Blacklists Compared

17 November 2007

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (127.0.0.1 result), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
234691(total number of IP addresses tested, including 499 at SDSC)
223907(union of most IP zones)
203840l2.apews.org
195827zen.spamhaus.org (union of all results)
181494t1.dnsbl.net.au
153908pbl.spamhaus.org (union of all results)
147403sbl-xbl.spamhaus.org (union of all results)
147025xbl.spamhaus.org (union of all results)
146971cbl.abuseat.org
146940zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
146924sbl-xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
146874xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
129866dnsbl-3.uceprotect.net
120301dnsbl.sorbs.net (union of all results)
119907dnsbl-2.uceprotect.net
116539zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
116454pbl.spamhaus.org (result 127.0.0.11 = Spamhaus entry)
116391dnsbl.tqmcube.com (union of all results)
106969psbl.surriel.com
103322dnsbl-1.uceprotect.net
98299dnsbl.sorbs.net (result 127.0.0.10 = dialup)
97149no-more-funn.moensted.dk (union of all results)
88316blackholes.five-ten-sg.com (union of all results)
87592dnsbl.tqmcube.com (result 127.0.0.2 = dialup)
84844ubl.unsubscore.com
83286no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
82273blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
47832hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
41510bl.spamcop.net
37456zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
37456pbl.spamhaus.org (result 127.0.0.10 = ISP contributed)
30972dnsbl.tqmcube.com (result 127.0.0.3 = spam source)
30094ix.dnsbl.manitu.net
26004db.wpbl.info
23258dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
14964unconfirmed.dsbl.org
14817list.dsbl.org
14787dsbl.dnsbl.net.au
13390mail-abuse.blacklist.jippg.org
11976countries.blackholes.us (result 127.0.7.6 = Brazil)
10811tr.countries.nerd.dk
10454no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
10258countries.blackholes.us (result 127.7.9.2 = Turkey)
8946ips.backscatterer.org
8807countries.blackholes.us (result 127.6.4.3 = Russia)
7725bl.spamcannibal.org
6618dnsbl.tqmcube.com (result 127.0.0.5 = China)
6529countries.blackholes.us (result 127.1.5.6 = China)
5625rmst.dnsbl.net.au
5339countries.blackholes.us (result 127.4.8.4 = Mexico)
5235korea.services.net
5047dnsbl.tqmcube.com (result 127.0.0.4 = South Korea)
4850countries.blackholes.us (result 127.4.1.0 = Korea)
4764blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
4505dnsbl.njabl.org (union of all results)
4466list.dnswl.org (not a blacklist!)
4238dnsbl.njabl.org (result 127.0.0.9 = open proxy)
3904countries.blackholes.us (result 127.0.3.2 = Argentina)
3073countries.blackholes.us (result 127.7.6.4 = Thailand)
3060probes.dnsbl.net.au
2998dnsbl.ahbl.org (union of all results)
2810dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
2707hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
2539no-more-funn.moensted.dk (result 127.0.0.9 = misc)
2391countries.blackholes.us (result 127.3.9.2 = Japan)
2260spamsources.fabel.dk
2110hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
1592countries.blackholes.us (result 127.4.5.8 = Malaysia)
1207blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
1056countries.blackholes.us (result 127.1.5.8 = Taiwan)
722zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
722xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
722sbl-xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
669countries.blackholes.us (result 127.3.4.4 = Hong Kong)
577no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
468zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
468sbl-xbl.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
468sbl.spamhaus.org
407countries.blackholes.us (result 127.7.0.2 = Singapore)
385no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
364blackholes.uceb.org (union of all results)
317blackholes.uceb.org (result 127.0.0.6 = spam haven)
316work.drbl.croco.net
288aspews.ext.sorbs.net
244dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
237dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
187accredit.habeas.com (not a blacklist!)
167query.bondedsender.org (not a blacklist!)
163dnsbl.njabl.org (result 127.0.0.4 = spam source)
158multi.uribl.com (result 127.0.0.2 = spam resource)
158multi.uribl.com (union of all results)
157iadb2.isipp.com (not a blacklist!)
157iadb.isipp.com (not a blacklist!)
156blackholes.uceb.org (result 127.0.0.3 = spam source)
139multi.surbl.org
128dnsbl.ahbl.org (result 127.0.0.4 = spam source)
120bl.deadbeef.com
115multihop.dsbl.org
104dnsbl.njabl.org (result 127.0.0.2 = open relay)
41relays.nether.net
40rdts.dnsbl.net.au
39blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
37sbl.csma.biz
36dnsbl.sorbs.net (result 127.0.0.6 = spam source)
35dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
35bl.csma.biz
34spam.wytnij.to
32countries.blackholes.us (result 127.5.6.6 = Nigeria)
31spamguard.leadmon.net (union of all results)
29hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
29blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
28dnsbl.ahbl.org (result 127.0.0.15 = open relay)
21exemptions.ahbl.org (not a blacklist!)
19blackholes.uceb.org (result 127.0.0.5 = dialup)
17blackholes.uceb.org (result 127.0.0.2 = open relay)
13spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
13dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
12spamguard.leadmon.net (result 127.0.0.8 = open proxy)
9blackholes.brainerd.net
7ohps.dnsbl.net.au
6spamguard.leadmon.net (result 127.0.0.3 = spam source)
6dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
4no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
4dnsbl.ahbl.org (result 127.0.0.20 = blog/wiki/comment spam source)
4dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)
3blackholes.five-ten-sg.com (result 127.0.0.11 = TCPA violator)
2dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
2spamsites.dnsbl.net.au
2omrs.dnsbl.net.au
2dnsbl.ahbl.org (result 127.0.0.18 = virus source)
2dnsbl.ahbl.org (result 127.0.0.11 = no postmaster or abuse e-mail)
1blackholes.uceb.org (result 127.0.0.9 = uncooperative company)
1owps.dnsbl.net.au
1osps.dnsbl.net.au
1osrs.dnsbl.net.au
1blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
1dob.sibl.support-intelligence.net
1dnsbl.ahbl.org (result 127.0.0.14 = denial-of-service attacker)


