Blacklists Compared

14 July 2007

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists.

HitsDNS Zone
166355(total number of IP addresses tested, including 508 at SDSC)
160514(union of most IP zones)
130461zen.spamhaus.org (union of all results)
127080l2.apews.dnsbl.uceprotect.net
105304t1.dnsbl.net.au
95111sbl-xbl.spamhaus.org (union of all results)
94661xbl.spamhaus.org (union of all results)
94310cbl.abuseat.org
94302sbl-xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
94299zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
94299xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
93491dynablock.njabl.org
93491pbl.spamhaus.org (union of all results)
89021dnsbl.tqmcube.com (union of all results)
85692zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
85692pbl.spamhaus.org (result 127.0.0.11 = Spamhaus entry)
81334no-more-funn.moensted.dk (union of all results)
73140blackholes.five-ten-sg.com (union of all results)
68014blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
57520dnsbl-2.uceprotect.net
56681dnsbl-1.uceprotect.net
55094no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
53073psbl.surriel.com
51222dnsbl.tqmcube.com (result 127.0.0.2 = dialup)
39954dnsbl.sorbs.net (union of all results)
39510dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
36377sbl.csma.biz
34508dnsbl-3.uceprotect.net
27645bl.spamcop.net
23652no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
19351dnsbl.tqmcube.com (result 127.0.0.3 = spam source)
19262db.wpbl.info
18757bl.csma.biz
18300ubl.unsubscore.com
17980cn-kr.blackholes.us (result 127.0.0.2 = China)
17980cn-kr.blackholes.us (union of all results)
14540dnsbl.tqmcube.com (result 127.0.0.5 = China)
14485unconfirmed.dsbl.org
14386list.dsbl.org
14377dsbl.dnsbl.net.au
13542korea.services.net
13150dnsbl.tqmcube.com (result 127.0.0.4 = South Korea)
9919ix.dnsbl.manitu.net
9601china.blackholes.us
9090tr.countries.nerd.dk
9035turkey.blackholes.us
8799korea.blackholes.us
7940zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
7940pbl.spamhaus.org (result 127.0.0.10 = ISP contributed)
7614mail-abuse.blacklist.jippg.org
6496combined-hib.dnsiplists.completewhois.com (union of all results)
6487combined-hib.dnsiplists.completewhois.com (result 127.0.0.4 = bad whois data)
4505spamsources.fabel.dk
3960ips.backscatterer.org
3954blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
3753dnsbl.njabl.org (union of all results)
3673russia.blackholes.us
3661rmst.dnsbl.net.au
3530dnsbl.njabl.org (result 127.0.0.9 = open proxy)
3353list.dnswl.org (not a blacklist!)
3276bl.spamcannibal.org
2703brazil.blackholes.us
2626dnsbl.ahbl.org (union of all results)
2452dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
1858no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
1683probes.dnsbl.net.au
1237taiwan.blackholes.us
1205zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
1205xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
1205sbl-xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
1182argentina.blackholes.us
1133thailand.blackholes.us
1064blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
853japan.blackholes.us
749malaysia.blackholes.us
723mexico.blackholes.us
594zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
594sbl-xbl.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
594sbl.spamhaus.org
467no-more-funn.moensted.dk (result 127.0.0.9 = misc)
437dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
417no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
356blackholes.uceb.org (union of all results)
344hongkong.blackholes.us
341dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
310blackholes.uceb.org (result 127.0.0.6 = spam haven)
255singapore.blackholes.us
237work.drbl.croco.net
166query.bondedsender.org (not a blacklist!)
165blackholes.uceb.org (result 127.0.0.3 = spam source)
140accredit.habeas.com (not a blacklist!)
137bl.deadbeef.com
132dnsbl.njabl.org (result 127.0.0.4 = spam source)
131iadb2.isipp.com (not a blacklist!)
128iadb.isipp.com (not a blacklist!)
100dnsbl.ahbl.org (result 127.0.0.4 = spam source)
