Blacklists Compared

18 October 2008

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (127.0.0.1 result), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
131013(total number of IP addresses tested, including 463 at SDSC)
125137(union of most IP zones)
110736zen.spamhaus.org (union of all results)
100062t1.dnsbl.net.au
79614cbl.abuseat.org
79510zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
67041zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
65805dnsbl-3.uceprotect.net
63509dnsbl-1.uceprotect.net
60156hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
59044dnsbl-2.uceprotect.net
57544dnsbl.sorbs.net (union of all results)
51674psbl.surriel.com
41248no-more-funn.moensted.dk (union of all results)
39582dnsbl.sorbs.net (result 127.0.0.10 = dialup)
39034ubl.unsubscore.com
29151blackholes.five-ten-sg.com (union of all results)
28390no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
27009ix.dnsbl.manitu.net
26012blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
23343bl.spamcop.net
20284zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
18880db.wpbl.info
17807dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
11247spam.dnsbl.sorbs.net
9896no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
8632sbl.csma.biz
8566bl.csma.biz
7915bl.spamcannibal.org
7891dnsbl.inps.de
7415countries.blackholes.us (result 127.1.5.6 = China)
7413tr.countries.nerd.dk
6631countries.blackholes.us (result 127.6.4.3 = Russia)
5594countries.blackholes.us (result 127.0.7.6 = Brazil)
5239countries.blackholes.us (result 127.7.9.2 = Turkey)
4636korea.services.net
4626ips.backscatterer.org
4246list.dnswl.org (not a blacklist!)
3786mail-abuse.blacklist.jippg.org
3765countries.blackholes.us (result 127.4.1.0 = Korea)
3411spamsources.fabel.dk
2756hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
2602dnsbl.njabl.org (union of all results)
2379no-more-funn.moensted.dk (result 127.0.0.9 = misc)
2331hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
2226blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
2083countries.blackholes.us (result 127.0.3.2 = Argentina)
2070rmst.dnsbl.net.au
2070dnsbl.njabl.org (result 127.0.0.9 = open proxy)
1557countries.blackholes.us (result 127.7.6.4 = Thailand)
1237aspews.ext.sorbs.net
1154countries.blackholes.us (result 127.4.8.4 = Mexico)
884blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
705countries.blackholes.us (result 127.3.9.2 = Japan)
536zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
512countries.blackholes.us (result 127.1.5.8 = Taiwan)
458no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
401dnsbl.njabl.org (result 127.0.0.4 = spam source)
289query.bondedsender.org (not a blacklist!)
280countries.blackholes.us (result 127.7.0.2 = Singapore)
265zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
235countries.blackholes.us (result 127.3.4.4 = Hong Kong)
170work.drbl.croco.net
167hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
167accredit.habeas.com (not a blacklist!)
165no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
157countries.blackholes.us (result 127.4.5.8 = Malaysia)
157dnsbl.sorbs.net (result 127.0.0.6 = spam source)
152iadb2.isipp.com (not a blacklist!)
131dnsbl.njabl.org (result 127.0.0.2 = open relay)
125probes.dnsbl.net.au
110iadb.isipp.com (not a blacklist!)
93tor.dnsbl.sectoor.de (union of all results)
92tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
77bl.deadbeef.com
54l2.bbfh.ext.sorbs.net
44l2.apews.org
43dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
41multi.surbl.org
39dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
16blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
14dnsbl-0.uceprotect.net
14spamguard.leadmon.net (union of all results)
12spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
12blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
9countries.blackholes.us (result 127.5.6.6 = Nigeria)
8exemptions.ahbl.org (not a blacklist!)
7dnsbl.sorbs.net (result 127.0.0.5 = open relay)
6dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
5spam.wytnij.to
5rdts.dnsbl.net.au
2no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
2multi.uribl.com (union of all results)
1multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
1multi.uribl.com (result 127.0.0.2 = spam resource)
1tor.dnsbl.sectoor.de (result 127.0.0.1 = Tor server)
1dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1spamguard.leadmon.net (result 127.0.0.8 = open proxy)
1blackholes.five-ten-sg.com (result 127.0.0.11 = TCPA violator)
1dob.sibl.support-intelligence.net
1blackholes.brainerd.net


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
131013(total number of IP addresses whose names were tested, including 463 at SDSC)
71758(union of all domain zones)
52663abuse.rfc-ignorant.org
43746rddn.dnsbl.net.au
27863dynamic.rhs.mailpolice.com
27448whois.rfc-ignorant.org (union of all results)
16946l1.apews.org
16796whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
10652whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
5275webmail.rhs.mailpolice.com
717adv.rhs.mailpolice.com
328bl.deadbeef.com
162multi.surbl.org
114multi.uribl.com (union of all results)
113multi.uribl.com (result 127.0.0.2 = spam resource)
81postmaster.rfc-ignorant.org
61bogusmx.rfc-ignorant.org
59dsn.rfc-ignorant.org (zone not intended for this use)
51rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
51rhsbl.sorbs.net (union of all results)
45bulk.rhs.mailpolice.com
5dob.sibl.support-intelligence.net
4porn.rhs.mailpolice.com
1multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
1ex.dnsbl.org


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
107112(total number of domains tested, including 417 at SDSC)
24359(union of all domain zones)
13777whois.rfc-ignorant.org (union of all results)
13163whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
4207abuse.rfc-ignorant.org
4170bogusmx.rfc-ignorant.org
2216postmaster.rfc-ignorant.org
1154webmail.rhs.mailpolice.com
1090multi.surbl.org
905multi.uribl.com (union of all results)
853multi.uribl.com (result 127.0.0.2 = spam resource)
763dsn.rfc-ignorant.org
614whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
360porn.rhs.mailpolice.com
318adv.rhs.mailpolice.com
108bulk.rhs.mailpolice.com
65rddn.dnsbl.net.au (zone not intended for this use)
47multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
44dynamic.rhs.mailpolice.com
30rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
30rhsbl.sorbs.net (union of all results)
26dob.sibl.support-intelligence.net
17l1.apews.org
15ex.dnsbl.org
5multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
2fraud.rhs.mailpolice.com
2bl.deadbeef.com


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 23 October 2008.