Blacklists Compared

5 April 2008

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (127.0.0.1 result), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
219969(total number of IP addresses tested, including 473 at SDSC)
206525(union of most IP zones)
180661l2.apews.org
169163zen.spamhaus.org (union of all results)
154400t1.dnsbl.net.au
109324zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
109315cbl.abuseat.org
106604zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
102934dnsbl-3.uceprotect.net
97484dnsbl-2.uceprotect.net
94267dnsbl-1.uceprotect.net
93229psbl.surriel.com
86840dnsbl.sorbs.net (union of all results)
79344hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
75960no-more-funn.moensted.dk (union of all results)
74871dnsbl.sorbs.net (result 127.0.0.10 = dialup)
70358blackholes.five-ten-sg.com (union of all results)
64694blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
60555no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
39599bl.spamcop.net
37655ubl.unsubscore.com
35088ix.dnsbl.manitu.net
32645zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
30201db.wpbl.info
23461sbl.csma.biz
23457bl.csma.biz
14470unconfirmed.dsbl.org
14328no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
14310list.dsbl.org
14299dsbl.dnsbl.net.au
12929mail-abuse.blacklist.jippg.org
12741bl.spamcannibal.org
12493dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
12414tr.countries.nerd.dk
12360ips.backscatterer.org
11092countries.blackholes.us (result 127.1.5.6 = China)
10021countries.blackholes.us (result 127.7.9.2 = Turkey)
8986countries.blackholes.us (result 127.0.7.6 = Brazil)
7238countries.blackholes.us (result 127.6.4.3 = Russia)
6821rmst.dnsbl.net.au
6584hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
5247korea.services.net
5007list.dnswl.org (not a blacklist!)
4558countries.blackholes.us (result 127.4.1.0 = Korea)
4508blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
4148dnsbl.njabl.org (union of all results)
3826dnsbl.njabl.org (result 127.0.0.9 = open proxy)
3453countries.blackholes.us (result 127.0.3.2 = Argentina)
3301spamsources.fabel.dk
2703countries.blackholes.us (result 127.3.9.2 = Japan)
2605dnsbl.ahbl.org (union of all results)
2451hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
2399dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
2190countries.blackholes.us (result 127.4.8.4 = Mexico)
2118countries.blackholes.us (result 127.7.6.4 = Thailand)
1529aspews.ext.sorbs.net
1073blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
866zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
848countries.blackholes.us (result 127.1.5.8 = Taiwan)
848hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
689countries.blackholes.us (result 127.4.5.8 = Malaysia)
552countries.blackholes.us (result 127.3.4.4 = Hong Kong)
550no-more-funn.moensted.dk (result 127.0.0.9 = misc)
525zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
487probes.dnsbl.net.au
443no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
380dnsbl.sorbs.net (result 127.0.0.6 = spam source)
321countries.blackholes.us (result 127.7.0.2 = Singapore)
272query.bondedsender.org (not a blacklist!)
242work.drbl.croco.net
241tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
241tor.dnsbl.sectoor.de (union of all results)
230dnsbl.njabl.org (result 127.0.0.4 = spam source)
228dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
222dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
191bl.deadbeef.com
188accredit.habeas.com (not a blacklist!)
144iadb2.isipp.com (not a blacklist!)
134iadb.isipp.com (not a blacklist!)
126dnsbl.ahbl.org (result 127.0.0.4 = spam source)
124multihop.dsbl.org
117no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
101multi.surbl.org
92dnsbl.njabl.org (result 127.0.0.2 = open relay)
84relays.nether.net
66exemptions.ahbl.org (not a blacklist!)
65dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
49blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
38countries.blackholes.us (result 127.5.6.6 = Nigeria)
37dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
32blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
27rdts.dnsbl.net.au
25dnsbl.ahbl.org (result 127.0.0.15 = open relay)
20spamguard.leadmon.net (union of all results)
14multi.uribl.com (union of all results)
13multi.uribl.com (result 127.0.0.2 = spam resource)
12dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
9spamguard.leadmon.net (result 127.0.0.8 = open proxy)
8blackholes.brainerd.net
7spam.wytnij.to
7ohps.dnsbl.net.au
6spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
5no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
4dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
4spamguard.leadmon.net (result 127.0.0.3 = spam source)
4dnsbl.ahbl.org (result 127.0.0.20 = blog/wiki/comment spam source)
3ricn.dnsbl.net.au
2osrs.dnsbl.net.au
1multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
1spamsites.dnsbl.net.au
1osps.dnsbl.net.au
1spamguard.leadmon.net (result 127.0.0.5 = open relay)
1blackholes.five-ten-sg.com (result 127.0.0.11 = TCPA violator)
1blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
1dob.sibl.support-intelligence.net
1dnsbl.ahbl.org (result 127.0.0.11 = no postmaster or abuse e-mail)
1dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
219969(total number of IP addresses whose names were tested, including 473 at SDSC)
132713(union of all domain zones)
109455l1.apews.org
89550abuse.rfc-ignorant.org
79398rddn.dnsbl.net.au
50447whois.rfc-ignorant.org (union of all results)
50363dynamic.rhs.mailpolice.com
32838whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
17609whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
8523webmail.rhs.mailpolice.com
706multi.surbl.org
597multi.uribl.com (union of all results)
596multi.uribl.com (result 127.0.0.2 = spam resource)
584adv.rhs.mailpolice.com
138bl.deadbeef.com
102rhsbl.ahbl.org
100bogusmx.rfc-ignorant.org
99postmaster.rfc-ignorant.org
60dsn.rfc-ignorant.org (zone not intended for this use)
59bulk.rhs.mailpolice.com
45dob.sibl.support-intelligence.net
30rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
30rhsbl.sorbs.net (union of all results)
29porn.rhs.mailpolice.com
2ex.dnsbl.org
1multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
1blackhole.securitysage.com


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
142664(total number of domains tested, including 441 at SDSC)
35096(union of all domain zones)
20208whois.rfc-ignorant.org (union of all results)
19495whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
6595bogusmx.rfc-ignorant.org
4919abuse.rfc-ignorant.org
2004multi.surbl.org
1914postmaster.rfc-ignorant.org
1861multi.uribl.com (union of all results)
1795multi.uribl.com (result 127.0.0.2 = spam resource)
1746l1.apews.org
1112webmail.rhs.mailpolice.com
1058dsn.rfc-ignorant.org
713whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
404porn.rhs.mailpolice.com
242adv.rhs.mailpolice.com
177rhsbl.ahbl.org
171bulk.rhs.mailpolice.com
167blackhole.securitysage.com
127rddn.dnsbl.net.au (zone not intended for this use)
108dynamic.rhs.mailpolice.com
69rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
69rhsbl.sorbs.net (union of all results)
63multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
35dob.sibl.support-intelligence.net
14ex.dnsbl.org
5bl.deadbeef.com
3multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
3fraud.rhs.mailpolice.com


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 11 April 2008.