Blacklists Compared

4 October 2008

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (127.0.0.1 result), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
158691(total number of IP addresses tested, including 484 at SDSC)
151453(union of most IP zones)
129603zen.spamhaus.org (union of all results)
114099t1.dnsbl.net.au
85096cbl.abuseat.org
85007zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
81359dnsbl-1.uceprotect.net
80571zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
79085dnsbl-3.uceprotect.net
76606psbl.surriel.com
72687dnsbl-2.uceprotect.net
71391hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
70461dnsbl.sorbs.net (union of all results)
51269dnsbl.sorbs.net (result 127.0.0.10 = dialup)
51006ubl.unsubscore.com
49078no-more-funn.moensted.dk (union of all results)
37937blackholes.five-ten-sg.com (union of all results)
36000no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
34373blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
31274db.wpbl.info
30122bl.spamcop.net
27260ix.dnsbl.manitu.net
24474zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
19009dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
10705spam.dnsbl.sorbs.net
10595no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
9603bl.spamcannibal.org
9247dnsbl.inps.de
8112mail-abuse.blacklist.jippg.org
7693tr.countries.nerd.dk
7488ips.backscatterer.org
6941countries.blackholes.us (result 127.6.4.3 = Russia)
6812countries.blackholes.us (result 127.1.5.6 = China)
6555countries.blackholes.us (result 127.0.7.6 = Brazil)
6234korea.services.net
5456countries.blackholes.us (result 127.7.9.2 = Turkey)
5014countries.blackholes.us (result 127.4.1.0 = Korea)
4670list.dnswl.org (not a blacklist!)
3551spamsources.fabel.dk
3369hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
3086hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
2956dnsbl.njabl.org (union of all results)
2608countries.blackholes.us (result 127.0.3.2 = Argentina)
2506blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
2322dnsbl.njabl.org (result 127.0.0.9 = open proxy)
2283rmst.dnsbl.net.au
2085countries.blackholes.us (result 127.7.6.4 = Thailand)
2029no-more-funn.moensted.dk (result 127.0.0.9 = misc)
1360countries.blackholes.us (result 127.3.9.2 = Japan)
1161countries.blackholes.us (result 127.4.8.4 = Mexico)
1134aspews.ext.sorbs.net
1009blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
798countries.blackholes.us (result 127.1.5.8 = Taiwan)
444dnsbl.njabl.org (result 127.0.0.4 = spam source)
357zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
342countries.blackholes.us (result 127.7.0.2 = Singapore)
310countries.blackholes.us (result 127.3.4.4 = Hong Kong)
304zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
283query.bondedsender.org (not a blacklist!)
264no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
235no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
224hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
213dnsbl.sorbs.net (result 127.0.0.6 = spam source)
198work.drbl.croco.net
189dnsbl.njabl.org (result 127.0.0.2 = open relay)
184accredit.habeas.com (not a blacklist!)
183iadb2.isipp.com (not a blacklist!)
148probes.dnsbl.net.au
147iadb.isipp.com (not a blacklist!)
128tor.dnsbl.sectoor.de (union of all results)
127tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
120countries.blackholes.us (result 127.4.5.8 = Malaysia)
116l2.bbfh.ext.sorbs.net
99bl.deadbeef.com
66dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
54dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
52multi.surbl.org
45l2.apews.org
31dnsbl-0.uceprotect.net
28exemptions.ahbl.org (not a blacklist!)
24blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
22blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
11spamguard.leadmon.net (union of all results)
8rdts.dnsbl.net.au
7countries.blackholes.us (result 127.5.6.6 = Nigeria)
7spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
6spam.wytnij.to
5dnsbl.sorbs.net (result 127.0.0.5 = open relay)
4multi.uribl.com (result 127.0.0.2 = spam resource)
4multi.uribl.com (union of all results)
3spamguard.leadmon.net (result 127.0.0.8 = open proxy)
3blackholes.brainerd.net
2no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
2blackholes.five-ten-sg.com (result 127.0.0.11 = TCPA violator)
1tor.dnsbl.sectoor.de (result 127.0.0.1 = Tor server)
1dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
1dnsbl.njabl.org (result 127.0.0.8 = open formmail.cgi)
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1blackholes.five-ten-sg.com (result 127.0.0.6 = open relay)
1dob.sibl.support-intelligence.net


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
158691(total number of IP addresses whose names were tested, including 484 at SDSC)
89246(union of all domain zones)
63842abuse.rfc-ignorant.org
55491rddn.dnsbl.net.au
35382dynamic.rhs.mailpolice.com
34069whois.rfc-ignorant.org (union of all results)
21838l1.apews.org
20852whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
13217whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
6585webmail.rhs.mailpolice.com
697adv.rhs.mailpolice.com
384dob.sibl.support-intelligence.net
335bl.deadbeef.com
193bulk.rhs.mailpolice.com
140multi.surbl.org
116multi.uribl.com (union of all results)
114multi.uribl.com (result 127.0.0.2 = spam resource)
92postmaster.rfc-ignorant.org
81bogusmx.rfc-ignorant.org
75rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
75rhsbl.sorbs.net (union of all results)
69dsn.rfc-ignorant.org (zone not intended for this use)
12porn.rhs.mailpolice.com
2multi.uribl.com (result 127.0.0.4 = opt-out spam resource)


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
126735(total number of domains tested, including 442 at SDSC)
27151(union of all domain zones)
15651whois.rfc-ignorant.org (union of all results)
15018whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
4607bogusmx.rfc-ignorant.org
4423abuse.rfc-ignorant.org
2306postmaster.rfc-ignorant.org
1132webmail.rhs.mailpolice.com
1100multi.surbl.org
886multi.uribl.com (union of all results)
872dsn.rfc-ignorant.org
826multi.uribl.com (result 127.0.0.2 = spam resource)
633whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
459porn.rhs.mailpolice.com
312adv.rhs.mailpolice.com
204dob.sibl.support-intelligence.net
136bulk.rhs.mailpolice.com
61rddn.dnsbl.net.au (zone not intended for this use)
54multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
50dynamic.rhs.mailpolice.com
45rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
45rhsbl.sorbs.net (union of all results)
16l1.apews.org
14ex.dnsbl.org
6multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
3fraud.rhs.mailpolice.com
2bl.deadbeef.com


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 9 October 2008.