Blacklists Compared

25 November 2006

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the exemptions.ahbl.org and query.bondedsender.org zones because they are not blacklists, and because it is too aggressive to be widely useful the block.blars.org zone is also excluded.

HitsDNS Zone
158997(total number of IP addresses tested, including 497 at SDSC)
151727(union of most IP zones)
127506t1.dnsbl.net.au
98734block.blars.org
90970dnsbl.sorbs.net (union of all results)
90372sbl-xbl.spamhaus.org (union of all results)
90311zen.spamhaus.org (union of all results)
89804xbl.spamhaus.org (union of all results)
88750cbl.abuseat.org
88673sbl-xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
88628zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
88574xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
80324no-more-funn.moensted.dk (union of all results)
78062dnsbl.sorbs.net (result 127.0.0.10 = dialup)
77844blackholes.five-ten-sg.com (union of all results)
76359blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
69366dnsbl.tqmcube.com (union of all results)
64633psbl.surriel.com
55775dynablock.njabl.org
52940no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
50220dnsbl-1.uceprotect.net
46091dnsbl-2.uceprotect.net
33615dnsbl.tqmcube.com (result 127.0.0.2 = dialup)
32770dnsbl-3.uceprotect.net
27683bl.spamcop.net
20444no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
19323bl.csma.biz
17606cn-kr.blackholes.us (result 127.0.0.2 = China)
17606cn-kr.blackholes.us (union of all results)
17062ubl.unsubscore.com
15843unconfirmed.dsbl.org
15803dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
15719dsbl.dnsbl.net.au
15718list.dsbl.org
14364dnsbl.tqmcube.com (result 127.0.0.3 = spam source)
14104dnsbl.tqmcube.com (result 127.0.0.5 = China)
12378china.blackholes.us
11093blacklist.spambag.org
8749dnsbl.njabl.org (union of all results)
8462korea.services.net
7286dnsbl.tqmcube.com (result 127.0.0.4 = South Korea)
6761mail-abuse.blacklist.jippg.org
6382no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
6289rmst.dnsbl.net.au
6039wpbl.dnsbl.net.au
5793dnsbl.njabl.org (result 127.0.0.9 = open proxy)
5579korea.blackholes.us
5158tr.countries.nerd.dk
4774brazil.blackholes.us
3952dnsbl.ahbl.org (union of all results)
3935turkey.blackholes.us
3909dnsbl.sorbs.net (result 127.0.0.6 = spam source)
3704spamsources.fabel.dk
3575zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
3575sbl-xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
3573xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
3521dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
2898unsure.nether.net
2669dnsbl.njabl.org (result 127.0.0.3 = dialup)
2519bl.spamcannibal.org
2281spews.dnsbl.net.au
2158probes.dnsbl.net.au
1743argentina.blackholes.us
1671taiwan.blackholes.us
1666dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
1556japan.blackholes.us
1178russia.blackholes.us
1032malaysia.blackholes.us
1011ricn.dnsbl.net.au
1008dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
857thailand.blackholes.us
815blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
634sbl-xbl.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
634sbl.spamhaus.org
618zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
534mexico.blackholes.us
510l1.spews.dnsbl.sorbs.net
488blackholes.uceb.org (union of all results)
458hongkong.blackholes.us
431no-more-funn.moensted.dk (result 127.0.0.9 = misc)
408blackholes.uceb.org (result 127.0.0.6 = spam haven)
408dnsbl.ahbl.org (result 127.0.0.4 = spam source)
365l2.spews.dnsbl.sorbs.net
347blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
330singapore.blackholes.us
292no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
263blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
249work.drbl.croco.net
237blackholes.uceb.org (result 127.0.0.3 = spam source)
220sbl.csma.biz
164dnsbl.njabl.org (result 127.0.0.4 = spam source)
138query.bondedsender.org (not a blacklist!)
131dnsbl.njabl.org (result 127.0.0.2 = open relay)
97dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
78spam.wytnij.to
78relays.ordb.org
78flowgoaway.com
77multihop.dsbl.org
73dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
59blackholes.uceb.org (result 127.0.0.5 = dialup)
58blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
31relays.nether.net
29dnsbl.ahbl.org (result 127.0.0.15 = open relay)
29tor.dnsbl.sectoor.de (union of all results)
28tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
28ohps.dnsbl.net.au
24osps.dnsbl.net.au
23bl.deadbeef.com
21rdts.dnsbl.net.au
16multi.surbl.org
13exemptions.ahbl.org (not a blacklist!)
10osrs.dnsbl.net.au
9blackholes.uceb.org (result 127.0.0.2 = open relay)
8spamguard.leadmon.net (union of all results)
7nigeria.blackholes.us
7dnsbl.sorbs.net (result 127.0.0.5 = open relay)
7spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
7dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)
6owps.dnsbl.net.au
5dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
3no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
3no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
3dnsbl.ahbl.org (result 127.0.0.14 = denial-of-service attacker)
2dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
2no-more-funn.moensted.dk (result 127.0.0.8 = open web form)
2blackholes.brainerd.net
1tor.dnsbl.sectoor.de (result 127.0.0.1 = Tor server)
1spamsites.dnsbl.net.au
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1blackholes.five-ten-sg.com (result 127.0.0.11 = TCPA violator)
1blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
1dnsbl.ahbl.org (result 127.0.0.11 = no postmaster or abuse e-mail)


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
158997(total number of IP addresses whose names were tested, including 497 at SDSC)
97909(union of all domain zones)
73985rddn.dnsbl.net.au
69098abuse.rfc-ignorant.org
52959dynamic.rhs.mailpolice.com
46927whois.rfc-ignorant.org (union of all results)
29827whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
17101whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
4178webmail.rhs.mailpolice.com
835postmaster.rfc-ignorant.org
483adv.rhs.mailpolice.com
300multi.surbl.org
241rhsbl.ahbl.org
114bulk.rhs.mailpolice.com
65dsn.rfc-ignorant.org (zone not intended for this use)
65bogusmx.rfc-ignorant.org
5porn.rhs.mailpolice.com
3bl.deadbeef.com
1blackhole.securitysage.com


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
99119(total number of domains tested, including 434 at SDSC)
16168(union of all domain zones)
6998whois.rfc-ignorant.org (union of all results)
6197whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
4449abuse.rfc-ignorant.org
2054webmail.rhs.mailpolice.com
1950multi.surbl.org
1782postmaster.rfc-ignorant.org
1250bogusmx.rfc-ignorant.org
1104dsn.rfc-ignorant.org
801whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
581rhsbl.ahbl.org
454porn.rhs.mailpolice.com
297bulk.rhs.mailpolice.com
240adv.rhs.mailpolice.com
188blackhole.securitysage.com
68rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
68rhsbl.sorbs.net (union of all results)
30rddn.dnsbl.net.au (zone not intended for this use)
23ex.dnsbl.org
16dynamic.rhs.mailpolice.com
2bl.deadbeef.com
1fraud.rhs.mailpolice.com
1cart00ney.surriel.com


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 1 December 2006.