Blacklists Compared

12 July 2008

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (127.0.0.1 result), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
135210(total number of IP addresses tested, including 559 at SDSC)
129545(union of most IP zones)
111316zen.spamhaus.org (union of all results)
107406l2.apews.org
96925t1.dnsbl.net.au
69915zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
69378dnsbl-3.uceprotect.net
68187cbl.abuseat.org
68139zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
66561dnsbl-1.uceprotect.net
64813dnsbl-2.uceprotect.net
56353psbl.surriel.com
54125dnsbl.sorbs.net (union of all results)
53871hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
43660no-more-funn.moensted.dk (union of all results)
42289dnsbl.sorbs.net (result 127.0.0.10 = dialup)
42181blackholes.five-ten-sg.com (union of all results)
37828blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
32313no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
29544ubl.unsubscore.com
28348ix.dnsbl.manitu.net
24342bl.spamcop.net
22656db.wpbl.info
21065zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
11323dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
11322spam.dnsbl.sorbs.net
11022no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
9393countries.blackholes.us (result 127.1.5.6 = China)
8412bl.spamcannibal.org
7895tr.countries.nerd.dk
7875countries.blackholes.us (result 127.6.4.3 = Russia)
6912countries.blackholes.us (result 127.0.7.6 = Brazil)
6592hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
6029countries.blackholes.us (result 127.7.9.2 = Turkey)
5844dnsbl.inps.de
5232mail-abuse.blacklist.jippg.org
3871list.dnswl.org (not a blacklist!)
3313korea.services.net
3266rmst.dnsbl.net.au
3220blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
3212dnsbl.njabl.org (union of all results)
2814sbl.csma.biz
2740dnsbl.njabl.org (result 127.0.0.9 = open proxy)
2725countries.blackholes.us (result 127.4.1.0 = Korea)
2575spamsources.fabel.dk
2569countries.blackholes.us (result 127.0.3.2 = Argentina)
2510ips.backscatterer.org
2341bl.csma.biz
2237hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
1793countries.blackholes.us (result 127.7.6.4 = Thailand)
1745dnsbl.ahbl.org (union of all results)
1529dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
1090blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
973countries.blackholes.us (result 127.4.8.4 = Mexico)
961dnsbl.sorbs.net (result 127.0.0.6 = spam source)
858aspews.ext.sorbs.net
720zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
507countries.blackholes.us (result 127.1.5.8 = Taiwan)
501countries.blackholes.us (result 127.3.9.2 = Japan)
392zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
367hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
348dnsbl.njabl.org (result 127.0.0.4 = spam source)
273query.bondedsender.org (not a blacklist!)
247probes.dnsbl.net.au
243countries.blackholes.us (result 127.7.0.2 = Singapore)
213no-more-funn.moensted.dk (result 127.0.0.9 = misc)
208countries.blackholes.us (result 127.4.5.8 = Malaysia)
197countries.blackholes.us (result 127.3.4.4 = Hong Kong)
197work.drbl.croco.net
176iadb2.isipp.com (not a blacklist!)
176accredit.habeas.com (not a blacklist!)
160iadb.isipp.com (not a blacklist!)
153dnsbl.ahbl.org (result 127.0.0.4 = spam source)
138bl.deadbeef.com
124dnsbl.njabl.org (result 127.0.0.2 = open relay)
110tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
110tor.dnsbl.sectoor.de (union of all results)
108no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
98dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
87dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
84no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
72multi.surbl.org
28dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
27exemptions.ahbl.org (not a blacklist!)
24blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
21dnsbl.ahbl.org (result 127.0.0.15 = open relay)
18blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
16countries.blackholes.us (result 127.5.6.6 = Nigeria)
12dnsbl.sorbs.net (result 127.0.0.5 = open relay)
12dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
12rdts.dnsbl.net.au
12dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
10spam.wytnij.to
7multi.uribl.com (result 127.0.0.2 = spam resource)
7multi.uribl.com (union of all results)
7spamguard.leadmon.net (union of all results)
4blackholes.brainerd.net
3spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
3spamguard.leadmon.net (result 127.0.0.8 = open proxy)
2ohps.dnsbl.net.au
1dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
1dob.sibl.support-intelligence.net
1dnsbl.ahbl.org (result 127.0.0.11 = no postmaster or abuse e-mail)
1dnsbl.ahbl.org (result 127.0.0.14 = denial-of-service attacker)


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
135210(total number of IP addresses whose names were tested, including 559 at SDSC)
78073(union of all domain zones)
59400l1.apews.org
56347abuse.rfc-ignorant.org
46198rddn.dnsbl.net.au
29096dynamic.rhs.mailpolice.com
28325whois.rfc-ignorant.org (union of all results)
19056whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
9270whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
5259webmail.rhs.mailpolice.com
541adv.rhs.mailpolice.com
412multi.surbl.org
375multi.uribl.com (union of all results)
374multi.uribl.com (result 127.0.0.2 = spam resource)
362bl.deadbeef.com
72rhsbl.ahbl.org
64postmaster.rfc-ignorant.org
53bulk.rhs.mailpolice.com
49bogusmx.rfc-ignorant.org
45dsn.rfc-ignorant.org (zone not intended for this use)
26rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
26rhsbl.sorbs.net (union of all results)
19dob.sibl.support-intelligence.net
3porn.rhs.mailpolice.com
1multi.uribl.com (result 127.0.0.4 = opt-out spam resource)


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
123494(total number of domains tested, including 520 at SDSC)
26156(union of all domain zones)
13050whois.rfc-ignorant.org (union of all results)
12429whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
5011bogusmx.rfc-ignorant.org
4283abuse.rfc-ignorant.org
2165postmaster.rfc-ignorant.org
1892multi.surbl.org
1598multi.uribl.com (union of all results)
1548multi.uribl.com (result 127.0.0.2 = spam resource)
1522l1.apews.org
1096webmail.rhs.mailpolice.com
954dsn.rfc-ignorant.org
621whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
439porn.rhs.mailpolice.com
282adv.rhs.mailpolice.com
185rhsbl.ahbl.org
148bulk.rhs.mailpolice.com
131rddn.dnsbl.net.au (zone not intended for this use)
123dynamic.rhs.mailpolice.com
64dob.sibl.support-intelligence.net
50multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
38rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
38rhsbl.sorbs.net (union of all results)
15ex.dnsbl.org
4fraud.rhs.mailpolice.com
4bl.deadbeef.com


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 17 July 2008.