Blacklists Compared

30 April 2005

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the exemptions.ahbl.org and query.bondedsender.org zones because they are not blacklists.

HitsDNS Zone
37576(total number of IP addresses tested, including 425 at SDSC)
32191(union of most IP zones)
22064t1.dnsbl.net.au
19075blackholes.five-ten-sg.com (union of all results)
18273blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
16347sbl-xbl.spamhaus.org (union of all results)
16251dnsbl.sorbs.net (union of all results)
14526xbl.spamhaus.org (union of all results)
13261sbl-xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
13258xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
13258cbl.abuseat.org
11561dnsbl.sorbs.net (result 127.0.0.10 = dialup)
10702cn-kr.blackholes.us (union of all results)
10343unconfirmed.dsbl.org
10246list.dsbl.org
10242dsbl.dnsbl.net.au
9557no-more-funn.moensted.dk (union of all results)
8964dynablock.njabl.org
8397rmst.dnsbl.net.au
7188psbl.surriel.com
7011sbl.csma.biz
6139cn-kr.blackholes.us (result 127.0.0.3 = Korea)
6139korea.blackholes.us
6126korea.services.net
6020no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
5788combined-hib.dnsiplists.completewhois.com (union of all results)
5775combined-hib.dnsiplists.completewhois.com (result 127.0.0.4 = bad whois data)
4840bl.spamcop.net
4563cn-kr.blackholes.us (result 127.0.0.2 = China)
4563china.blackholes.us
4290bl.csma.biz
4136dnsbl.njabl.org (union of all results)
4073l2.spews.dnsbl.sorbs.net
3961blacklist.spambag.org
3677l1.spews.dnsbl.sorbs.net
3530spews.dnsbl.net.au
3421dnsbl.njabl.org (result 127.0.0.9 = open proxy)
3343xbl.spamhaus.org (result 127.0.0.6 = Blitzed Open Proxy Monitor List)
3342opm.blitzed.org
3341sbl-xbl.spamhaus.org (result 127.0.0.6 = Blitzed Open Proxy Monitor List)
3126dnsbl.ahbl.org (union of all results)
2974wpbl.dnsbl.net.au
2641sbl-xbl.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
2631sbl.spamhaus.org
2503dnsbl.sorbs.net (result 127.0.0.7 = open formmail.cgi)
2245dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
2231spamsources.fabel.dk
2175xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
2174sbl-xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
1955ricn.dnsbl.net.au
1912spam.wytnij.to
1849dnsbl.antispam.or.id
1846dnsbl.rangers.eu.org (union of all results)
1808dnsbl.sorbs.net (result 127.0.0.6 = spam source)
1724no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
1643dnsbl.rangers.eu.org (result 127.0.0.2 = dialup)
1542dnsbl.regedit64.net
1399dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
1364comcast.blackholes.us
1292dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
1268pdl.blackholes.us
1207unsure.nether.net
1163brazil.blackholes.us
1075bl.spamcannibal.org
1031no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
843dnsbl.ahbl.org (result 127.0.0.4 = spam source)
762probes.dnsbl.net.au
639japan.blackholes.us
622no-more-funn.moensted.dk (result 127.0.0.9 = misc)
523dnsbl.njabl.org (result 127.0.0.3 = dialup)
509taiwan.blackholes.us
457russia.blackholes.us
422blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
372mci.blackholes.us
344charter.blackholes.us
320argentina.blackholes.us
276mail-abuse.blacklist.jippg.org
275rr.blackholes.us
258mexico.blackholes.us
251blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
249cw.blackholes.us
242level3.blackholes.us
222ybl.megacity.org
215blackholes.intersil.net
203interbusiness.blackholes.us
171turkey.blackholes.us
170no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
164query.bondedsender.org (not a blacklist!)
153wanadoo-fr.blackholes.us
148qwest.blackholes.us
147hongkong.blackholes.us
142ohps.dnsbl.net.au
142tr.countries.nerd.dk
136thailand.blackholes.us
136dnsbl.njabl.org (result 127.0.0.2 = open relay)
135dnsbl.rangers.eu.org (result 127.0.0.16 = spam haven)
123singapore.blackholes.us
123dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
114internap.blackholes.us
109relays.ordb.org
107dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
105verio.blackholes.us
99malaysia.blackholes.us
93flowgoaway.com
91xo.blackholes.us
89rogers.blackholes.us
85multihop.dsbl.org
80cybercon.blackholes.us
77osps.dnsbl.net.au
72dnsbl.njabl.org (result 127.0.0.4 = spam source)
66blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
61above.blackholes.us
57dnsbl.rangers.eu.org (result 127.0.0.8 = spam source)
54bellsouth.blackholes.us
47he.blackholes.us
46lauderdale.blackholes.us
42a2000.blackholes.us
41yipes.blackholes.us
37blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
37dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
36osrs.dnsbl.net.au
32covad.blackholes.us
31telstra.blackholes.us
30relays.nether.net
29inflow.blackholes.us
24infolink.blackholes.us
23exemptions.ahbl.org (not a blacklist!)
18rackspace.blackholes.us
17rdts.dnsbl.net.au
16blackholes.uceb.org (union of all results)
15combined-hib.dnsiplists.completewhois.com (result 127.0.0.2 = unallocated IP address)
14eli.blackholes.us
14affinity.blackholes.us
13hil.habeas.com
13blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
12blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
11swbell.blackholes.us
11burst.blackholes.us
11dnsbl.sorbs.net (result 127.0.0.5 = open relay)
11dnsbl.rangers.eu.org (result 127.0.0.4 = virus notices)
10broadwing.blackholes.us
10spamguard.leadmon.net (union of all results)
9navisite.blackholes.us
9epoch.blackholes.us
9blackholes.uceb.org (result 127.0.0.3 = spam source)
9spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
8nigeria.blackholes.us
7blackholes.uceb.org (result 127.0.0.2 = open relay)
7dialup.blacklist.jippg.org (result 127.0.0.3 = dialup outside Japan)
7blackholes.brainerd.net
7dialup.blacklist.jippg.org (union of all results)
6olm.blackholes.us
6owps.dnsbl.net.au
4dnsbl.ahbl.org (result 127.0.0.15 = open relay)
3pajo.blackholes.us
3maxim.blackholes.us
2ciberlynx.blackholes.us
2no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
2bl.deadbeef.com
1media3.blackholes.us
1dnsbl.rangers.eu.org (result 127.0.0.32 = worm source)
1owfs.dnsbl.net.au
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
1blackholes.five-ten-sg.com (result 127.0.0.6 = open relay)
1dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems.

