Blacklists Compared

21 August 2004

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the exemptions.ahbl.org and query.bondedsender.org zones because they are not blacklists, and because it is too aggressive to be widely useful the block.blars.org zone is also excluded.

HitsDNS Zone
29150(total number of IP addresses tested, including 437 at SDSC)
23531(union of most IP zones)
17921t1.dnsbl.net.au
17032block.blars.org
15630blackholes.five-ten-sg.com (union of all results)
14916blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
12199sbl-xbl.spamhaus.org (union of all results)
12056dnsbl.sorbs.net (union of all results)
10942xbl.spamhaus.org (union of all results)
10899cbl.abuseat.org
10889xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
10889sbl-xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
8326dynablock.njabl.org
8210unconfirmed.dsbl.org
8178dnsbl.sorbs.net (result 127.0.0.10 = dialup)
8101list.dsbl.org
8100dsbl.dnsbl.net.au
7363no-more-funn.moensted.dk (union of all results)
6395cn-kr.blackholes.us (union of all results)
4099sbl.csma.biz
4094psbl.surriel.com
4077ipwhois.rfc-ignorant.org
4018dnsbl.njabl.org (union of all results)
3890cn-kr.blackholes.us (result 127.0.0.3 = Korea)
3890korea.blackholes.us
3882korea.services.net
3797bl.spamcop.net
3685no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
3545rmst.dnsbl.net.au
3044dnsbl.ahbl.org (union of all results)
2720blacklist.spambag.org
2580wpbl.dnsbl.net.au
2528l2.spews.dnsbl.sorbs.net
2505cn-kr.blackholes.us (result 127.0.0.2 = China)
2505china.blackholes.us
2342dnsbl.njabl.org (result 127.0.0.9 = open proxy)
2122l1.spews.dnsbl.sorbs.net
2117spews.dnsbl.net.au
1972ricn.dnsbl.net.au
1925dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
1858no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
1825pdl.blackholes.us
1780dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
1774spamsources.fabel.dk
1675dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
1496unsure.nether.net
1385sbl-xbl.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
1385sbl.spamhaus.org
1317dnsbl.njabl.org (result 127.0.0.3 = dialup)
1235dnsbl.sorbs.net (result 127.0.0.6 = spam source)
1142spam.wytnij.to
1131xbl.spamhaus.org (result 127.0.0.6 = Blitzed Open Proxy Monitor List)
1131sbl-xbl.spamhaus.org (result 127.0.0.6 = Blitzed Open Proxy Monitor List)
1131opm.blitzed.org
1041bl.csma.biz
1023dnsbl.ahbl.org (result 127.0.0.4 = spam source)
982work.drbl.croco.net
871no-more-funn.moensted.dk (result 127.0.0.9 = misc)
819japan.blackholes.us
788brazil.blackholes.us
739no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
675level3.blackholes.us
623spamguard.leadmon.net (union of all results)
606dun.dnsrbl.net
587probes.dnsbl.net.au
581spamguard.leadmon.net (result 127.0.0.2 = dialup)
567ybl.megacity.org
527taiwan.blackholes.us
461dnsbl.rangers.eu.org (union of all results)
443cw.blackholes.us
392blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
375comcast.blackholes.us
316rr.blackholes.us
302charter.blackholes.us
298dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
277dnsbl.sorbs.net (result 127.0.0.7 = open formmail.cgi)
260blackholes.intersil.net
257mexico.blackholes.us
256russia.blackholes.us
246no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
243dnsbl.rangers.eu.org (result 127.0.0.2 = dialup)
238dnsbl.antispam.or.id
230qwest.blackholes.us
220blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
198dnsbl.njabl.org (result 127.0.0.2 = source or relay)
194hongkong.blackholes.us
180dnsbl.njabl.org (result 127.0.0.4 = spam source)
172relays.ordb.org
170interbusiness.blackholes.us
167argentina.blackholes.us
159turkey.blackholes.us
159tr.countries.nerd.dk
153ohps.dnsbl.net.au
145dnsbl.rangers.eu.org (result 127.0.0.16 = spam haven)
143verio.blackholes.us
127wanadoo-fr.blackholes.us
127flowgoaway.com
124singapore.blackholes.us
111infolink.blackholes.us
110malaysia.blackholes.us
109xo.blackholes.us
109dialup.blacklist.jippg.org (union of all results)
107dialup.blacklist.jippg.org (result 127.0.0.3 = dialup outside Japan)
97multihop.dsbl.org
91dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
89query.bondedsender.org (not a blacklist!)
88osps.dnsbl.net.au
79relays.visi.com
61internap.blackholes.us
60above.blackholes.us
60relays.nether.net
59thailand.blackholes.us
55bellsouth.blackholes.us
55osrs.dnsbl.net.au
54he.blackholes.us
54ph.rbl.cluecentral.net
49dnsbl.rangers.eu.org (result 127.0.0.8 = spam source)
46mail-abuse.blacklist.jippg.org
46blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
42inflow.blackholes.us
42dnsbl.sorbs.net (result 127.0.0.5 = open relay)
42spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
41cybercon.blackholes.us
40telstra.blackholes.us
36blackholes.uceb.org (union of all results)
35blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
34eli.blackholes.us
33swbell.blackholes.us
32dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
31blackholes.brainerd.net
30covad.blackholes.us
29yipes.blackholes.us
29rdts.dnsbl.net.au
26rogers.blackholes.us
26rackspace.blackholes.us
23dnsbl.rangers.eu.org (result 127.0.0.4 = virus notices)
21a2000.blackholes.us
21blackholes.uceb.org (result 127.0.0.3 = spam source)
19nigeria.blackholes.us
17satos.rbl.cluecentral.net
16exemptions.ahbl.org (not a blacklist!)
15blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
14hil.habeas.com
13dnsbl.ahbl.org (result 127.0.0.15 = open relay)
12olm.blackholes.us
12broadwing.blackholes.us
12blackholes.uceb.org (result 127.0.0.2 = open relay)
12sbbl.they.com
12dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
11pajo.blackholes.us
11epoch.blackholes.us
10burst.blackholes.us
10affinity.blackholes.us
8maxim.blackholes.us
8bl.deadbeef.com
7navisite.blackholes.us
7no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
6lauderdale.blackholes.us
6no-more-funn.moensted.dk (result 127.0.0.11 = repeated probes)
5ciberlynx.blackholes.us
5owps.dnsbl.net.au
5blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
4dnsbl.ahbl.org (result 127.0.0.14 = denial-of-service attacker)
3blackholes.uceb.org (result 127.0.0.6 = spam haven)
2relays.bl.kundenserver.de
2dialup.blacklist.jippg.org (result 127.0.0.4 = dialup in Japan)
2no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
2spam.dnsrbl.net
1dnsbl.rangers.eu.org (result 127.0.0.32 = worm source)
1omrs.dnsbl.net.au
1no-more-funn.moensted.dk (result 127.0.0.8 = open web form)
1blackholes.five-ten-sg.com (result 127.0.0.6 = open relay)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems.

