Blacklists Compared

8 April 2006

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the exemptions.ahbl.org and query.bondedsender.org zones because they are not blacklists, and because it is too aggressive to be widely useful the block.blars.org zone is also excluded.

HitsDNS Zone
80471(total number of IP addresses tested, including 501 at SDSC)
72673(union of most IP zones)
50923block.blars.org
45110dnsbl.sorbs.net (union of all results)
41488t1.dnsbl.net.au
36508dnsbl.sorbs.net (result 127.0.0.10 = dialup)
35911sbl-xbl.spamhaus.org (union of all results)
33928xbl.spamhaus.org (union of all results)
32624cbl.abuseat.org
32617xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
32617sbl-xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
27766dynablock.njabl.org
27641psbl.surriel.com
22639blackholes.five-ten-sg.com (union of all results)
21887blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
18146no-more-funn.moensted.dk (union of all results)
16464cn-kr.blackholes.us (result 127.0.0.2 = China)
16464cn-kr.blackholes.us (union of all results)
14306sbl.csma.biz
12745china.blackholes.us
11907blacklist.spambag.org
11703dnsbl-1.uceprotect.net
11343unconfirmed.dsbl.org
11248list.dsbl.org
11244dsbl.dnsbl.net.au
10530bl.spamcop.net
8801dnsbl-2.uceprotect.net
8280no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
7632dnsbl.sorbs.net (result 127.0.0.6 = spam source)
7428unsure.nether.net
6947l2.spews.dnsbl.sorbs.net
6524combined-hib.dnsiplists.completewhois.com (union of all results)
6522combined-hib.dnsiplists.completewhois.com (result 127.0.0.4 = bad whois data)
6280wpbl.dnsbl.net.au
6239l1.spews.dnsbl.sorbs.net
5768spews.dnsbl.net.au
5673bl.csma.biz
4653no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
4529no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
4193dnsbl.njabl.org (union of all results)
3975dnsbl.sorbs.net (result 127.0.0.7 = open formmail.cgi)
3791korea.services.net
3719korea.blackholes.us
3634rmst.dnsbl.net.au
2862dnsbl.ahbl.org (union of all results)
2758ricn.dnsbl.net.au
2746dnsbl.njabl.org (result 127.0.0.9 = open proxy)
2702sbl.spamhaus.org
2691sbl-xbl.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
2628spamsources.fabel.dk
2246dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
1911brazil.blackholes.us
1764xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
1764sbl-xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
1692opm.blitzed.org
1595spam.wytnij.to
1439japan.blackholes.us
1369sbl-xbl.spamhaus.org (result 127.0.0.6 = Blitzed Open Proxy Monitor List)
1367xbl.spamhaus.org (result 127.0.0.6 = Blitzed Open Proxy Monitor List)
1361russia.blackholes.us
1340mail-abuse.blacklist.jippg.org
1281dnsbl-3.uceprotect.net
1232dnsbl.njabl.org (result 127.0.0.3 = dialup)
1089probes.dnsbl.net.au
1047taiwan.blackholes.us
995bl.spamcannibal.org
975dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
884dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
863tr.countries.nerd.dk
860turkey.blackholes.us
803mexico.blackholes.us
722dnsbl.antispam.or.id
599argentina.blackholes.us
594dnsbl.ahbl.org (result 127.0.0.4 = spam source)
418blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
412no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
342hongkong.blackholes.us
301malaysia.blackholes.us
273no-more-funn.moensted.dk (result 127.0.0.9 = misc)
272singapore.blackholes.us
251thailand.blackholes.us
235blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
159blackholes.intersil.net
138query.bondedsender.org (not a blacklist!)
133dnsbl.njabl.org (result 127.0.0.2 = open relay)
115relays.ordb.org
107ohps.dnsbl.net.au
98dnsbl.njabl.org (result 127.0.0.4 = spam source)
82multihop.dsbl.org
81blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
76flowgoaway.com
62dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
48dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
25osps.dnsbl.net.au
21tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
21tor.dnsbl.sectoor.de (union of all results)
20relays.nether.net
15hil.habeas.com
14exemptions.ahbl.org (not a blacklist!)
12rdts.dnsbl.net.au
12blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
11spamguard.leadmon.net (union of all results)
10nigeria.blackholes.us
10dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)
8dnsbl.sorbs.net (result 127.0.0.5 = open relay)
8spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
8dnsbl.ahbl.org (result 127.0.0.15 = open relay)
8dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
8blackholes.uceb.org (union of all results)
6osrs.dnsbl.net.au
5bl.deadbeef.com
4blackholes.uceb.org (result 127.0.0.3 = spam source)
4blackholes.uceb.org (result 127.0.0.2 = open relay)
3spamguard.leadmon.net (result 127.0.0.3 = spam source)
3blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
3blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
3blackholes.brainerd.net
2owps.dnsbl.net.au
2no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
2combined-hib.dnsiplists.completewhois.com (result 127.0.0.2 = unallocated IP address)
1dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
1no-more-funn.moensted.dk (result 127.0.0.8 = open web form)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems.


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
80471(total number of IP addresses whose names were tested, including 501 at SDSC)
45978(union of all domain zones)
31210abuse.rfc-ignorant.org
31108rddn.dnsbl.net.au
22312dynamic.rhs.mailpolice.com
21968whois.rfc-ignorant.org (union of all results)
18203whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
3767whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
2495webmail.rhs.mailpolice.com
836rhsbl.ahbl.org
551bl.deadbeef.com
521adv.rhs.mailpolice.com
243postmaster.rfc-ignorant.org
212bulk.rhs.mailpolice.com
128bogusmx.rfc-ignorant.org
125dsn.rfc-ignorant.org (zone not intended for this use)
4porn.rhs.mailpolice.com
3blackhole.securitysage.com


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
34607(total number of domains tested, including 418 at SDSC)
6785(union of all domain zones)
2563whois.rfc-ignorant.org (union of all results)
2193abuse.rfc-ignorant.org
2096whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
1086postmaster.rfc-ignorant.org
866webmail.rhs.mailpolice.com
858rhsbl.ahbl.org
834bogusmx.rfc-ignorant.org
781dsn.rfc-ignorant.org
467whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
190adv.rhs.mailpolice.com
158bulk.rhs.mailpolice.com
128blackhole.securitysage.com
127bl.deadbeef.com
107porn.rhs.mailpolice.com
39rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
39rhsbl.sorbs.net (union of all results)
21rddn.dnsbl.net.au (zone not intended for this use)
13ex.dnsbl.org
11dynamic.rhs.mailpolice.com
1cart00ney.surriel.com


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 28 April 2006.