Blacklists Compared

24 May 2008

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (127.0.0.1 result), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
207110(total number of IP addresses tested, including 479 at SDSC)
193755(union of most IP zones)
172989l2.apews.org
161702zen.spamhaus.org (union of all results)
139460t1.dnsbl.net.au
105204zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
102325dnsbl-3.uceprotect.net
99419cbl.abuseat.org
99302zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
95093dnsbl-2.uceprotect.net
93171dnsbl-1.uceprotect.net
84628psbl.surriel.com
80209hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
75170dnsbl.sorbs.net (union of all results)
68497no-more-funn.moensted.dk (union of all results)
66106dnsbl.sorbs.net (result 127.0.0.10 = dialup)
64426blackholes.five-ten-sg.com (union of all results)
59102blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
51711no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
42613ix.dnsbl.manitu.net
37087bl.spamcop.net
29904db.wpbl.info
28509zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
27536ubl.unsubscore.com
15217no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
13616sbl.csma.biz
13452bl.csma.biz
12809bl.spamcannibal.org
11418countries.blackholes.us (result 127.1.5.6 = China)
11077ips.backscatterer.org
10468tr.countries.nerd.dk
9999hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
9138countries.blackholes.us (result 127.0.7.6 = Brazil)
8894mail-abuse.blacklist.jippg.org
8779countries.blackholes.us (result 127.6.4.3 = Russia)
8462dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
8180countries.blackholes.us (result 127.7.9.2 = Turkey)
6321korea.services.net
6294rmst.dnsbl.net.au
5373countries.blackholes.us (result 127.4.1.0 = Korea)
5068list.dnswl.org (not a blacklist!)
5008countries.blackholes.us (result 127.0.3.2 = Argentina)
4826dnsbl.njabl.org (union of all results)
4347dnsbl.njabl.org (result 127.0.0.9 = open proxy)
4084blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
3677spamsources.fabel.dk
2808dnsbl.ahbl.org (union of all results)
2688hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
2612dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
2596countries.blackholes.us (result 127.4.8.4 = Mexico)
2510countries.blackholes.us (result 127.3.9.2 = Japan)
2358countries.blackholes.us (result 127.7.6.4 = Thailand)
1296aspews.ext.sorbs.net
1173blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
1059no-more-funn.moensted.dk (result 127.0.0.9 = misc)
967zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
817hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
793dnsbl.sorbs.net (result 127.0.0.6 = spam source)
706countries.blackholes.us (result 127.1.5.8 = Taiwan)
477countries.blackholes.us (result 127.3.4.4 = Hong Kong)
435probes.dnsbl.net.au
420no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
415zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
385dnsbl.njabl.org (result 127.0.0.4 = spam source)
346countries.blackholes.us (result 127.4.5.8 = Malaysia)
328countries.blackholes.us (result 127.7.0.2 = Singapore)
270work.drbl.croco.net
256query.bondedsender.org (not a blacklist!)
214dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
207no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
198accredit.habeas.com (not a blacklist!)
188dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
186iadb2.isipp.com (not a blacklist!)
178bl.deadbeef.com
176tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
176tor.dnsbl.sectoor.de (union of all results)
173iadb.isipp.com (not a blacklist!)
130dnsbl.ahbl.org (result 127.0.0.4 = spam source)
94dnsbl.njabl.org (result 127.0.0.2 = open relay)
85relays.nether.net
69multi.surbl.org
62dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
60exemptions.ahbl.org (not a blacklist!)
40dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
34blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
32blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
30countries.blackholes.us (result 127.5.6.6 = Nigeria)
26rdts.dnsbl.net.au
18spamguard.leadmon.net (union of all results)
13dnsbl.ahbl.org (result 127.0.0.15 = open relay)
8spam.wytnij.to
8spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
7blackholes.brainerd.net
6dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
5multi.uribl.com (result 127.0.0.2 = spam resource)
5spamguard.leadmon.net (result 127.0.0.3 = spam source)
5spamguard.leadmon.net (result 127.0.0.8 = open proxy)
5dnsbl.ahbl.org (result 127.0.0.20 = blog/wiki/comment spam source)
5multi.uribl.com (union of all results)
4no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
3ohps.dnsbl.net.au
2dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
1spamsites.dnsbl.net.au
1blackholes.five-ten-sg.com (result 127.0.0.11 = TCPA violator)
1dob.sibl.support-intelligence.net
1dnsbl.ahbl.org (result 127.0.0.11 = no postmaster or abuse e-mail)
1dnsbl.ahbl.org (result 127.0.0.14 = denial-of-service attacker)
1dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
207110(total number of IP addresses whose names were tested, including 479 at SDSC)
121508(union of all domain zones)
100510l1.apews.org
85037abuse.rfc-ignorant.org
68347rddn.dnsbl.net.au
47742whois.rfc-ignorant.org (union of all results)
43440dynamic.rhs.mailpolice.com
33952whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
13790whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
8039webmail.rhs.mailpolice.com
691multi.surbl.org
617multi.uribl.com (union of all results)
616multi.uribl.com (result 127.0.0.2 = spam resource)
597adv.rhs.mailpolice.com
313bl.deadbeef.com
192bulk.rhs.mailpolice.com
147bogusmx.rfc-ignorant.org
105postmaster.rfc-ignorant.org
101rhsbl.ahbl.org
75dsn.rfc-ignorant.org (zone not intended for this use)
35rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
35rhsbl.sorbs.net (union of all results)
24dob.sibl.support-intelligence.net
15porn.rhs.mailpolice.com
2ex.dnsbl.org
1multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
1fraud.rhs.mailpolice.com


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
156957(total number of domains tested, including 427 at SDSC)
38253(union of all domain zones)
21936whois.rfc-ignorant.org (union of all results)
21182whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
7329bogusmx.rfc-ignorant.org
5871abuse.rfc-ignorant.org
2272postmaster.rfc-ignorant.org
1910multi.surbl.org
1901l1.apews.org
1545multi.uribl.com (union of all results)
1489multi.uribl.com (result 127.0.0.2 = spam resource)
1408webmail.rhs.mailpolice.com
1094dsn.rfc-ignorant.org
754whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
521porn.rhs.mailpolice.com
267adv.rhs.mailpolice.com
214rhsbl.ahbl.org
204bulk.rhs.mailpolice.com
119rddn.dnsbl.net.au (zone not intended for this use)
92dynamic.rhs.mailpolice.com
60rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
60rhsbl.sorbs.net (union of all results)
55multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
35dob.sibl.support-intelligence.net
17ex.dnsbl.org
5bl.deadbeef.com
2fraud.rhs.mailpolice.com
1multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 30 May 2008.