Blacklists Compared

1 March 2008

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (127.0.0.1 result), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
236237(total number of IP addresses tested, including 454 at SDSC)
225647(union of most IP zones)
203753l2.apews.org
194616zen.spamhaus.org (union of all results)
177245t1.dnsbl.net.au
129089zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
128174cbl.abuseat.org
122644zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
119652dnsbl-3.uceprotect.net
119519dnsbl-2.uceprotect.net
110501psbl.surriel.com
105932dnsbl-1.uceprotect.net
96929dnsbl.sorbs.net (union of all results)
91743no-more-funn.moensted.dk (union of all results)
86223dnsbl.sorbs.net (result 127.0.0.10 = dialup)
84709blackholes.five-ten-sg.com (union of all results)
78635blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
74019ubl.unsubscore.com
73093hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
71820no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
47388sbl.csma.biz
47012bl.csma.biz
45409bl.spamcop.net
37162ix.dnsbl.manitu.net
34410zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
26057db.wpbl.info
18875no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
15833unconfirmed.dsbl.org
15764dsbl.dnsbl.net.au
15714list.dsbl.org
14113tr.countries.nerd.dk
13767bl.spamcannibal.org
12075countries.blackholes.us (result 127.1.5.6 = China)
11666countries.blackholes.us (result 127.7.9.2 = Turkey)
10237mail-abuse.blacklist.jippg.org
10166dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
9576korea.services.net
9533countries.blackholes.us (result 127.0.7.6 = Brazil)
8554countries.blackholes.us (result 127.4.1.0 = Korea)
8039countries.blackholes.us (result 127.6.4.3 = Russia)
7691ips.backscatterer.org
7314rmst.dnsbl.net.au
4945blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
4901dnsbl.njabl.org (union of all results)
4748list.dnswl.org (not a blacklist!)
4618dnsbl.njabl.org (result 127.0.0.9 = open proxy)
3669countries.blackholes.us (result 127.0.3.2 = Argentina)
3385spamsources.fabel.dk
2887dnsbl.ahbl.org (union of all results)
2862countries.blackholes.us (result 127.4.8.4 = Mexico)
2675dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
2377hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
2220aspews.ext.sorbs.net
2153countries.blackholes.us (result 127.7.6.4 = Thailand)
1413countries.blackholes.us (result 127.3.9.2 = Japan)
1163hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
1050blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
1045zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
963countries.blackholes.us (result 127.4.5.8 = Malaysia)
800zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
794countries.blackholes.us (result 127.1.5.8 = Taiwan)
684probes.dnsbl.net.au
656no-more-funn.moensted.dk (result 127.0.0.9 = misc)
627dnsbl.sorbs.net (result 127.0.0.6 = spam source)
445countries.blackholes.us (result 127.3.4.4 = Hong Kong)
375countries.blackholes.us (result 127.7.0.2 = Singapore)
325no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
287dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
281dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
274bl.deadbeef.com
248work.drbl.croco.net
220query.bondedsender.org (not a blacklist!)
198dnsbl.njabl.org (result 127.0.0.4 = spam source)
187accredit.habeas.com (not a blacklist!)
135hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
129no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
127iadb2.isipp.com (not a blacklist!)
120iadb.isipp.com (not a blacklist!)
116dnsbl.ahbl.org (result 127.0.0.4 = spam source)
109multihop.dsbl.org
102multi.surbl.org
85dnsbl.njabl.org (result 127.0.0.2 = open relay)
56dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
46countries.blackholes.us (result 127.5.6.6 = Nigeria)
45relays.nether.net
40rdts.dnsbl.net.au
40blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
38blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
35exemptions.ahbl.org (not a blacklist!)
35dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
31dnsbl.ahbl.org (result 127.0.0.15 = open relay)
22dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
19multi.uribl.com (result 127.0.0.2 = spam resource)
19multi.uribl.com (union of all results)
17spamguard.leadmon.net (union of all results)
15spam.wytnij.to
8blackholes.brainerd.net
7spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
7spamguard.leadmon.net (result 127.0.0.8 = open proxy)
4no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
3spamguard.leadmon.net (result 127.0.0.3 = spam source)
3dnsbl.ahbl.org (result 127.0.0.14 = denial-of-service attacker)
2spamsites.dnsbl.net.au
2ohps.dnsbl.net.au
2dnsbl.ahbl.org (result 127.0.0.11 = no postmaster or abuse e-mail)
2dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)
1osps.dnsbl.net.au
1osrs.dnsbl.net.au
1blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
1dob.sibl.support-intelligence.net
1dnsbl.ahbl.org (result 127.0.0.20 = blog/wiki/comment spam source)


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
236237(total number of IP addresses whose names were tested, including 454 at SDSC)
143807(union of all domain zones)
124470l1.apews.org
94151abuse.rfc-ignorant.org
89438rddn.dnsbl.net.au
56704whois.rfc-ignorant.org (union of all results)
44088dynamic.rhs.mailpolice.com
38402whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
18302whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
7090webmail.rhs.mailpolice.com
692multi.surbl.org
584multi.uribl.com (result 127.0.0.2 = spam resource)
584multi.uribl.com (union of all results)
216adv.rhs.mailpolice.com
146bl.deadbeef.com
115postmaster.rfc-ignorant.org
99bogusmx.rfc-ignorant.org
86rhsbl.ahbl.org
78dsn.rfc-ignorant.org (zone not intended for this use)
39bulk.rhs.mailpolice.com
21rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
21rhsbl.sorbs.net (union of all results)
13porn.rhs.mailpolice.com
12dob.sibl.support-intelligence.net
2blackhole.securitysage.com


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
147216(total number of domains tested, including 410 at SDSC)
34977(union of all domain zones)
17555whois.rfc-ignorant.org (union of all results)
16904whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
9311bogusmx.rfc-ignorant.org
4857abuse.rfc-ignorant.org
2414multi.surbl.org
2130multi.uribl.com (union of all results)
2058multi.uribl.com (result 127.0.0.2 = spam resource)
1911postmaster.rfc-ignorant.org
1663l1.apews.org
943dsn.rfc-ignorant.org
651whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
175blackhole.securitysage.com
174rhsbl.ahbl.org
75rddn.dnsbl.net.au (zone not intended for this use)
70multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
69rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
69rhsbl.sorbs.net (union of all results)
15dob.sibl.support-intelligence.net
13ex.dnsbl.org
5bl.deadbeef.com
2multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 7 March 2008.