Blacklists Compared

30 August 2008

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (127.0.0.1 result), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
190889(total number of IP addresses tested, including 461 at SDSC)
184365(union of most IP zones)
163928zen.spamhaus.org (union of all results)
144080t1.dnsbl.net.au
109810cbl.abuseat.org
109672zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
101478zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
97555psbl.surriel.com
95823dnsbl-3.uceprotect.net
90057dnsbl-2.uceprotect.net
88432dnsbl.sorbs.net (union of all results)
86887dnsbl-1.uceprotect.net
78118hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
61685no-more-funn.moensted.dk (union of all results)
59266dnsbl.sorbs.net (result 127.0.0.10 = dialup)
53461blackholes.five-ten-sg.com (union of all results)
50343ubl.unsubscore.com
48691blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
43642no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
39736db.wpbl.info
36839bl.spamcop.net
32142ix.dnsbl.manitu.net
28995dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
27947zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
16392no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
12835spam.dnsbl.sorbs.net
11806countries.blackholes.us (result 127.1.5.6 = China)
10868bl.spamcannibal.org
10501tr.countries.nerd.dk
10133dnsbl.inps.de
10073hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
8313countries.blackholes.us (result 127.0.7.6 = Brazil)
8026mail-abuse.blacklist.jippg.org
7886countries.blackholes.us (result 127.6.4.3 = Russia)
7791countries.blackholes.us (result 127.7.9.2 = Turkey)
7498korea.services.net
5978countries.blackholes.us (result 127.4.1.0 = Korea)
5591spamsources.fabel.dk
5122sbl.csma.biz
4910ips.backscatterer.org
4655bl.csma.biz
4622countries.blackholes.us (result 127.7.6.4 = Thailand)
4344dnsbl.njabl.org (union of all results)
3980list.dnswl.org (not a blacklist!)
3826countries.blackholes.us (result 127.0.3.2 = Argentina)
3743blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
3513dnsbl.njabl.org (result 127.0.0.9 = open proxy)
2659hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
2365rmst.dnsbl.net.au
1886aspews.ext.sorbs.net
1642countries.blackholes.us (result 127.4.8.4 = Mexico)
1227no-more-funn.moensted.dk (result 127.0.0.9 = misc)
1022countries.blackholes.us (result 127.3.9.2 = Japan)
989blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
976countries.blackholes.us (result 127.1.5.8 = Taiwan)
739dnsbl.ahbl.org (union of all results)
662dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
654dnsbl.njabl.org (result 127.0.0.4 = spam source)
545zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
522countries.blackholes.us (result 127.7.0.2 = Singapore)
494zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
416countries.blackholes.us (result 127.3.4.4 = Hong Kong)
307query.bondedsender.org (not a blacklist!)
261countries.blackholes.us (result 127.4.5.8 = Malaysia)
256dnsbl.sorbs.net (result 127.0.0.6 = spam source)
251no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
241no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
222probes.dnsbl.net.au
218work.drbl.croco.net
194accredit.habeas.com (not a blacklist!)
177dnsbl.njabl.org (result 127.0.0.2 = open relay)
169iadb2.isipp.com (not a blacklist!)
166bl.deadbeef.com
148tor.dnsbl.sectoor.de (union of all results)
147tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
128hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
128iadb.isipp.com (not a blacklist!)
92l2.apews.org
91dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
85dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
80multi.surbl.org
51dnsbl.ahbl.org (result 127.0.0.4 = spam source)
24exemptions.ahbl.org (not a blacklist!)
21blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
17blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
17dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
16countries.blackholes.us (result 127.5.6.6 = Nigeria)
15rdts.dnsbl.net.au
14spamguard.leadmon.net (union of all results)
11spam.wytnij.to
10dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
8dnsbl.sorbs.net (result 127.0.0.5 = open relay)
8spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
6dnsbl.ahbl.org (result 127.0.0.15 = open relay)
5spamguard.leadmon.net (result 127.0.0.8 = open proxy)
4blackholes.brainerd.net
2dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
2dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
2dnsbl.ahbl.org (result 127.0.0.20 = blog/wiki/comment spam source)
1tor.dnsbl.sectoor.de (result 127.0.0.1 = Tor server)
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1dob.sibl.support-intelligence.net


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
190889(total number of IP addresses whose names were tested, including 461 at SDSC)
104232(union of all domain zones)
76405abuse.rfc-ignorant.org
63518rddn.dnsbl.net.au
41357whois.rfc-ignorant.org (union of all results)
41289dynamic.rhs.mailpolice.com
27833whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
22094l1.apews.org
13524whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
7639webmail.rhs.mailpolice.com
614adv.rhs.mailpolice.com
460bl.deadbeef.com
413multi.surbl.org
248multi.uribl.com (union of all results)
245multi.uribl.com (result 127.0.0.2 = spam resource)
188bulk.rhs.mailpolice.com
85postmaster.rfc-ignorant.org
83bogusmx.rfc-ignorant.org
67dsn.rfc-ignorant.org (zone not intended for this use)
63rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
63rhsbl.sorbs.net (union of all results)
36rhsbl.ahbl.org
27dob.sibl.support-intelligence.net
4porn.rhs.mailpolice.com
2multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
1multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
1fraud.rhs.mailpolice.com


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
146161(total number of domains tested, including 415 at SDSC)
28780(union of all domain zones)
14777whois.rfc-ignorant.org (union of all results)
14129whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
6237bogusmx.rfc-ignorant.org
4532abuse.rfc-ignorant.org
2611postmaster.rfc-ignorant.org
1896multi.surbl.org
1138webmail.rhs.mailpolice.com
1105multi.uribl.com (union of all results)
1037multi.uribl.com (result 127.0.0.2 = spam resource)
928dsn.rfc-ignorant.org
648whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
532porn.rhs.mailpolice.com
297adv.rhs.mailpolice.com
157bulk.rhs.mailpolice.com
140rddn.dnsbl.net.au (zone not intended for this use)
128dynamic.rhs.mailpolice.com
65multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
48rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
48rhsbl.sorbs.net (union of all results)
36dob.sibl.support-intelligence.net
15ex.dnsbl.org
7l1.apews.org
4bl.deadbeef.com
3multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
2fraud.rhs.mailpolice.com


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 5 September 2008.