Blacklists Compared

22 December 2007

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (127.0.0.1 result), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
231774(total number of IP addresses tested, including 499 at SDSC)
222894(union of most IP zones)
198833l2.apews.org
193959zen.spamhaus.org (union of all results)
174915t1.dnsbl.net.au
157301pbl.spamhaus.org (union of all results)
125113dnsbl.sorbs.net (union of all results)
124067dnsbl-3.uceprotect.net
122635dnsbl-2.uceprotect.net
121458zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
121432pbl.spamhaus.org (result 127.0.0.11 = Spamhaus entry)
116931sbl-xbl.spamhaus.org (union of all results)
116502xbl.spamhaus.org (union of all results)
116346cbl.abuseat.org
116269xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
116235zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
116189sbl-xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
115910dnsbl.tqmcube.com (union of all results)
99649dnsbl.sorbs.net (result 127.0.0.10 = dialup)
96369dnsbl-1.uceprotect.net
94337ubl.unsubscore.com
93612no-more-funn.moensted.dk (union of all results)
85193blackholes.five-ten-sg.com (union of all results)
83089dnsbl.tqmcube.com (result 127.0.0.2 = dialup)
82335no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
79091blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
60468psbl.surriel.com
54951hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
41860bl.spamcop.net
36069db.wpbl.info
35869zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
35869pbl.spamhaus.org (result 127.0.0.10 = ISP contributed)
35166dnsbl.tqmcube.com (result 127.0.0.3 = spam source)
31777ix.dnsbl.manitu.net
26875dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
13839unconfirmed.dsbl.org
13718list.dsbl.org
13714dsbl.dnsbl.net.au
12134bl.spamcannibal.org
11994mail-abuse.blacklist.jippg.org
11852sbl.csma.biz
11087bl.csma.biz
10769tr.countries.nerd.dk
10574countries.blackholes.us (result 127.0.7.6 = Brazil)
9990countries.blackholes.us (result 127.7.9.2 = Turkey)
9508no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
7069countries.blackholes.us (result 127.6.4.3 = Russia)
6110rmst.dnsbl.net.au
5836countries.blackholes.us (result 127.4.8.4 = Mexico)
5652dnsbl.tqmcube.com (result 127.0.0.5 = China)
5580countries.blackholes.us (result 127.1.5.6 = China)
5028ips.backscatterer.org
4931korea.services.net
4794blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
4726dnsbl.tqmcube.com (result 127.0.0.4 = South Korea)
4451countries.blackholes.us (result 127.4.1.0 = Korea)
4322list.dnswl.org (not a blacklist!)
4232dnsbl.njabl.org (union of all results)
4029countries.blackholes.us (result 127.0.3.2 = Argentina)
3925dnsbl.njabl.org (result 127.0.0.9 = open proxy)
3075countries.blackholes.us (result 127.7.6.4 = Thailand)
2768dnsbl.ahbl.org (union of all results)
2612spamsources.fabel.dk
2552dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
1997hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
1366no-more-funn.moensted.dk (result 127.0.0.9 = misc)
1319countries.blackholes.us (result 127.4.5.8 = Malaysia)
1271probes.dnsbl.net.au
1229blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
979countries.blackholes.us (result 127.1.5.8 = Taiwan)
956countries.blackholes.us (result 127.3.9.2 = Japan)
761hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
659zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
659xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
659sbl-xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
642sbl-xbl.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
642sbl.spamhaus.org
641zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
490countries.blackholes.us (result 127.3.4.4 = Hong Kong)
406aspews.ext.sorbs.net
358countries.blackholes.us (result 127.7.0.2 = Singapore)
298no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
241work.drbl.croco.net
237blackholes.uceb.org (union of all results)
226dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
224no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
222dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
216blackholes.uceb.org (result 127.0.0.6 = spam haven)
194dnsbl.njabl.org (result 127.0.0.4 = spam source)
183bl.deadbeef.com
171query.bondedsender.org (not a blacklist!)
164accredit.habeas.com (not a blacklist!)
155dnsbl.ahbl.org (result 127.0.0.4 = spam source)
154iadb2.isipp.com (not a blacklist!)
154iadb.isipp.com (not a blacklist!)
116blackholes.uceb.org (result 127.0.0.3 = spam source)
113dnsbl.njabl.org (result 127.0.0.2 = open relay)
92multihop.dsbl.org
68multi.surbl.org
68multi.uribl.com (union of all results)
66multi.uribl.com (result 127.0.0.2 = spam resource)
54hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
45blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
41dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
38relays.nether.net
35dnsbl.ahbl.org (result 127.0.0.15 = open relay)
31blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
29rdts.dnsbl.net.au
28exemptions.ahbl.org (not a blacklist!)
23dnsbl.sorbs.net (result 127.0.0.6 = spam source)
21spam.wytnij.to
21countries.blackholes.us (result 127.5.6.6 = Nigeria)
19spamguard.leadmon.net (union of all results)
17dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
10spamguard.leadmon.net (result 127.0.0.8 = open proxy)
9blackholes.uceb.org (result 127.0.0.5 = dialup)
8spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
6ohps.dnsbl.net.au
6blackholes.brainerd.net
5blackholes.uceb.org (result 127.0.0.2 = open relay)
4dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
3spamsites.dnsbl.net.au
2multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
2dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
2osps.dnsbl.net.au
2blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
2dnsbl.ahbl.org (result 127.0.0.20 = blog/wiki/comment spam source)
2dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)
1osrs.dnsbl.net.au
1omrs.dnsbl.net.au
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1blackholes.five-ten-sg.com (result 127.0.0.11 = TCPA violator)
1dob.sibl.support-intelligence.net
1dnsbl.ahbl.org (result 127.0.0.11 = no postmaster or abuse e-mail)


