Blacklists Compared

17 January 2004

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the exemptions.ahbl.org and query.bondedsender.org zones because they are not blacklists, and because it is too aggressive to be widely useful the block.blars.org zone is also excluded.

HitsDNS Zone
17386(total number of IP addresses tested, including 351 at SDSC)
13229(union of most IP zones)
8428t1.dnsbl.net.au
8204dnsbl.sorbs.net (union of all results)
7691block.blars.org
7185blackholes.five-ten-sg.com (union of all results)
6160blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
5792sbl-xbl.spamhaus.org (union of all results)
5672unconfirmed.dsbl.org
5519dsbl.dnsbl.net.au
5519list.dsbl.org
5229dnsbl.sorbs.net (result 127.0.0.10 = dialup)
5051dynablock.njabl.org
4420cbl.abuseat.org
4405xbl.spamhaus.org
4405sbl-xbl.spamhaus.org (result 127.0.0.4 = Spamhaus XBL)
4174dnsbl.njabl.org (union of all results)
3629no-more-funn.moensted.dk (union of all results)
3033bl.spamcop.net
2910sbl.csma.biz
2241cn-kr.blackholes.us (union of all results)
2013dnsbl.njabl.org (result 127.0.0.9 = open proxy)
1804ipwhois.rfc-ignorant.org
1744l2.spews.dnsbl.sorbs.net
1680no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
1659dnsbl.ahbl.org (union of all results)
1627spam.wytnij.to
1566sbl-xbl.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
1566sbl.spamhaus.org
1523no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
1500bl.csma.biz
1498dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
1462unsure.nether.net
1445l1.spews.dnsbl.sorbs.net
1445spews.dnsbl.net.au
1301dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
1268cn-kr.blackholes.us (result 127.0.0.2 = China)
1268china.blackholes.us
1203psbl.surriel.com
1175dnsbl.njabl.org (result 127.0.0.3 = dialup)
1074dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
973cn-kr.blackholes.us (result 127.0.0.3 = Korea)
973korea.blackholes.us
961korea.services.net
771rmst.dnsbl.net.au
746blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
726dnsbl.njabl.org (result 127.0.0.4 = spam source)
724dnsbl.sorbs.net (result 127.0.0.6 = spam source)
720ybl.megacity.org
686spamsources.fabel.dk
583dnsbl.ahbl.org (result 127.0.0.4 = spam source)
511pss.spambusters.org.ar
510blackholes.intersil.net
480cw.blackholes.us
408relays.visi.com
401blacklist.spambag.org
394probes.dnsbl.net.au
385spamguard.leadmon.net (union of all results)
373spamguard.leadmon.net (result 127.0.0.2 = dialup)
350comcast.blackholes.us
316opm.blitzed.org
309level3.blackholes.us
290relaywatcher.n13mbl.com
270dnsbl.njabl.org (result 127.0.0.2 = source or relay)
249brazil.blackholes.us
235no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
234rr.blackholes.us
222blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
214relays.ordb.org
208taiwan.blackholes.us
196no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
192dialup.blacklist.jippg.org (union of all results)
189dialup.blacklist.jippg.org (result 127.0.0.3 = dialup outside Japan)
184ricn.dnsbl.net.au
177japan.blackholes.us
174work.drbl.croco.net
167dnsbl.antispam.or.id
160spam.dnsrbl.net
146charter.blackholes.us
142mail-abuse.blacklist.jippg.org
138multihop.dsbl.org
132qwest.blackholes.us
130russia.blackholes.us
128verio.blackholes.us
122osrs.dnsbl.net.au
121xo.blackholes.us
115wanadoo-fr.blackholes.us
112dnsbl.sorbs.net (result 127.0.0.5 = open relay)
107internap.blackholes.us
105dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
98relays.bl.kundenserver.de
97interbusiness.blackholes.us
96singapore.blackholes.us
92sbbl.they.com
83hongkong.blackholes.us
82query.bondedsender.org (not a blacklist!)
81flowgoaway.com
76mexico.blackholes.us
76infolink.blackholes.us
74relays.nether.net
71dun.dnsrbl.net
70above.blackholes.us
70osps.dnsbl.net.au
70ohps.dnsbl.net.au
64argentina.blackholes.us
62dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
58tr.countries.nerd.dk
56turkey.blackholes.us
50yipes.blackholes.us
49rogers.blackholes.us
49dnsbl.sorbs.net (result 127.0.0.7 = open formmail.cgi)
44he.blackholes.us
44bellsouth.blackholes.us
39blackholes.brainerd.net
38a2000.blackholes.us
36inflow.blackholes.us
353y.spam.mrs.kithrup.com
35spam.exsilia.net (union of all results)
34nigeria.blackholes.us
34blackholes.uceb.org (union of all results)
33no-more-funn.moensted.dk (result 127.0.0.9 = misc)
32telstra.blackholes.us
31rdts.dnsbl.net.au
31exemptions.ahbl.org (not a blacklist!)
29cybercon.blackholes.us
29covad.blackholes.us
28spam.exsilia.net (result 127.0.0.2 = spam source)
23blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
22satos.rbl.cluecentral.net
21rackspace.blackholes.us
20swbell.blackholes.us
20malaysia.blackholes.us
19thailand.blackholes.us
19blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
18ph.rbl.cluecentral.net
17blackholes.uceb.org (result 127.0.0.3 = spam source)
13eli.blackholes.us
12spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
11blackholes.uceb.org (result 127.0.0.2 = open relay)
11bl.deadbeef.com
10pajo.blackholes.us
10broadwing.blackholes.us
9affinity.blackholes.us
8olm.blackholes.us
8burst.blackholes.us
8blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
7spamsources.yamta.org (result 127.0.0.2 = spam source)
7spam.exsilia.net (result 127.0.0.3 = virus source)
6no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
5epoch.blackholes.us
5owps.dnsbl.net.au
5dev.null.dk
4maxim.blackholes.us
4blackholes.uceb.org (result 127.0.0.4 = spam source network)
4no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
4blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
3dialup.blacklist.jippg.org (result 127.0.0.4 = dialup in Japan)
3dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
2navisite.blackholes.us
2blackholes.uceb.org (result 127.0.0.8 = spam source with fake sender)
2omrs.dnsbl.net.au
2blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
1ciberlynx.blackholes.us
1spamsites.dnsbl.net.au
1dnsbl.njabl.org (result 127.0.0.8 = open formmail.cgi)
1blackholes.five-ten-sg.com (result 127.0.0.6 = open relay)
1dnsbl.ahbl.org (result 127.0.0.15 = open relay)
1dnsbl.ahbl.org (result 127.0.0.127 = misc)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems.

