Blacklists Compared

25 June 2005

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the exemptions.ahbl.org and query.bondedsender.org zones because they are not blacklists.

HitsDNS Zone
39446(total number of IP addresses tested, including 384 at SDSC)
33802(union of most IP zones)
22379t1.dnsbl.net.au
16595dnsbl.sorbs.net (union of all results)
13065sbl-xbl.spamhaus.org (union of all results)
12025cbl.abuseat.org
11652dnsbl.sorbs.net (result 127.0.0.10 = dialup)
11402xbl.spamhaus.org (union of all results)
10155sbl-xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
10107xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
9884rmst.dnsbl.net.au
9661dynablock.njabl.org
9165unconfirmed.dsbl.org
9127list.dsbl.org
9123dsbl.dnsbl.net.au
8701blackholes.five-ten-sg.com (union of all results)
8681no-more-funn.moensted.dk (union of all results)
8582cn-kr.blackholes.us (union of all results)
8292blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
7410psbl.surriel.com
6620sbl.csma.biz
5823korea.services.net
5411combined-hib.dnsiplists.completewhois.com (union of all results)
5376combined-hib.dnsiplists.completewhois.com (result 127.0.0.4 = bad whois data)
5197cn-kr.blackholes.us (result 127.0.0.3 = Korea)
5197korea.blackholes.us
5043no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
4249bl.spamcop.net
4123blacklist.spambag.org
3421bl.csma.biz
3385cn-kr.blackholes.us (result 127.0.0.2 = China)
3385china.blackholes.us
3129dnsbl.njabl.org (union of all results)
3061l2.spews.dnsbl.sorbs.net
2890dnsbl.ahbl.org (union of all results)
2766dnsbl.sorbs.net (result 127.0.0.7 = open formmail.cgi)
2678l1.spews.dnsbl.sorbs.net
2466spamsources.fabel.dk
2449spews.dnsbl.net.au
2403dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
2377dnsbl.njabl.org (result 127.0.0.9 = open proxy)
2203wpbl.dnsbl.net.au
2193sbl-xbl.spamhaus.org (result 127.0.0.6 = Blitzed Open Proxy Monitor List)
2189xbl.spamhaus.org (result 127.0.0.6 = Blitzed Open Proxy Monitor List)
2100dnsbl.rangers.eu.org (union of all results)
1990opm.blitzed.org
1819dnsbl.rangers.eu.org (result 127.0.0.2 = dialup)
1755dnsbl.sorbs.net (result 127.0.0.6 = spam source)
1681dnsbl.regedit64.net
1670sbl-xbl.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
1665sbl.spamhaus.org
1627ricn.dnsbl.net.au
1589no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
1440dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
1333pdl.blackholes.us
1328brazil.blackholes.us
1314no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
1289sbl-xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
1284xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
1198unsure.nether.net
1119bl.spamcannibal.org
946spam.wytnij.to
942taiwan.blackholes.us
896dnsbl.antispam.or.id
893dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
852comcast.blackholes.us
756japan.blackholes.us
560no-more-funn.moensted.dk (result 127.0.0.9 = misc)
551rr.blackholes.us
545probes.dnsbl.net.au
508dnsbl.njabl.org (result 127.0.0.3 = dialup)
480dnsbl.ahbl.org (result 127.0.0.4 = spam source)
463hongkong.blackholes.us
423russia.blackholes.us
403charter.blackholes.us
401mci.blackholes.us
393argentina.blackholes.us
306mexico.blackholes.us
265cw.blackholes.us
255interbusiness.blackholes.us
225turkey.blackholes.us
225tr.countries.nerd.dk
223blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
197query.bondedsender.org (not a blacklist!)
190blackholes.intersil.net
187thailand.blackholes.us
187dnsbl.rangers.eu.org (result 127.0.0.16 = spam haven)
182no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
176ybl.megacity.org
172qwest.blackholes.us
171level3.blackholes.us
169dnsbl.njabl.org (result 127.0.0.2 = open relay)
163mail-abuse.blacklist.jippg.org
154singapore.blackholes.us
146malaysia.blackholes.us
125blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
123internap.blackholes.us
118verio.blackholes.us
106ohps.dnsbl.net.au
96dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
93wanadoo-fr.blackholes.us
91flowgoaway.com
88xo.blackholes.us
83relays.ordb.org
82dnsbl.njabl.org (result 127.0.0.4 = spam source)
76dnsbl.rangers.eu.org (result 127.0.0.8 = spam source)
75cybercon.blackholes.us
74above.blackholes.us
68multihop.dsbl.org
61dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
52he.blackholes.us
52bellsouth.blackholes.us
51rogers.blackholes.us
51broadwing.blackholes.us
50osps.dnsbl.net.au
41telstra.blackholes.us
40covad.blackholes.us
35inflow.blackholes.us
33osrs.dnsbl.net.au
30a2000.blackholes.us
30exemptions.ahbl.org (not a blacklist!)
29blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
26relays.nether.net
24combined-hib.dnsiplists.completewhois.com (result 127.0.0.2 = unallocated IP address)
23eli.blackholes.us
22blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
20rdts.dnsbl.net.au
18infolink.blackholes.us
16dnsbl.rangers.eu.org (result 127.0.0.4 = virus notices)
14blackholes.uceb.org (union of all results)
13rackspace.blackholes.us
12yipes.blackholes.us
12blackholes.brainerd.net
11swbell.blackholes.us
11lauderdale.blackholes.us
11combined-hib.dnsiplists.completewhois.com (result 127.0.0.3 = hijacked network)
11spamguard.leadmon.net (union of all results)
10epoch.blackholes.us
10spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
10hil.habeas.com
9dnsbl.sorbs.net (result 127.0.0.5 = open relay)
8nigeria.blackholes.us
8blackholes.uceb.org (result 127.0.0.3 = spam source)
7maxim.blackholes.us
6olm.blackholes.us
6affinity.blackholes.us
5pajo.blackholes.us
5navisite.blackholes.us
5dnsbl.ahbl.org (result 127.0.0.15 = open relay)
5dialup.blacklist.jippg.org (union of all results)
4burst.blackholes.us
4blackholes.uceb.org (result 127.0.0.2 = open relay)
4dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
3owps.dnsbl.net.au
3omrs.dnsbl.net.au
3dialup.blacklist.jippg.org (result 127.0.0.4 = dialup in Japan)
3no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
3blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
3blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
3blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
2blackholes.uceb.org (result 127.0.0.6 = spam haven)
2dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
2dnsbl.rangers.eu.org (result 127.0.0.32 = worm source)
2dialup.blacklist.jippg.org (result 127.0.0.3 = dialup outside Japan)
1ciberlynx.blackholes.us
1spamsites.dnsbl.net.au
1owfs.dnsbl.net.au
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
1blackholes.five-ten-sg.com (result 127.0.0.6 = open relay)
1bl.deadbeef.com
1dnsbl.ahbl.org (result 127.0.0.14 = denial-of-service attacker)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems.

