Blacklists Compared

9 October 2004

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the exemptions.ahbl.org and query.bondedsender.org zones because they are not blacklists, and because it is too aggressive to be widely useful the block.blars.org zone is also excluded.

HitsDNS Zone
31272(total number of IP addresses tested, including 438 at SDSC)
25806(union of most IP zones)
19586t1.dnsbl.net.au
17586blackholes.five-ten-sg.com (union of all results)
16826blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
12948dnsbl.sorbs.net (union of all results)
11904sbl-xbl.spamhaus.org (union of all results)
10606xbl.spamhaus.org (union of all results)
10547cbl.abuseat.org
10530xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
10528sbl-xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
8944unconfirmed.dsbl.org
8837list.dsbl.org
8824no-more-funn.moensted.dk (union of all results)
8765dsbl.dnsbl.net.au
8438dnsbl.sorbs.net (result 127.0.0.10 = dialup)
8419dynablock.njabl.org
8236cn-kr.blackholes.us (union of all results)
5395cn-kr.blackholes.us (result 127.0.0.3 = Korea)
5395korea.blackholes.us
5390korea.services.net
5038ipwhois.rfc-ignorant.org
4940no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
4900sbl.csma.biz
4855psbl.surriel.com
4760rmst.dnsbl.net.au
4284bl.spamcop.net
3842dnsbl.njabl.org (union of all results)
3727blacklist.spambag.org
3029wpbl.dnsbl.net.au
2900l2.spews.dnsbl.sorbs.net
2841cn-kr.blackholes.us (result 127.0.0.2 = China)
2841china.blackholes.us
2803dnsbl.ahbl.org (union of all results)
2602ricn.dnsbl.net.au
2592dnsbl.njabl.org (result 127.0.0.9 = open proxy)
2486spews.dnsbl.net.au
2470l1.spews.dnsbl.sorbs.net
2229block.blars.org
2025dnsbl.sorbs.net (result 127.0.0.6 = spam source)
1943spamsources.fabel.dk
1843no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
1790bl.csma.biz
1767pdl.blackholes.us
1674dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
1571dnsbl.sorbs.net (result 127.0.0.7 = open formmail.cgi)
1560spam.wytnij.to
1415sbl-xbl.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
1415sbl.spamhaus.org
1396dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
1146dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
1016dnsbl.ahbl.org (result 127.0.0.4 = spam source)
992no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
972unsure.nether.net
964dnsbl.njabl.org (result 127.0.0.3 = dialup)
933work.drbl.croco.net
848no-more-funn.moensted.dk (result 127.0.0.9 = misc)
800brazil.blackholes.us
730bl.spamcannibal.org
707japan.blackholes.us
696level3.blackholes.us
681dnsbl.rangers.eu.org (union of all results)
679opm.blitzed.org
675xbl.spamhaus.org (result 127.0.0.6 = Blitzed Open Proxy Monitor List)
675sbl-xbl.spamhaus.org (result 127.0.0.6 = Blitzed Open Proxy Monitor List)
669probes.dnsbl.net.au
592taiwan.blackholes.us
578spamguard.leadmon.net (union of all results)
525ybl.megacity.org
490spamguard.leadmon.net (result 127.0.0.2 = dialup)
471comcast.blackholes.us
465blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
455dnsbl.rangers.eu.org (result 127.0.0.2 = dialup)
363dnsbl.antispam.or.id
357charter.blackholes.us
326cw.blackholes.us
319mexico.blackholes.us
309rr.blackholes.us
229blackholes.intersil.net
228no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
219interbusiness.blackholes.us
207qwest.blackholes.us
205blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
196relaywatcher.n13mbl.com
192russia.blackholes.us
192hongkong.blackholes.us
172dnsbl.njabl.org (result 127.0.0.2 = source or relay)
165dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
158argentina.blackholes.us
157ohps.dnsbl.net.au
152wanadoo-fr.blackholes.us
145tr.countries.nerd.dk
142turkey.blackholes.us
140verio.blackholes.us
134dnsbl.rangers.eu.org (result 127.0.0.16 = spam haven)
127dnsbl.njabl.org (result 127.0.0.4 = spam source)
124flowgoaway.com
116query.bondedsender.org (not a blacklist!)
114dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
112xo.blackholes.us
112singapore.blackholes.us
109osps.dnsbl.net.au
99multihop.dsbl.org
96infolink.blackholes.us
94internap.blackholes.us
88spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
87malaysia.blackholes.us
87relays.ordb.org
72thailand.blackholes.us
72dnsbl.rangers.eu.org (result 127.0.0.8 = spam source)
63cybercon.blackholes.us
62dialup.blacklist.jippg.org (union of all results)
59dialup.blacklist.jippg.org (result 127.0.0.3 = dialup outside Japan)
57relays.nether.net
54ph.rbl.cluecentral.net
53above.blackholes.us
48mail-abuse.blacklist.jippg.org
44telstra.blackholes.us
43he.blackholes.us
43dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
43osrs.dnsbl.net.au
42covad.blackholes.us
39inflow.blackholes.us
37bellsouth.blackholes.us
33blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
31blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
30rackspace.blackholes.us
30blackholes.uceb.org (union of all results)
28swbell.blackholes.us
28rogers.blackholes.us
28nigeria.blackholes.us
28dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
27blackholes.brainerd.net
26yipes.blackholes.us
26rdts.dnsbl.net.au
25broadwing.blackholes.us
23hil.habeas.com
20blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
19dnsbl.rangers.eu.org (result 127.0.0.4 = virus notices)
18dnsbl.sorbs.net (result 127.0.0.5 = open relay)
16exemptions.ahbl.org (not a blacklist!)
14a2000.blackholes.us
14blackholes.uceb.org (result 127.0.0.3 = spam source)
12eli.blackholes.us
12blackholes.uceb.org (result 127.0.0.2 = open relay)
11maxim.blackholes.us
10satos.rbl.cluecentral.net
8epoch.blackholes.us
8affinity.blackholes.us
8dnsbl.ahbl.org (result 127.0.0.15 = open relay)
7burst.blackholes.us
7bl.deadbeef.com
6olm.blackholes.us
6navisite.blackholes.us
5pajo.blackholes.us
5owps.dnsbl.net.au
5relays.bl.kundenserver.de
5blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
4blackholes.uceb.org (result 127.0.0.6 = spam haven)
3ciberlynx.blackholes.us
3dialup.blacklist.jippg.org (result 127.0.0.4 = dialup in Japan)
2spamsites.dnsbl.net.au
2omrs.dnsbl.net.au
1dnsbl.rangers.eu.org (result 127.0.0.32 = worm source)
1dnsbl.njabl.org (result 127.0.0.8 = open formmail.cgi)
1no-more-funn.moensted.dk (result 127.0.0.8 = open web form)
1no-more-funn.moensted.dk (result 127.0.0.11 = repeated probes)
1no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
1no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
1blackholes.five-ten-sg.com (result 127.0.0.6 = open relay)
1dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems.