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
17386(total number of IP addresses whose names were tested, including 351 at SDSC)
8747(union of all domain zones)
6205abuse.rfc-ignorant.org
4386rddn.dnsbl.net.au
1376whois.rfc-ignorant.org (union of all results)
702whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
674whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
641bulk.rhs.mailpolice.com
491blackhole.securitysage.com
303rhsbl.ahbl.org
147bl.deadbeef.com
41porn.rhs.mailpolice.com
13dsn.rfc-ignorant.org (zone not intended for this use)
11postmaster.rfc-ignorant.org
4bogusmx.rfc-ignorant.org

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
10383(total number of domains tested, including 210 at SDSC)
4238(union of all domain zones)
1966bulk.rhs.mailpolice.com
1079rhsbl.ahbl.org
995whois.rfc-ignorant.org (union of all results)
937abuse.rfc-ignorant.org
854whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
513blackhole.securitysage.com
496postmaster.rfc-ignorant.org
478dsn.rfc-ignorant.org
141whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
57bogusmx.rfc-ignorant.org
54porn.rhs.mailpolice.com
51bl.deadbeef.com
30ex.dnsbl.org (union of all results)
28ex.dnsbl.org (result 127.0.0.2 = spamsites)
18rddn.dnsbl.net.au (zone not intended for this use)
6rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
6rhsbl.sorbs.net (union of all results)
2ex.dnsbl.org (result 127.0.0.3 = spam source)

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 26 January 2004.