91dnsbl.njabl.org (result 127.0.0.2 = open relay)
77spam.wytnij.to
73multihop.dsbl.org
57blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
48ohps.dnsbl.net.au
47dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
44blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
39tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
39tor.dnsbl.sectoor.de (union of all results)
30relays.nether.net
29blackholes.uceb.org (result 127.0.0.5 = dialup)
25dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
22multi.surbl.org
16spamguard.leadmon.net (union of all results)
15dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
13osps.dnsbl.net.au
13rdts.dnsbl.net.au
12nigeria.blackholes.us
10multi.uribl.com (result 127.0.0.2 = spam resource)
10blackholes.brainerd.net
10exemptions.ahbl.org (not a blacklist!)
10multi.uribl.com (union of all results)
9spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
9combined-hib.dnsiplists.completewhois.com (result 127.0.0.2 = unallocated IP address)
8dnsbl.ahbl.org (result 127.0.0.15 = open relay)
7blackholes.uceb.org (result 127.0.0.2 = open relay)
7spamguard.leadmon.net (result 127.0.0.3 = spam source)
5osrs.dnsbl.net.au
3owps.dnsbl.net.au
3blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
3blackholes.five-ten-sg.com (result 127.0.0.11 = TCPA violator)
2dnsbl.ahbl.org (result 127.0.0.20 = blog/wiki/comment spam source)
1blackholes.uceb.org (result 127.0.0.8 = spam source with fake sender)
1dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
1omrs.dnsbl.net.au
1no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
1blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
1dnsbl.ahbl.org (result 127.0.0.11 = no postmaster or abuse e-mail)
1dnsbl.ahbl.org (result 127.0.0.14 = denial-of-service attacker)
1dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
166355(total number of IP addresses whose names were tested, including 508 at SDSC)
103694(union of all domain zones)
94005l1.apews.rhsbl.uceprotect.net
74299rddn.dnsbl.net.au
66568abuse.rfc-ignorant.org
47750dynamic.rhs.mailpolice.com
37830whois.rfc-ignorant.org (union of all results)
22502whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
15328whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
8505webmail.rhs.mailpolice.com
627multi.surbl.org
567multi.uribl.com (union of all results)
565multi.uribl.com (result 127.0.0.2 = spam resource)
487adv.rhs.mailpolice.com
109bulk.rhs.mailpolice.com
98postmaster.rfc-ignorant.org
89rhsbl.ahbl.org
82dsn.rfc-ignorant.org (zone not intended for this use)
80bogusmx.rfc-ignorant.org
69bl.deadbeef.com
29rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
29rhsbl.sorbs.net (union of all results)
13porn.rhs.mailpolice.com
1multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
1multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
1blackhole.securitysage.com


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
91569(total number of domains tested, including 482 at SDSC)
19722(union of all domain zones)
8576whois.rfc-ignorant.org (union of all results)
7923whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
4999abuse.rfc-ignorant.org
2538multi.surbl.org
2363l1.apews.rhsbl.uceprotect.net
2227postmaster.rfc-ignorant.org
2112multi.uribl.com (union of all results)
2051multi.uribl.com (result 127.0.0.2 = spam resource)
1743webmail.rhs.mailpolice.com
1281bogusmx.rfc-ignorant.org
989dsn.rfc-ignorant.org
653whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
366porn.rhs.mailpolice.com
258rhsbl.ahbl.org
204bulk.rhs.mailpolice.com
199blackhole.securitysage.com
161adv.rhs.mailpolice.com
101rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
101rhsbl.sorbs.net (union of all results)
59multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
42rddn.dnsbl.net.au (zone not intended for this use)
17ex.dnsbl.org
16dynamic.rhs.mailpolice.com
3bl.deadbeef.com
2multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
1fraud.rhs.mailpolice.com
1cart00ney.surriel.com


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 19 July 2007.