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
39446(total number of IP addresses whose names were tested, including 384 at SDSC)
17955(union of all domain zones)
14407abuse.rfc-ignorant.org
8372rddn.dnsbl.net.au
7993whois.rfc-ignorant.org (union of all results)
6424whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
4852dynamic.rhs.mailpolice.com
1569whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
1372webmail.rhs.mailpolice.com
776rhsbl.ahbl.org
608bl.deadbeef.com
494bulk.rhs.mailpolice.com
361adv.rhs.mailpolice.com
74postmaster.rfc-ignorant.org
26dsn.rfc-ignorant.org (zone not intended for this use)
4bogusmx.rfc-ignorant.org
2blackhole.securitysage.com
2porn.rhs.mailpolice.com

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
25771(total number of domains tested, including 321 at SDSC)
6297(union of all domain zones)
2346abuse.rfc-ignorant.org
1944whois.rfc-ignorant.org (union of all results)
1384whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
1263postmaster.rfc-ignorant.org
1165webmail.rhs.mailpolice.com
1001dsn.rfc-ignorant.org
939rhsbl.ahbl.org
560whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
542bogusmx.rfc-ignorant.org
402bulk.rhs.mailpolice.com
223blackhole.securitysage.com
197adv.rhs.mailpolice.com
171bl.deadbeef.com
92porn.rhs.mailpolice.com
50rddn.dnsbl.net.au (zone not intended for this use)
48rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
48rhsbl.sorbs.net (union of all results)
24dynamic.rhs.mailpolice.com
16ex.dnsbl.org
2cart00ney.surriel.com

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 8 July 2005.