Blacklists Compared

29 November 2003

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the exemptions.ahbl.org and query.bondedsender.org zones because they are not blacklists, and because it is too aggressive to be widely useful the block.blars.org zone is also excluded.

HitsDNS Zone
15859(total number of IP addresses tested, including 379 at SDSC)
12456(union of most IP zones)
8534t1.dnsbl.net.au
7268dnsbl.sorbs.net (union of all results)
6601block.blars.org
6227blackholes.five-ten-sg.com (union of all results)
5301blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
5006dnsbl.sorbs.net (result 127.0.0.10 = dialup)
4911unconfirmed.dsbl.org
4771dsbl.dnsbl.net.au
4771list.dsbl.org
4764cbl.abuseat.org
3519bl.spamcop.net
3443no-more-funn.moensted.dk (union of all results)
3207dnsbl.njabl.org (union of all results)
2582sbl.csma.biz
2289cn-kr.blackholes.us (union of all results)
2029unsure.nether.net
1814dnsbl.njabl.org (result 127.0.0.9 = open proxy)
1749no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
1666dnsbl.ahbl.org (union of all results)
1608pdl.dnsbl.net.au
1463l2.spews.dnsbl.sorbs.net
1431ipwhois.rfc-ignorant.org
1421dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
1396cn-kr.blackholes.us (result 127.0.0.2 = China)
1396china.blackholes.us
1332spam.wytnij.to
1274no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
1223psbl.surriel.com
1199dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
1182l1.spews.dnsbl.sorbs.net
1182spews.dnsbl.net.au
1158dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
1042sbl.spamhaus.org
902bl.csma.biz
893cn-kr.blackholes.us (result 127.0.0.3 = Korea)
893korea.blackholes.us
885korea.services.net
807spamsources.fabel.dk
751dialups.visi.com
716relays.visi.com
676rmst.dnsbl.net.au
671dnsbl.sorbs.net (result 127.0.0.6 = spam source)
666blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
661dnsbl.njabl.org (result 127.0.0.3 = dialup)
629ybl.megacity.org
583ricn.dnsbl.net.au
561probes.dnsbl.net.au
504pss.spambusters.org.ar
502relaywatcher.n13mbl.com
480dnsbl.njabl.org (result 127.0.0.4 = spam source)
468dnsbl.ahbl.org (result 127.0.0.4 = spam source)
447cw.blackholes.us
444blacklist.spambag.org
423spamguard.leadmon.net (union of all results)
410spamguard.leadmon.net (result 127.0.0.2 = dialup)
406work.drbl.croco.net
401comcast.blackholes.us
396blackholes.intersil.net
340brazil.blackholes.us
328level3.blackholes.us
326rr.blackholes.us
297opm.blitzed.org
287taiwan.blackholes.us
266dnsbl.njabl.org (result 127.0.0.2 = source or relay)
215blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
210no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
203dnsbl.antispam.or.id
186relays.ordb.org
180no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
166charter.blackholes.us
158dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
157japan.blackholes.us
138sbbl.they.com
136xo.blackholes.us
129russia.blackholes.us
126multihop.dsbl.org
1253y.spam.mrs.kithrup.com
121verio.blackholes.us
117mail-abuse.blacklist.jippg.org
111osrs.dnsbl.net.au
109mexico.blackholes.us
106qwest.blackholes.us
99osps.dnsbl.net.au
91dialup.blacklist.jippg.org (result 127.0.0.3 = dialup outside Japan)
91query.bondedsender.org (not a blacklist!)
91dialup.blacklist.jippg.org (union of all results)
89wanadoo-fr.blackholes.us
89interbusiness.blackholes.us
86internap.blackholes.us
84relays.nether.net
84flowgoaway.com
76dun.dnsrbl.net
69hongkong.blackholes.us
67argentina.blackholes.us
63blackholes.brainerd.net
62ohps.dnsbl.net.au
60he.blackholes.us
55blackholes.uceb.org (union of all results)
53rogers.blackholes.us
45turkey.blackholes.us
45nigeria.blackholes.us
45tr.countries.nerd.dk
43above.blackholes.us
42rdts.dnsbl.net.au
41singapore.blackholes.us
39bellsouth.blackholes.us
38telstra.blackholes.us
36dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
36no-more-funn.moensted.dk (result 127.0.0.9 = misc)
30vox.schpider.com
30spam.exsilia.net (union of all results)
28inflow.blackholes.us
28blackholes.uceb.org (result 127.0.0.3 = spam source)
28relays.bl.kundenserver.de
25a2000.blackholes.us
25satos.rbl.cluecentral.net
24infolink.blackholes.us
24no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
24exemptions.ahbl.org (not a blacklist!)
23ph.rbl.cluecentral.net
22malaysia.blackholes.us
22cybercon.blackholes.us
22blackholes.uceb.org (result 127.0.0.2 = open relay)
21yipes.blackholes.us
21rackspace.blackholes.us
21spam.exsilia.net (result 127.0.0.2 = spam source)
16thailand.blackholes.us
16eli.blackholes.us
16covad.blackholes.us
14blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
13spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
13blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
10blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
9spam.exsilia.net (result 127.0.0.3 = virus source)
8broadwing.blackholes.us
8no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
8bl.deadbeef.com
7spamsources.yamta.org (result 127.0.0.2 = spam source)
7affinity.blackholes.us
6pajo.blackholes.us
6burst.blackholes.us
6omrs.dnsbl.net.au
5dnsbl.sorbs.net (result 127.0.0.5 = open relay)
5owps.dnsbl.net.au
5t3direct.dnsbl.net.au
4dev.null.dk
4blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
3olm.blackholes.us
3blackholes.uceb.org (result 127.0.0.4 = spam source network)
3dnsbl.sorbs.net (result 127.0.0.7 = open formmail.cgi)
3dnsbl.njabl.org (result 127.0.0.8 = open formmail.cgi)
3blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
2maxim.blackholes.us
2epoch.blackholes.us
2blackholes.uceb.org (result 127.0.0.8 = spam source with fake sender)
1navisite.blackholes.us
1ciberlynx.blackholes.us
1dnsbl.njabl.org (result 127.0.0.5 = relay output)
1no-more-funn.moensted.dk (result 127.0.0.8 = open web form)
1blackholes.five-ten-sg.com (result 127.0.0.6 = open relay)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems.