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
31272(total number of IP addresses whose names were tested, including 438 at SDSC)
13109(union of all domain zones)
9861abuse.rfc-ignorant.org
6830rddn.dnsbl.net.au
4611whois.rfc-ignorant.org (union of all results)
2842whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
1770whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
701bulk.rhs.mailpolice.com
662rhsbl.ahbl.org
289bl.deadbeef.com
29postmaster.rfc-ignorant.org
22dsn.rfc-ignorant.org (zone not intended for this use)
21porn.rhs.mailpolice.com
10blackhole.securitysage.com
1bogusmx.rfc-ignorant.org

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
28279(total number of domains tested, including 302 at SDSC)
10457(union of all domain zones)
5873whois.rfc-ignorant.org (union of all results)
5432whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
2626abuse.rfc-ignorant.org
1328bulk.rhs.mailpolice.com
1105rhsbl.ahbl.org
1020postmaster.rfc-ignorant.org
840dsn.rfc-ignorant.org
473blackhole.securitysage.com
441whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
298bogusmx.rfc-ignorant.org
275bl.deadbeef.com
81porn.rhs.mailpolice.com
67rddn.dnsbl.net.au (zone not intended for this use)
46rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
46rhsbl.sorbs.net (union of all results)
19ex.dnsbl.org
3cart00ney.surriel.com

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 20 October 2004.