Blacklists Compared

25 December 2004

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the exemptions.ahbl.org and query.bondedsender.org zones because they are not blacklists, and because it is too aggressive to be widely useful the block.blars.org zone is also excluded.

HitsDNS Zone
30614(total number of IP addresses tested, including 381 at SDSC)
26236(union of most IP zones)
21244t1.dnsbl.net.au
18682blackholes.five-ten-sg.com (union of all results)
17974blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
14971dnsbl.sorbs.net (union of all results)
10882sbl-xbl.spamhaus.org (union of all results)
9885dnsbl.sorbs.net (result 127.0.0.10 = dialup)
9851cn-kr.blackholes.us (union of all results)
9770unconfirmed.dsbl.org
9693list.dsbl.org
9689dsbl.dnsbl.net.au
9659no-more-funn.moensted.dk (union of all results)
9611xbl.spamhaus.org (union of all results)
9561cbl.abuseat.org
9512xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
9507sbl-xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
8152dynablock.njabl.org
7163cn-kr.blackholes.us (result 127.0.0.3 = Korea)
7163korea.blackholes.us
7157korea.services.net
6939sbl.csma.biz
6429rmst.dnsbl.net.au
6409no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
5705combined-hib.dnsiplists.completewhois.com (union of all results)
5691combined-hib.dnsiplists.completewhois.com (result 127.0.0.4 = bad whois data)
5444psbl.surriel.com
4499bl.csma.biz
4096bl.spamcop.net
3820dnsbl.njabl.org (union of all results)
3498blacklist.spambag.org
2870wpbl.dnsbl.net.au
2842dnsbl.sorbs.net (result 127.0.0.7 = open formmail.cgi)
2715dnsbl.njabl.org (result 127.0.0.9 = open proxy)
2688cn-kr.blackholes.us (result 127.0.0.2 = China)
2688china.blackholes.us
2660dnsbl.ahbl.org (union of all results)
2589ricn.dnsbl.net.au
2499spamsources.fabel.dk
2142l2.spews.dnsbl.sorbs.net
2009dnsbl.sorbs.net (result 127.0.0.6 = spam source)
1881dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
1804l1.spews.dnsbl.sorbs.net
1651pdl.blackholes.us
1636probes.dnsbl.net.au
1557dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
1486no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
1425sbl.spamhaus.org
1390sbl-xbl.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
1220dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
1135spews.dnsbl.net.au
1103spam.wytnij.to
1056unsure.nether.net
1047dnsbl.antispam.or.id
951no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
892dnsbl.regedit64.net
877dnsbl.rangers.eu.org (union of all results)
872dnsbl.njabl.org (result 127.0.0.3 = dialup)
835brazil.blackholes.us
796work.drbl.croco.net
787bl.spamcannibal.org
675dnsbl.ahbl.org (result 127.0.0.4 = spam source)
674dnsbl.rangers.eu.org (result 127.0.0.2 = dialup)
635no-more-funn.moensted.dk (result 127.0.0.9 = misc)
635block.blars.org
603opm.blitzed.org
598sbl-xbl.spamhaus.org (result 127.0.0.6 = Blitzed Open Proxy Monitor List)
596xbl.spamhaus.org (result 127.0.0.6 = Blitzed Open Proxy Monitor List)
514japan.blackholes.us
486ybl.megacity.org
480level3.blackholes.us
419taiwan.blackholes.us
402blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
296mexico.blackholes.us
293charter.blackholes.us
258rr.blackholes.us
248cw.blackholes.us
242comcast.blackholes.us
211blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
210interbusiness.blackholes.us
210argentina.blackholes.us
202qwest.blackholes.us
193no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
178hongkong.blackholes.us
172russia.blackholes.us
150blackholes.intersil.net
140query.bondedsender.org (not a blacklist!)
135wanadoo-fr.blackholes.us
130dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
130dnsbl.njabl.org (result 127.0.0.2 = source or relay)
128mail-abuse.blacklist.jippg.org
127tr.countries.nerd.dk
119dnsbl.njabl.org (result 127.0.0.4 = spam source)
115ohps.dnsbl.net.au
115relays.ordb.org
114dnsbl.rangers.eu.org (result 127.0.0.16 = spam haven)
108verio.blackholes.us
108turkey.blackholes.us
103dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
96xo.blackholes.us
90above.blackholes.us
87singapore.blackholes.us
79osps.dnsbl.net.au
72dialup.blacklist.jippg.org (result 127.0.0.3 = dialup outside Japan)
72dialup.blacklist.jippg.org (union of all results)
71internap.blackholes.us
71multihop.dsbl.org
69cybercon.blackholes.us
69dnsbl.rangers.eu.org (result 127.0.0.8 = spam source)
67malaysia.blackholes.us
64yipes.blackholes.us
63thailand.blackholes.us
54blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
53bellsouth.blackholes.us
52flowgoaway.com
48spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
48spamguard.leadmon.net (union of all results)
42telstra.blackholes.us
40he.blackholes.us
39nigeria.blackholes.us
38relays.nether.net
38ph.rbl.cluecentral.net
37dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
36inflow.blackholes.us
36blackholes.brainerd.net
34swbell.blackholes.us
32osrs.dnsbl.net.au
32dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
30rogers.blackholes.us
30covad.blackholes.us
26rdts.dnsbl.net.au
25eli.blackholes.us
25blackholes.uceb.org (union of all results)
24a2000.blackholes.us
23blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
22dnsbl.sorbs.net (result 127.0.0.5 = open relay)
19dnsbl.rangers.eu.org (result 127.0.0.4 = virus notices)
19dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)
17exemptions.ahbl.org (not a blacklist!)
15blackholes.uceb.org (result 127.0.0.3 = spam source)
15hil.habeas.com
14combined-hib.dnsiplists.completewhois.com (result 127.0.0.2 = unallocated IP address)
14dnsbl.ahbl.org (result 127.0.0.15 = open relay)
13rackspace.blackholes.us
10blackholes.uceb.org (result 127.0.0.2 = open relay)
10blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
9navisite.blackholes.us
9satos.rbl.cluecentral.net
7infolink.blackholes.us
7affinity.blackholes.us
6olm.blackholes.us
5epoch.blackholes.us
5omrs.dnsbl.net.au
5blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
4pajo.blackholes.us
4maxim.blackholes.us
4burst.blackholes.us
4broadwing.blackholes.us
2ciberlynx.blackholes.us
2owps.dnsbl.net.au
2relays.bl.kundenserver.de
2blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
2bl.deadbeef.com
1dnsbl.rangers.eu.org (result 127.0.0.32 = worm source)
1no-more-funn.moensted.dk (result 127.0.0.8 = open web form)
1blackholes.five-ten-sg.com (result 127.0.0.6 = open relay)
1dnsbl.ahbl.org (result 127.0.0.14 = denial-of-service attacker)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems.

