Blacklists Compared

31 May 2008

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (127.0.0.1 result), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
209390(total number of IP addresses tested, including 472 at SDSC)
192171(union of most IP zones)
165904l2.apews.org
152240zen.spamhaus.org (union of all results)
132913t1.dnsbl.net.au
97780zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
97529cbl.abuseat.org
97403zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
92640dnsbl-3.uceprotect.net
89855dnsbl-1.uceprotect.net
89049dnsbl-2.uceprotect.net
84283psbl.surriel.com
78283hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
68818dnsbl.sorbs.net (union of all results)
64788no-more-funn.moensted.dk (union of all results)
60297dnsbl.sorbs.net (result 127.0.0.10 = dialup)
60014blackholes.five-ten-sg.com (union of all results)
54952blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
53170ubl.unsubscore.com
48507no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
34668ix.dnsbl.manitu.net
32847bl.spamcop.net
30312db.wpbl.info
26891zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
15804ips.backscatterer.org
14818no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
13213bl.spamcannibal.org
11384countries.blackholes.us (result 127.1.5.6 = China)
10427tr.countries.nerd.dk
9863countries.blackholes.us (result 127.6.4.3 = Russia)
9545hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
8329countries.blackholes.us (result 127.0.7.6 = Brazil)
8095countries.blackholes.us (result 127.7.9.2 = Turkey)
8013dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
7895mail-abuse.blacklist.jippg.org
5774korea.services.net
5502rmst.dnsbl.net.au
5331list.dnswl.org (not a blacklist!)
4871countries.blackholes.us (result 127.4.1.0 = Korea)
4482countries.blackholes.us (result 127.0.3.2 = Argentina)
4360dnsbl.njabl.org (union of all results)
4314countries.blackholes.us (result 127.3.9.2 = Japan)
3979dnsbl.njabl.org (result 127.0.0.9 = open proxy)
3858blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
3603spamsources.fabel.dk
2936hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
2525dnsbl.ahbl.org (union of all results)
2366countries.blackholes.us (result 127.7.6.4 = Thailand)
2332dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
2208countries.blackholes.us (result 127.4.8.4 = Mexico)
1336aspews.ext.sorbs.net
1142blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
984no-more-funn.moensted.dk (result 127.0.0.9 = misc)
951sbl.csma.biz
947zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
922bl.csma.biz
890countries.blackholes.us (result 127.1.5.8 = Taiwan)
690hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
659countries.blackholes.us (result 127.3.4.4 = Hong Kong)
594dnsbl.sorbs.net (result 127.0.0.6 = spam source)
459zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
430countries.blackholes.us (result 127.7.0.2 = Singapore)
408probes.dnsbl.net.au
403no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
349countries.blackholes.us (result 127.4.5.8 = Malaysia)
289dnsbl.njabl.org (result 127.0.0.4 = spam source)
259work.drbl.croco.net
259query.bondedsender.org (not a blacklist!)
198tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
198tor.dnsbl.sectoor.de (union of all results)
184accredit.habeas.com (not a blacklist!)
181iadb2.isipp.com (not a blacklist!)
181no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
177dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
177bl.deadbeef.com
165iadb.isipp.com (not a blacklist!)
148dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
110relays.nether.net
96dnsbl.ahbl.org (result 127.0.0.4 = spam source)
92dnsbl.njabl.org (result 127.0.0.2 = open relay)
90exemptions.ahbl.org (not a blacklist!)
86multi.surbl.org
52dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
30blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
28blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
27dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
24countries.blackholes.us (result 127.5.6.6 = Nigeria)
23dnsbl.ahbl.org (result 127.0.0.15 = open relay)
19rdts.dnsbl.net.au
19spamguard.leadmon.net (union of all results)
15dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
11spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
11blackholes.brainerd.net
9spam.wytnij.to
9multi.uribl.com (result 127.0.0.2 = spam resource)
9dnsbl.ahbl.org (result 127.0.0.20 = blog/wiki/comment spam source)
9multi.uribl.com (union of all results)
5spamguard.leadmon.net (result 127.0.0.3 = spam source)
4no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
3dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
3ohps.dnsbl.net.au
3spamguard.leadmon.net (result 127.0.0.8 = open proxy)
2dnsbl.ahbl.org (result 127.0.0.11 = no postmaster or abuse e-mail)
1osps.dnsbl.net.au
1blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
1blackholes.five-ten-sg.com (result 127.0.0.11 = TCPA violator)
1blackholes.five-ten-sg.com (result 127.0.0.6 = open relay)
1blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
1dob.sibl.support-intelligence.net
1dnsbl.ahbl.org (result 127.0.0.14 = denial-of-service attacker)
1dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
209390(total number of IP addresses whose names were tested, including 472 at SDSC)
118573(union of all domain zones)
93567l1.apews.org
81538abuse.rfc-ignorant.org
64026rddn.dnsbl.net.au
46114whois.rfc-ignorant.org (union of all results)
39887dynamic.rhs.mailpolice.com
32577whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
13539whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
7912webmail.rhs.mailpolice.com
676multi.surbl.org
579adv.rhs.mailpolice.com
559multi.uribl.com (union of all results)
558multi.uribl.com (result 127.0.0.2 = spam resource)
325bl.deadbeef.com
158bogusmx.rfc-ignorant.org
130rhsbl.ahbl.org
115postmaster.rfc-ignorant.org
92bulk.rhs.mailpolice.com
82dsn.rfc-ignorant.org (zone not intended for this use)
38porn.rhs.mailpolice.com
21rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
21rhsbl.sorbs.net (union of all results)
19dob.sibl.support-intelligence.net
2ex.dnsbl.org
1multi.uribl.com (result 127.0.0.4 = opt-out spam resource)


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
147867(total number of domains tested, including 435 at SDSC)
36634(union of all domain zones)
21357whois.rfc-ignorant.org (union of all results)
20637whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
6895bogusmx.rfc-ignorant.org
5193abuse.rfc-ignorant.org
2156postmaster.rfc-ignorant.org
1837l1.apews.org
1813multi.surbl.org
1316multi.uribl.com (union of all results)
1255multi.uribl.com (result 127.0.0.2 = spam resource)
1232webmail.rhs.mailpolice.com
1078dsn.rfc-ignorant.org
720whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
527porn.rhs.mailpolice.com
247adv.rhs.mailpolice.com
210bulk.rhs.mailpolice.com
200rhsbl.ahbl.org
95rddn.dnsbl.net.au (zone not intended for this use)
82dynamic.rhs.mailpolice.com
78dob.sibl.support-intelligence.net
62rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
62rhsbl.sorbs.net (union of all results)
59multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
16ex.dnsbl.org
5bl.deadbeef.com
4fraud.rhs.mailpolice.com
2multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 6 June 2008.