Blacklists Compared

6 September 2008

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (127.0.0.1 result), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
167145(total number of IP addresses tested, including 486 at SDSC)
161573(union of most IP zones)
143714zen.spamhaus.org (union of all results)
128888t1.dnsbl.net.au
99175cbl.abuseat.org
99029zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
88926zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
87452psbl.surriel.com
80654dnsbl-1.uceprotect.net
80532dnsbl-3.uceprotect.net
78343dnsbl.sorbs.net (union of all results)
76588dnsbl-2.uceprotect.net
72825hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
53757no-more-funn.moensted.dk (union of all results)
50856dnsbl.sorbs.net (result 127.0.0.10 = dialup)
44790ubl.unsubscore.com
44293blackholes.five-ten-sg.com (union of all results)
40399blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
37092db.wpbl.info
36861no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
33802bl.spamcop.net
32317ix.dnsbl.manitu.net
27322dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
24181zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
15119no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
12176spam.dnsbl.sorbs.net
10574countries.blackholes.us (result 127.1.5.6 = China)
10300dnsbl.inps.de
9508bl.spamcannibal.org
9450tr.countries.nerd.dk
8997mail-abuse.blacklist.jippg.org
8868hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
8157korea.services.net
7769countries.blackholes.us (result 127.6.4.3 = Russia)
6868countries.blackholes.us (result 127.7.9.2 = Turkey)
6714countries.blackholes.us (result 127.4.1.0 = Korea)
6678countries.blackholes.us (result 127.0.7.6 = Brazil)
4864spamsources.fabel.dk
4010ips.backscatterer.org
3819dnsbl.njabl.org (union of all results)
3815list.dnswl.org (not a blacklist!)
3477sbl.csma.biz
3219countries.blackholes.us (result 127.7.6.4 = Thailand)
3208bl.csma.biz
3049countries.blackholes.us (result 127.0.3.2 = Argentina)
2933blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
2924dnsbl.njabl.org (result 127.0.0.9 = open proxy)
2916rmst.dnsbl.net.au
2491hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
1740aspews.ext.sorbs.net
1378no-more-funn.moensted.dk (result 127.0.0.9 = misc)
1330countries.blackholes.us (result 127.4.8.4 = Mexico)
946countries.blackholes.us (result 127.3.9.2 = Japan)
926blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
798countries.blackholes.us (result 127.1.5.8 = Taiwan)
738dnsbl.njabl.org (result 127.0.0.4 = spam source)
658zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
498countries.blackholes.us (result 127.7.0.2 = Singapore)
392zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
334countries.blackholes.us (result 127.3.4.4 = Hong Kong)
260query.bondedsender.org (not a blacklist!)
254no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
237dnsbl.sorbs.net (result 127.0.0.6 = spam source)
216work.drbl.croco.net
192accredit.habeas.com (not a blacklist!)
188no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
177probes.dnsbl.net.au
171iadb2.isipp.com (not a blacklist!)
170countries.blackholes.us (result 127.4.5.8 = Malaysia)
157dnsbl.njabl.org (result 127.0.0.2 = open relay)
139iadb.isipp.com (not a blacklist!)
137bl.deadbeef.com
111tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
111tor.dnsbl.sectoor.de (union of all results)
109hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
76dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
72multi.surbl.org
63l2.apews.org
52dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
24exemptions.ahbl.org (not a blacklist!)
23countries.blackholes.us (result 127.5.6.6 = Nigeria)
20blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
15spam.wytnij.to
15blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
10spamguard.leadmon.net (union of all results)
9rdts.dnsbl.net.au
7spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
6dnsbl.sorbs.net (result 127.0.0.5 = open relay)
2dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
2spamguard.leadmon.net (result 127.0.0.8 = open proxy)
2blackholes.brainerd.net
1multi.uribl.com (result 127.0.0.2 = spam resource)
1dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
1dob.sibl.support-intelligence.net
1multi.uribl.com (union of all results)


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
167145(total number of IP addresses whose names were tested, including 486 at SDSC)
89264(union of all domain zones)
64669abuse.rfc-ignorant.org
53866rddn.dnsbl.net.au
35532whois.rfc-ignorant.org (union of all results)
34476dynamic.rhs.mailpolice.com
23835whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
19095l1.apews.org
11697whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
6296webmail.rhs.mailpolice.com
567adv.rhs.mailpolice.com
361multi.surbl.org
259bl.deadbeef.com
233multi.uribl.com (result 127.0.0.2 = spam resource)
233multi.uribl.com (union of all results)
174bulk.rhs.mailpolice.com
75rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
75rhsbl.sorbs.net (union of all results)
73postmaster.rfc-ignorant.org
59dsn.rfc-ignorant.org (zone not intended for this use)
58bogusmx.rfc-ignorant.org
51dob.sibl.support-intelligence.net
2porn.rhs.mailpolice.com
1fraud.rhs.mailpolice.com
1ex.dnsbl.org


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
140017(total number of domains tested, including 436 at SDSC)
28016(union of all domain zones)
14736whois.rfc-ignorant.org (union of all results)
14069whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
5542bogusmx.rfc-ignorant.org
4313abuse.rfc-ignorant.org
2739postmaster.rfc-ignorant.org
1561multi.surbl.org
1228dob.sibl.support-intelligence.net
1185webmail.rhs.mailpolice.com
1046multi.uribl.com (union of all results)
993multi.uribl.com (result 127.0.0.2 = spam resource)
918dsn.rfc-ignorant.org
667whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
472porn.rhs.mailpolice.com
284adv.rhs.mailpolice.com
129bulk.rhs.mailpolice.com
66rddn.dnsbl.net.au (zone not intended for this use)
56dynamic.rhs.mailpolice.com
51multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
41rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
41rhsbl.sorbs.net (union of all results)
14ex.dnsbl.org
10l1.apews.org
3fraud.rhs.mailpolice.com
2multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
2bl.deadbeef.com


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 11 September 2008.