.sorbs.net (union of all results)
5814blackholes.five-ten-sg.com (union of all results)
4775unconfirmed.dsbl.org
4720blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
4574dsbl.dnsbl.net.au
4574list.dsbl.org
4549dynablock.easynet.nl (result 127.0.0.2 = dialup)
4549dynablock.easynet.nl (union of all results)
4542wdl.dnsbl.net.au
4223cbl.abuseat.org
3565dnsbl.sorbs.net (result 127.0.0.10 = dialup)
3523blackholes.easynet.nl
3520wpb.dnsbl.net.au
3482no-more-funn.moensted.dk (union of all results)
3264dnsbl.njabl.org (union of all results)
3006bl.spamcop.net
2579sbl.csma.biz
2168proxies.blackholes.easynet.nl
1968cn-kr.blackholes.us (union of all results)
1888unsure.nether.net
1878dnsbl.ahbl.org (union of all results)
1848dnsbl.njabl.org (result 127.0.0.9 = open proxy)
1576no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
1561l2.spews.dnsbl.sorbs.net
1495ipwhois.rfc-ignorant.org
1464dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
1432no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
1356psbl.surriel.com
1286dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
1267spews.dnsbl.net.au
1264l1.spews.dnsbl.sorbs.net
1260spam.wytnij.to
1249cn-kr.blackholes.us (result 127.0.0.2 = China)
1249china.blackholes.us
1227dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
1180sbl.spamhaus.org
949bl.csma.biz
774blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
730rmst.dnsbl.net.au
719cn-kr.blackholes.us (result 127.0.0.3 = Korea)
719korea.blackholes.us
719spamsources.fabel.dk
710korea.services.net
695ybl.megacity.org
675probes.dnsbl.net.au
650dnsbl.ahbl.org (result 127.0.0.4 = spam source)
649dnsbl.njabl.org (result 127.0.0.3 = dialup)
633ricn.dnsbl.net.au
618dnsbl.sorbs.net (result 127.0.0.6 = spam source)
595pss.spambusters.org.ar
517dnsbl.njabl.org (result 127.0.0.4 = spam source)
511cw.blackholes.us
492blackholes.intersil.net
474spamguard.leadmon.net (union of all results)
464spamguard.leadmon.net (result 127.0.0.2 = dialup)
440relaywatcher.n13mbl.com
437comcast.blackholes.us
430work.drbl.croco.net
419rr.blackholes.us
398blacklist.spambag.org
374pdl.dnsbl.net.au
339opm.blitzed.org
326relays.visi.com
325level3.blackholes.us
310brazil.blackholes.us
271dnsbl.njabl.org (result 127.0.0.2 = source or relay)
264blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
257no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
256taiwan.blackholes.us
214dnsbl.antispam.or.id
200sbbl.they.com
191japan.blackholes.us
173multihop.dsbl.org
167xo.blackholes.us
166dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
161charter.blackholes.us
159no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
154relays.ordb.org
144qwest.blackholes.us
140verio.blackholes.us
139russia.blackholes.us
1213y.spam.mrs.kithrup.com
113internap.blackholes.us
107relays.nether.net
107mail-abuse.blacklist.jippg.org
103query.bondedsender.org (not a blacklist!)
