Blacklists Compared

28 October 2006

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the exemptions.ahbl.org and query.bondedsender.org zones because they are not blacklists, and because it is too aggressive to be widely useful the block.blars.org zone is also excluded.

HitsDNS Zone
154860(total number of IP addresses tested, including 493 at SDSC)
144191(union of most IP zones)
109377t1.dnsbl.net.au
96114block.blars.org
83102dnsbl.sorbs.net (union of all results)
74203no-more-funn.moensted.dk (union of all results)
73953psbl.surriel.com
72674blackholes.five-ten-sg.com (union of all results)
71179blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
70646dnsbl.sorbs.net (result 127.0.0.10 = dialup)
69185dnsbl.tqmcube.com (union of all results)
59170zen.spamhaus.org (union of all results)
59163sbl-xbl.spamhaus.org (union of all results)
58407xbl.spamhaus.org (union of all results)
56323cbl.abuseat.org
56243zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
56237sbl-xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
56235xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
50953dynablock.njabl.org
50200no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
34457dnsbl.tqmcube.com (result 127.0.0.2 = dialup)
33612dnsbl-1.uceprotect.net
33148dnsbl-3.uceprotect.net
27615bl.spamcop.net
24039dnsbl-2.uceprotect.net
21398ubl.unsubscore.com
20767no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
16185bl.csma.biz
15943unconfirmed.dsbl.org
15784list.dsbl.org
15777dnsbl.tqmcube.com (result 127.0.0.5 = China)
15776dsbl.dnsbl.net.au
13718cn-kr.blackholes.us (result 127.0.0.2 = China)
13718cn-kr.blackholes.us (union of all results)
12973dnsbl.tqmcube.com (result 127.0.0.3 = spam source)
12225blacklist.spambag.org
11799dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
10492china.blackholes.us
8758dnsbl.njabl.org (union of all results)
6809unsure.nether.net
6767korea.services.net
6660mail-abuse.blacklist.jippg.org
6290dnsbl.njabl.org (result 127.0.0.9 = open proxy)
6074wpbl.dnsbl.net.au
5980dnsbl.tqmcube.com (result 127.0.0.4 = South Korea)
5621rmst.dnsbl.net.au
4737dnsbl.ahbl.org (union of all results)
4301dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
3975zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
3975xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
3975sbl-xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
3938dnsbl.sorbs.net (result 127.0.0.6 = spam source)
3743tr.countries.nerd.dk
3711combined-hib.dnsiplists.completewhois.com (union of all results)
3707spamsources.fabel.dk
3685combined-hib.dnsiplists.completewhois.com (result 127.0.0.4 = bad whois data)
3221korea.blackholes.us
2639no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
2529brazil.blackholes.us
2305bl.spamcannibal.org
2273turkey.blackholes.us
2172dnsbl.njabl.org (result 127.0.0.3 = dialup)
2119ricn.dnsbl.net.au
1996probes.dnsbl.net.au
1890dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
1756spews.dnsbl.net.au
1271taiwan.blackholes.us
1202l2.spews.dnsbl.sorbs.net
1162l1.spews.dnsbl.sorbs.net
1089dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
972japan.blackholes.us
902zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
902sbl-xbl.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
902sbl.spamhaus.org
870blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
835russia.blackholes.us
729spam.wytnij.to
695argentina.blackholes.us
594malaysia.blackholes.us
555no-more-funn.moensted.dk (result 127.0.0.9 = misc)
551thailand.blackholes.us
547mexico.blackholes.us
414dnsbl.ahbl.org (result 127.0.0.4 = spam source)
401no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
311hongkong.blackholes.us
300blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
288singapore.blackholes.us
279blackholes.uceb.org (union of all results)
266blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
235sbl.csma.biz
224work.drbl.croco.net
205dnsbl.njabl.org (result 127.0.0.4 = spam source)
183blackholes.uceb.org (result 127.0.0.3 = spam source)
116multihop.dsbl.org
111query.bondedsender.org (not a blacklist!)
99dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
93dnsbl.njabl.org (result 127.0.0.2 = open relay)
83dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
82blackholes.uceb.org (result 127.0.0.5 = dialup)
77relays.ordb.org
76flowgoaway.com
52blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
50ohps.dnsbl.net.au
30tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
30relays.nether.net
30tor.dnsbl.sectoor.de (union of all results)
26combined-hib.dnsiplists.completewhois.com (result 127.0.0.2 = unallocated IP address)
21dnsbl.antispam.or.id
20osps.dnsbl.net.au
19dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
19spamguard.leadmon.net (union of all results)
18rdts.dnsbl.net.au
18spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
18dnsbl.ahbl.org (result 127.0.0.15 = open relay)
15exemptions.ahbl.org (not a blacklist!)
14blackholes.uceb.org (result 127.0.0.2 = open relay)
13multi.surbl.org
9owps.dnsbl.net.au
9no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
9blackholes.brainerd.net
4nigeria.blackholes.us
4blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
4dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)
3blackholes.five-ten-sg.com (result 127.0.0.11 = TCPA violator)
3bl.deadbeef.com
2dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
1dnsbl.sorbs.net (result 127.0.0.5 = open relay)
1osrs.dnsbl.net.au
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1no-more-funn.moensted.dk (result 127.0.0.8 = open web form)


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
154860(total number of IP addresses whose names were tested, including 493 at SDSC)
94335(union of all domain zones)
69669rddn.dnsbl.net.au
65646abuse.rfc-ignorant.org
50118dynamic.rhs.mailpolice.com
44717whois.rfc-ignorant.org (union of all results)
29557whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
15160whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
4295webmail.rhs.mailpolice.com
619postmaster.rfc-ignorant.org
514adv.rhs.mailpolice.com
375rhsbl.ahbl.org
273multi.surbl.org
133bulk.rhs.mailpolice.com
100dsn.rfc-ignorant.org (zone not intended for this use)
97bogusmx.rfc-ignorant.org
4porn.rhs.mailpolice.com


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
94733(total number of domains tested, including 486 at SDSC)
15912(union of all domain zones)
6257whois.rfc-ignorant.org (union of all results)
5404whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
4842abuse.rfc-ignorant.org
2154multi.surbl.org
1913webmail.rhs.mailpolice.com
1887postmaster.rfc-ignorant.org
1275bogusmx.rfc-ignorant.org
1144dsn.rfc-ignorant.org
853whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
755rhsbl.ahbl.org
465porn.rhs.mailpolice.com
280bulk.rhs.mailpolice.com
251adv.rhs.mailpolice.com
212blackhole.securitysage.com
60rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
60rhsbl.sorbs.net (union of all results)
29rddn.dnsbl.net.au (zone not intended for this use)
22ex.dnsbl.org
9dynamic.rhs.mailpolice.com
1cart00ney.surriel.com


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 4 November 2006.