Blacklists Compared

12 January 2008

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (127.0.0.1 result), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
194641(total number of IP addresses tested, including 466 at SDSC)
175990(union of most IP zones)
152697l2.apews.org
140679zen.spamhaus.org (union of all results)
134670t1.dnsbl.net.au
112361sbl-xbl.spamhaus.org (union of all results)
111875xbl.spamhaus.org (union of all results)
111813cbl.abuseat.org
111757zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
111752xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
111749sbl-xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
107658pbl.spamhaus.org (union of all results)
90369dnsbl.tqmcube.com (union of all results)
86589dnsbl-3.uceprotect.net
86543dnsbl.sorbs.net (union of all results)
82848dnsbl-1.uceprotect.net
81006psbl.surriel.com
80190dnsbl-2.uceprotect.net
78862zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
78862pbl.spamhaus.org (result 127.0.0.11 = Spamhaus entry)
69520no-more-funn.moensted.dk (union of all results)
67208ubl.unsubscore.com
64071dnsbl.sorbs.net (result 127.0.0.10 = dialup)
61999blackholes.five-ten-sg.com (union of all results)
57459no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
56175dnsbl.tqmcube.com (result 127.0.0.2 = dialup)
56060blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
54583hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
36167sbl.csma.biz
35710bl.csma.biz
33186dnsbl.tqmcube.com (result 127.0.0.3 = spam source)
31439bl.spamcop.net
30379ix.dnsbl.manitu.net
28796zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
28796pbl.spamhaus.org (result 127.0.0.10 = ISP contributed)
23446dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
23146db.wpbl.info
13255ips.backscatterer.org
11230bl.spamcannibal.org
11098unconfirmed.dsbl.org
10891list.dsbl.org
10889dsbl.dnsbl.net.au
10315no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
9825tr.countries.nerd.dk
9235mail-abuse.blacklist.jippg.org
8734countries.blackholes.us (result 127.7.9.2 = Turkey)
7651countries.blackholes.us (result 127.0.7.6 = Brazil)
5944countries.blackholes.us (result 127.6.4.3 = Russia)
5728dnsbl.tqmcube.com (result 127.0.0.5 = China)
5708korea.services.net
5704list.dnswl.org (not a blacklist!)
5647countries.blackholes.us (result 127.1.5.6 = China)
5550dnsbl.tqmcube.com (result 127.0.0.4 = South Korea)
5490rmst.dnsbl.net.au
5208countries.blackholes.us (result 127.4.1.0 = Korea)
4838blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
3572dnsbl.njabl.org (union of all results)
3260countries.blackholes.us (result 127.3.9.2 = Japan)
3133dnsbl.njabl.org (result 127.0.0.9 = open proxy)
2553countries.blackholes.us (result 127.0.3.2 = Argentina)
2550hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
2132spamsources.fabel.dk
2077countries.blackholes.us (result 127.7.6.4 = Thailand)
1955dnsbl.ahbl.org (union of all results)
1821dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
1760countries.blackholes.us (result 127.4.8.4 = Mexico)
1025no-more-funn.moensted.dk (result 127.0.0.9 = misc)
1013blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
901countries.blackholes.us (result 127.4.5.8 = Malaysia)
842countries.blackholes.us (result 127.1.5.8 = Taiwan)
807probes.dnsbl.net.au
782zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
782xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
782sbl-xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
775aspews.ext.sorbs.net
737hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
612no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
585countries.blackholes.us (result 127.3.4.4 = Hong Kong)
577zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
577sbl-xbl.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
577sbl.spamhaus.org
329countries.blackholes.us (result 127.7.0.2 = Singapore)
291dnsbl.njabl.org (result 127.0.0.4 = spam source)
242work.drbl.croco.net
227blackholes.uceb.org (union of all results)
220dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
218dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
183bl.deadbeef.com
171blackholes.uceb.org (result 127.0.0.6 = spam haven)
169multihop.dsbl.org
163no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