99mexico.blackholes.us
99osrs.dnsbl.net.au
94osps.dnsbl.net.au
93dialup.blacklist.jippg.org (union of all results)
92dialup.blacklist.jippg.org (result 127.0.0.3 = dialup outside Japan)
91ohps.dnsbl.net.au
85flowgoaway.com
75argentina.blackholes.us
73interbusiness.blackholes.us
71wanadoo-fr.blackholes.us
71rogers.blackholes.us
69hongkong.blackholes.us
69dun.dnsrbl.net
67blackholes.brainerd.net
65tr.countries.nerd.dk
64turkey.blackholes.us
58he.blackholes.us
54blackholes.uceb.org (union of all results)
53no-more-funn.moensted.dk (result 127.0.0.9 = misc)
49nigeria.blackholes.us
48bellsouth.blackholes.us
48above.blackholes.us
38inflow.blackholes.us
38a2000.blackholes.us
38dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
36no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
34singapore.blackholes.us
32vox.schpider.com
31relays.bl.kundenserver.de
30covad.blackholes.us
29rdts.dnsbl.net.au
28yipes.blackholes.us
28spam.exsilia.net (union of all results)
27rackspace.blackholes.us
26telstra.blackholes.us
26cybercon.blackholes.us
26blackholes.uceb.org (result 127.0.0.2 = open relay)
26satos.rbl.cluecentral.net
24blackholes.uceb.org (result 127.0.0.3 = spam source)
22blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
21spam.exsilia.net (result 127.0.0.2 = spam source)
17ph.rbl.cluecentral.net
15broadwing.blackholes.us
14malaysia.blackholes.us
13infolink.blackholes.us
13eli.blackholes.us
12bl.deadbeef.com
10thailand.blackholes.us
10spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
10blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
10blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
9affinity.blackholes.us
8olm.blackholes.us
8blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
7burst.blackholes.us
7no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
7spam.exsilia.net (result 127.0.0.3 = virus source)
6spamsources.yamta.org (result 127.0.0.2 = spam source)
6pajo.blackholes.us
6omrs.dnsbl.net.au
5maxim.blackholes.us
5epoch.blackholes.us
5dnsbl.sorbs.net (result 127.0.0.5 = open relay)
5blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
4owps.dnsbl.net.au
4t3direct.dnsbl.net.au
3dnsbl.sorbs.net (result 127.0.0.7 = open formmail.cgi)
3dev.null.dk
2navisite.blackholes.us
2blackholes.uceb.org (result 127.0.0.4 = spam source network)
2blackholes.uceb.org (result 127.0.0.8 = spam source with fake sender)
2dialups.visi.com
1spamsites.dnsbl.net.au
1dnsbl.njabl.org (result 127.0.0.8 = open formmail.cgi)
1dialup.blacklist.jippg.org (result 127.0.0.4 = dialup in Japan)
1no-more-funn.moensted.dk (result 127.0.0.8 = open web form)
1blackholes.five-ten-sg.com (result 127.0.0.6 = open relay)
1dnsbl.ahbl.org (result 127.0.0.2 = open relay)
1exemptions.ahbl.org (not a blacklist!)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems.

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
16596(total number of IP addresses whose names were tested, including 371 at SDSC)
7876(union of all domain zones)
5172abuse.rfc-ignorant.org
3521rddn.dnsbl.net.au
1173whois.rfc-ignorant.org (union of all results)
754endn.dnsbl.net.au
714spamdomains.blackholes.easynet.nl
708bulk.rhs.mailpolice.com
621whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
610blackhole.securitysage.com
552whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
169bl.deadbeef.com
161rhsbl.ahbl.org
106porn.rhs.mailpolice.com
18dsn.rfc-ignorant.org (zone not intended for this use)
10postmaster.rfc-ignorant.org
1ex.dnsbl.org (result 127.0.0.2 = spamsites)
1ex.dnsbl.org (union of all results)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
9289(total number of domains tested, including 237 at SDSC)
3369(union of all domain zones)
1265bulk.rhs.mailpolice.com
899abuse.rfc-ignorant.org
887whois.rfc-ignorant.org (union of all results)
759whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
745blackhole.securitysage.com
464postmaster.rfc-ignorant.org
462dsn.rfc-ignorant.org
128whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
66rhsbl.ahbl.org
53bl.deadbeef.com
44porn.rhs.mailpolice.com
40ex.dnsbl.org (union of all results)
38ex.dnsbl.org (result 127.0.0.2 = spamsites)
12rddn.dnsbl.net.au (zone not intended for this use)
2ex.dnsbl.org (result 127.0.0.3 = spam source)
1rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
1rhsbl.sorbs.net (union of all results)

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 1 December 2003.