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
29150(total number of IP addresses whose names were tested, including 437 at SDSC)
12986(union of all domain zones)
9469abuse.rfc-ignorant.org
6963rddn.dnsbl.net.au
3687whois.rfc-ignorant.org (union of all results)
2324whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
1363whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
842bulk.rhs.mailpolice.com
718rhsbl.ahbl.org
281bl.deadbeef.com
203blackhole.securitysage.com
20postmaster.rfc-ignorant.org
20dsn.rfc-ignorant.org (zone not intended for this use)
13porn.rhs.mailpolice.com
3bogusmx.rfc-ignorant.org
1cart00ney.surriel.com

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
26466(total number of domains tested, including 296 at SDSC)
8546(union of all domain zones)
4048whois.rfc-ignorant.org (union of all results)
3595whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
2514abuse.rfc-ignorant.org
1451bulk.rhs.mailpolice.com
1143rhsbl.ahbl.org
1036postmaster.rfc-ignorant.org
881dsn.rfc-ignorant.org
453whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
452blackhole.securitysage.com
313bogusmx.rfc-ignorant.org
211bl.deadbeef.com
78porn.rhs.mailpolice.com
60ex.dnsbl.org (union of all results)
58ex.dnsbl.org (result 127.0.0.2 = spamsites)
39rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
39rhsbl.sorbs.net (union of all results)
17rddn.dnsbl.net.au (zone not intended for this use)
4cart00ney.surriel.com
3rhsbl.sorbs.net (result 127.0.0.12 = domain does not send mail)
2ex.dnsbl.org (result 127.0.0.3 = spam source)

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 1 September 2004.