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
15859(total number of IP addresses whose names were tested, including 379 at SDSC)
7673(union of all domain zones)
4696abuse.rfc-ignorant.org
3780rddn.dnsbl.net.au
1129whois.rfc-ignorant.org (union of all results)
620bulk.rhs.mailpolice.com
571whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
558whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
533blackhole.securitysage.com
168bl.deadbeef.com
122rhsbl.ahbl.org
67porn.rhs.mailpolice.com
12postmaster.rfc-ignorant.org
10dsn.rfc-ignorant.org (zone not intended for this use)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
8642(total number of domains tested, including 226 at SDSC)
3204(union of all domain zones)
1185bulk.rhs.mailpolice.com
882whois.rfc-ignorant.org (union of all results)
829abuse.rfc-ignorant.org
758whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
705blackhole.securitysage.com
461dsn.rfc-ignorant.org
445postmaster.rfc-ignorant.org
124whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
76rhsbl.ahbl.org
59bl.deadbeef.com
58porn.rhs.mailpolice.com
33ex.dnsbl.org (union of all results)
31ex.dnsbl.org (result 127.0.0.2 = spamsites)
20rddn.dnsbl.net.au (zone not intended for this use)
2ex.dnsbl.org (result 127.0.0.3 = spam source)
1rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
1rhsbl.sorbs.net (union of all results)

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 7 December 2003.