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
37576(total number of IP addresses whose names were tested, including 425 at SDSC)
16926(union of all domain zones)
12985abuse.rfc-ignorant.org
8150rddn.dnsbl.net.au
4469whois.rfc-ignorant.org (union of all results)
3904dynamic.rhs.mailpolice.com
3178whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
1466webmail.rhs.mailpolice.com
1293whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
670rhsbl.ahbl.org
620bulk.rhs.mailpolice.com
372adv.rhs.mailpolice.com
314bl.deadbeef.com
22postmaster.rfc-ignorant.org
9dsn.rfc-ignorant.org (zone not intended for this use)
7blackhole.securitysage.com
3bogusmx.rfc-ignorant.org
1rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
1porn.rhs.mailpolice.com
1ex.dnsbl.org
1rhsbl.sorbs.net (union of all results)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
25008(total number of domains tested, including 353 at SDSC)
6532(union of all domain zones)
2702whois.rfc-ignorant.org (union of all results)
2270whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
1953abuse.rfc-ignorant.org
975postmaster.rfc-ignorant.org
922webmail.rhs.mailpolice.com
834rhsbl.ahbl.org
778dsn.rfc-ignorant.org
444bulk.rhs.mailpolice.com
432whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
372bogusmx.rfc-ignorant.org
211blackhole.securitysage.com
178adv.rhs.mailpolice.com
173bl.deadbeef.com
77porn.rhs.mailpolice.com
41rddn.dnsbl.net.au (zone not intended for this use)
38rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
38rhsbl.sorbs.net (union of all results)
18dynamic.rhs.mailpolice.com
16ex.dnsbl.org
1cart00ney.surriel.com

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 11 May 2005.