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
231774(total number of IP addresses whose names were tested, including 499 at SDSC)
160055(union of all domain zones)
139436l1.apews.org
108411rddn.dnsbl.net.au
100620abuse.rfc-ignorant.org
68105dynamic.rhs.mailpolice.com
63460whois.rfc-ignorant.org (union of all results)
42526whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
20935whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
10960webmail.rhs.mailpolice.com
923multi.surbl.org
853multi.uribl.com (union of all results)
852multi.uribl.com (result 127.0.0.2 = spam resource)
602adv.rhs.mailpolice.com
152bl.deadbeef.com
97postmaster.rfc-ignorant.org
93rhsbl.ahbl.org
83bulk.rhs.mailpolice.com
68bogusmx.rfc-ignorant.org
65dsn.rfc-ignorant.org (zone not intended for this use)
21rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
21rhsbl.sorbs.net (union of all results)
9dob.sibl.support-intelligence.net
8porn.rhs.mailpolice.com
1multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
1blackhole.securitysage.com
1fraud.rhs.mailpolice.com


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
176693(total number of domains tested, including 485 at SDSC)
40183(union of all domain zones)
22838whois.rfc-ignorant.org (union of all results)
22198whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
8027bogusmx.rfc-ignorant.org
4268abuse.rfc-ignorant.org
2810multi.surbl.org
2345multi.uribl.com (union of all results)
2279multi.uribl.com (result 127.0.0.2 = spam resource)
1798l1.apews.org
1523postmaster.rfc-ignorant.org
1358webmail.rhs.mailpolice.com
828dsn.rfc-ignorant.org
727porn.rhs.mailpolice.com
640whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
361bulk.rhs.mailpolice.com
353rhsbl.ahbl.org
218adv.rhs.mailpolice.com
180blackhole.securitysage.com
150rddn.dnsbl.net.au (zone not intended for this use)
129dynamic.rhs.mailpolice.com
65multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
63rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
63rhsbl.sorbs.net (union of all results)
7dob.sibl.support-intelligence.net
3fraud.rhs.mailpolice.com
2bl.deadbeef.com
1multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
1cart00ney.surriel.com


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 27 December 2007.