157accredit.habeas.com (not a blacklist!)
155query.bondedsender.org (not a blacklist!)
151iadb2.isipp.com (not a blacklist!)
148dnsbl.njabl.org (result 127.0.0.2 = open relay)
144iadb.isipp.com (not a blacklist!)
103relays.nether.net
98hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
95dnsbl.ahbl.org (result 127.0.0.4 = spam source)
79exemptions.ahbl.org (not a blacklist!)
72blackholes.uceb.org (result 127.0.0.3 = spam source)
62dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
59multi.surbl.org
58blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
33blackholes.uceb.org (result 127.0.0.2 = open relay)
28dnsbl.sorbs.net (result 127.0.0.6 = spam source)
27multi.uribl.com (union of all results)
26multi.uribl.com (result 127.0.0.2 = spam resource)
26rdts.dnsbl.net.au
24blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
21spamguard.leadmon.net (union of all results)
20spam.wytnij.to
15blackholes.brainerd.net
14countries.blackholes.us (result 127.5.6.6 = Nigeria)
13dnsbl.ahbl.org (result 127.0.0.15 = open relay)
11blackholes.uceb.org (result 127.0.0.5 = dialup)
11dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
9spamguard.leadmon.net (result 127.0.0.8 = open proxy)
7spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
7dnsbl.ahbl.org (result 127.0.0.20 = blog/wiki/comment spam source)
6dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
5spamguard.leadmon.net (result 127.0.0.3 = spam source)
5no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
5dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
4ohps.dnsbl.net.au
4blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
2owps.dnsbl.net.au
2spamsites.dnsbl.net.au
2omrs.dnsbl.net.au
2dnsbl.ahbl.org (result 127.0.0.11 = no postmaster or abuse e-mail)
1multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
1osps.dnsbl.net.au
1osrs.dnsbl.net.au
1blackholes.five-ten-sg.com (result 127.0.0.11 = TCPA violator)
1blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
1dob.sibl.support-intelligence.net
1dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
194641(total number of IP addresses whose names were tested, including 466 at SDSC)
117862(union of all domain zones)
98155l1.apews.org
72340rddn.dnsbl.net.au
70101abuse.rfc-ignorant.org
43879whois.rfc-ignorant.org (union of all results)
42972dynamic.rhs.mailpolice.com
28542whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
15338whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
8888webmail.rhs.mailpolice.com
715multi.surbl.org
644multi.uribl.com (union of all results)
643multi.uribl.com (result 127.0.0.2 = spam resource)
550adv.rhs.mailpolice.com
133postmaster.rfc-ignorant.org
109bl.deadbeef.com
106bogusmx.rfc-ignorant.org
104dsn.rfc-ignorant.org (zone not intended for this use)
93rhsbl.ahbl.org
91bulk.rhs.mailpolice.com
27porn.rhs.mailpolice.com
22dob.sibl.support-intelligence.net
20rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
20rhsbl.sorbs.net (union of all results)
2ex.dnsbl.org
1multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
1blackhole.securitysage.com


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
143807(total number of domains tested, including 419 at SDSC)
34052(union of all domain zones)
19505whois.rfc-ignorant.org (union of all results)
18944whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
6091bogusmx.rfc-ignorant.org
3819abuse.rfc-ignorant.org
2541multi.surbl.org
2330multi.uribl.com (union of all results)
2287multi.uribl.com (result 127.0.0.2 = spam resource)
1672l1.apews.org
1302postmaster.rfc-ignorant.org
1267webmail.rhs.mailpolice.com
743dsn.rfc-ignorant.org
593porn.rhs.mailpolice.com
561whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
290bulk.rhs.mailpolice.com
288rhsbl.ahbl.org
229adv.rhs.mailpolice.com
135blackhole.securitysage.com
134rddn.dnsbl.net.au (zone not intended for this use)
116dynamic.rhs.mailpolice.com
66rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
66rhsbl.sorbs.net (union of all results)
40multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
20dob.sibl.support-intelligence.net
12ex.dnsbl.org
7bl.deadbeef.com
3multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
2fraud.rhs.mailpolice.com


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 18 January 2008.