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
234691(total number of IP addresses whose names were tested, including 499 at SDSC)
160007(union of all domain zones)
142615l1.apews.org
107420rddn.dnsbl.net.au
105125abuse.rfc-ignorant.org
66019dynamic.rhs.mailpolice.com
61549whois.rfc-ignorant.org (union of all results)
42372whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
19178whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
11882webmail.rhs.mailpolice.com
775multi.surbl.org
740multi.uribl.com (result 127.0.0.2 = spam resource)
740multi.uribl.com (union of all results)
534adv.rhs.mailpolice.com
146bl.deadbeef.com
103postmaster.rfc-ignorant.org
100rhsbl.ahbl.org
85bulk.rhs.mailpolice.com
82bogusmx.rfc-ignorant.org
80dsn.rfc-ignorant.org (zone not intended for this use)
26rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
26rhsbl.sorbs.net (union of all results)
15porn.rhs.mailpolice.com
10dob.sibl.support-intelligence.net


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
196640(total number of domains tested, including 443 at SDSC)
53986(union of all domain zones)
36325whois.rfc-ignorant.org (union of all results)
35671whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
7359bogusmx.rfc-ignorant.org
4868abuse.rfc-ignorant.org
3000multi.surbl.org
2391multi.uribl.com (union of all results)
2333multi.uribl.com (result 127.0.0.2 = spam resource)
2060l1.apews.org
1630postmaster.rfc-ignorant.org
1560webmail.rhs.mailpolice.com
877dsn.rfc-ignorant.org
849porn.rhs.mailpolice.com
654whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
422rhsbl.ahbl.org
388bulk.rhs.mailpolice.com
209adv.rhs.mailpolice.com
160rddn.dnsbl.net.au (zone not intended for this use)
137dynamic.rhs.mailpolice.com
74rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
74rhsbl.sorbs.net (union of all results)
55multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
38dob.sibl.support-intelligence.net
8fraud.rhs.mailpolice.com
3multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
3bl.deadbeef.com
1cart00ney.surriel.com


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 24 November 2007.