Blacklists Compared

4 November 2006

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the exemptions.ahbl.org and query.bondedsender.org zones because they are not blacklists, and because it is too aggressive to be widely useful the block.blars.org zone is also excluded.

HitsDNS Zone
164243(total number of IP addresses tested, including 781 at SDSC)
150984(union of most IP zones)
114684t1.dnsbl.net.au
100010block.blars.org
81652dnsbl.sorbs.net (union of all results)
77738blackholes.five-ten-sg.com (union of all results)
76214no-more-funn.moensted.dk (union of all results)
76063blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
72703dnsbl.tqmcube.com (union of all results)
71929sbl-xbl.spamhaus.org (union of all results)
71928zen.spamhaus.org (union of all results)
71332xbl.spamhaus.org (union of all results)
69492cbl.abuseat.org
69467xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
69467sbl-xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
69466zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
68769dnsbl.sorbs.net (result 127.0.0.10 = dialup)
67574psbl.surriel.com
50841dynablock.njabl.org
49029no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
39207dnsbl-3.uceprotect.net
37927dnsbl-1.uceprotect.net
33457dnsbl.tqmcube.com (result 127.0.0.2 = dialup)
30881dnsbl-2.uceprotect.net
30335bl.spamcop.net
26658bl.csma.biz
23885no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
18141dnsbl.tqmcube.com (result 127.0.0.5 = China)
16512unconfirmed.dsbl.org
16317list.dsbl.org
16307dsbl.dnsbl.net.au
14120dnsbl.tqmcube.com (result 127.0.0.3 = spam source)
14117cn-kr.blackholes.us (result 127.0.0.2 = China)
14117cn-kr.blackholes.us (union of all results)
13200blacklist.spambag.org
12223ubl.unsubscore.com
11625dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
11332china.blackholes.us
8981dnsbl.njabl.org (union of all results)
7977korea.services.net
7844mail-abuse.blacklist.jippg.org
6987dnsbl.tqmcube.com (result 127.0.0.4 = South Korea)
6585dnsbl.njabl.org (result 127.0.0.9 = open proxy)
6583rmst.dnsbl.net.au
6234unsure.nether.net
5038spews.dnsbl.net.au
5038dnsbl.ahbl.org (union of all results)
4808wpbl.dnsbl.net.au
4604dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
4363dnsbl.sorbs.net (result 127.0.0.6 = spam source)
4243zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
4243xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
4243sbl-xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
4171spamsources.fabel.dk
3620tr.countries.nerd.dk
2766korea.blackholes.us
2685combined-hib.dnsiplists.completewhois.com (union of all results)
2655combined-hib.dnsiplists.completewhois.com (result 127.0.0.4 = bad whois data)
2622bl.spamcannibal.org
2431no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
2408brazil.blackholes.us
2132turkey.blackholes.us
2079dnsbl.njabl.org (result 127.0.0.3 = dialup)
2055dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
1965probes.dnsbl.net.au
1729ricn.dnsbl.net.au
1130dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
1031taiwan.blackholes.us
911russia.blackholes.us
904blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
889spam.wytnij.to
766japan.blackholes.us
764zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
764sbl-xbl.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
764sbl.spamhaus.org
752no-more-funn.moensted.dk (result 127.0.0.9 = misc)
623argentina.blackholes.us
541malaysia.blackholes.us
422dnsbl.ahbl.org (result 127.0.0.4 = spam source)
414no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
388mexico.blackholes.us
354blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
336blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
316hongkong.blackholes.us
287blackholes.uceb.org (union of all results)
273l1.spews.dnsbl.sorbs.net
260l2.spews.dnsbl.sorbs.net
231sbl.csma.biz
221dnsbl.njabl.org (result 127.0.0.4 = spam source)
213work.drbl.croco.net
174blackholes.uceb.org (result 127.0.0.3 = spam source)
145query.bondedsender.org (not a blacklist!)
144multihop.dsbl.org
138singapore.blackholes.us
132dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
112thailand.blackholes.us
100dnsbl.njabl.org (result 127.0.0.2 = open relay)
93blackholes.uceb.org (result 127.0.0.5 = dialup)
89dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
87relays.ordb.org
74relays.nether.net
72blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
69flowgoaway.com
47ohps.dnsbl.net.au
36tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
36tor.dnsbl.sectoor.de (union of all results)
33dnsbl.antispam.or.id
30combined-hib.dnsiplists.completewhois.com (result 127.0.0.2 = unallocated IP address)
23multi.surbl.org
23no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
22exemptions.ahbl.org (not a blacklist!)
21dnsbl.ahbl.org (result 127.0.0.15 = open relay)
20blackholes.uceb.org (result 127.0.0.2 = open relay)
20rdts.dnsbl.net.au
17osps.dnsbl.net.au
17spamguard.leadmon.net (union of all results)
15blackholes.brainerd.net
13spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
9dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
8nigeria.blackholes.us
7osrs.dnsbl.net.au
5owps.dnsbl.net.au
5bl.deadbeef.com
5dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)
4blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
3spamguard.leadmon.net (result 127.0.0.3 = spam source)
3blackholes.five-ten-sg.com (result 127.0.0.11 = TCPA violator)
2dnsbl.sorbs.net (result 127.0.0.5 = open relay)
1spamguard.leadmon.net (result 127.0.0.8 = open proxy)
1no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
1blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
1blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
1dnsbl.ahbl.org (result 127.0.0.18 = virus source)


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
164243(total number of IP addresses whose names were tested, including 781 at SDSC)
95983(union of all domain zones)
68611rddn.dnsbl.net.au
66810abuse.rfc-ignorant.org
49494dynamic.rhs.mailpolice.com
45400whois.rfc-ignorant.org (union of all results)
29349whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
16051whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
4743webmail.rhs.mailpolice.com
792postmaster.rfc-ignorant.org
522adv.rhs.mailpolice.com
345rhsbl.ahbl.org
281multi.surbl.org
130bulk.rhs.mailpolice.com
116dsn.rfc-ignorant.org (zone not intended for this use)
104bogusmx.rfc-ignorant.org
11porn.rhs.mailpolice.com
1fraud.rhs.mailpolice.com
1ex.dnsbl.org


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
90940(total number of domains tested, including 426 at SDSC)
15430(union of all domain zones)
5869whois.rfc-ignorant.org (union of all results)
5051whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
4640abuse.rfc-ignorant.org
2158multi.surbl.org
2011postmaster.rfc-ignorant.org
1868webmail.rhs.mailpolice.com
1342bogusmx.rfc-ignorant.org
1165dsn.rfc-ignorant.org
818whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
701rhsbl.ahbl.org
366porn.rhs.mailpolice.com
324bulk.rhs.mailpolice.com
227adv.rhs.mailpolice.com
211blackhole.securitysage.com
68rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
68rhsbl.sorbs.net (union of all results)
25rddn.dnsbl.net.au (zone not intended for this use)
15ex.dnsbl.org
9dynamic.rhs.mailpolice.com
1cart00ney.surriel.com


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 10 November 2006.