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
30614(total number of IP addresses whose names were tested, including 381 at SDSC)
12091(union of all domain zones)
9005abuse.rfc-ignorant.org
6566rddn.dnsbl.net.au
3449whois.rfc-ignorant.org (union of all results)
2834dynamic.rhs.mailpolice.com
2617whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
1304webmail.rhs.mailpolice.com
832whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
406rhsbl.ahbl.org
349bulk.rhs.mailpolice.com
304adv.rhs.mailpolice.com
245bl.deadbeef.com
20postmaster.rfc-ignorant.org
16dsn.rfc-ignorant.org (zone not intended for this use)
6porn.rhs.mailpolice.com
4blackhole.securitysage.com
4bogusmx.rfc-ignorant.org

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
25726(total number of domains tested, including 267 at SDSC)
7290(union of all domain zones)
3050whois.rfc-ignorant.org (union of all results)
2641whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
2234abuse.rfc-ignorant.org
1050postmaster.rfc-ignorant.org
919webmail.rhs.mailpolice.com
862dsn.rfc-ignorant.org
697bulk.rhs.mailpolice.com
685rhsbl.ahbl.org
409whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
286bogusmx.rfc-ignorant.org
243bl.deadbeef.com
231blackhole.securitysage.com
184adv.rhs.mailpolice.com
51porn.rhs.mailpolice.com
50rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
50rhsbl.sorbs.net (union of all results)
45rddn.dnsbl.net.au (zone not intended for this use)
18dynamic.rhs.mailpolice.com
18ex.dnsbl.org
2cart00ney.surriel.com

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 4 January 2005.