Blacklists Compared

1 November 2008

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (127.0.0.1 result), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
122328(total number of IP addresses tested, including 487 at SDSC)
115368(union of most IP zones)
91987zen.spamhaus.org (union of all results)
82252t1.dnsbl.net.au
76506b.barracudacentral.org
61377cbl.abuseat.org
61275zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
57088dnsbl-3.uceprotect.net
56881zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
55468dnsbl-1.uceprotect.net
51193dnsbl-2.uceprotect.net
51054hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
46604dnsbl.sorbs.net (union of all results)
44496psbl.surriel.com
37338no-more-funn.moensted.dk (union of all results)
34154dnsbl.sorbs.net (result 127.0.0.10 = dialup)
31531blackholes.five-ten-sg.com (union of all results)
27849blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
24861no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
24569ubl.unsubscore.com
20365ix.dnsbl.manitu.net
19075bl.spamcop.net
16374zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
14344db.wpbl.info
12294dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
9727spam.dnsbl.sorbs.net
9525no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
8569ips.backscatterer.org
7693countries.blackholes.us (result 127.1.5.6 = China)
7667bl.spamcannibal.org
6809dnsbl.inps.de
5546countries.blackholes.us (result 127.6.4.3 = Russia)
5353tr.countries.nerd.dk
5143countries.blackholes.us (result 127.0.7.6 = Brazil)
4783list.dnswl.org (not a blacklist!)
3807countries.blackholes.us (result 127.7.9.2 = Turkey)
3575korea.services.net
3434spamsources.fabel.dk
3044hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
2926mail-abuse.blacklist.jippg.org
2896countries.blackholes.us (result 127.4.1.0 = Korea)
2753sbl.csma.biz
2682hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
2624bl.csma.biz
2533blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
2271rmst.dnsbl.net.au
2256no-more-funn.moensted.dk (result 127.0.0.9 = misc)
2176dnsbl.njabl.org (union of all results)
2003countries.blackholes.us (result 127.3.9.2 = Japan)
1930countries.blackholes.us (result 127.0.3.2 = Argentina)
1688dnsbl.njabl.org (result 127.0.0.9 = open proxy)
1419countries.blackholes.us (result 127.7.6.4 = Thailand)
1087blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
1008aspews.ext.sorbs.net
695countries.blackholes.us (result 127.1.5.8 = Taiwan)
566no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
560countries.blackholes.us (result 127.4.8.4 = Mexico)
412dnsbl.njabl.org (result 127.0.0.4 = spam source)
291countries.blackholes.us (result 127.3.4.4 = Hong Kong)
289query.bondedsender.org (not a blacklist!)
287zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
236countries.blackholes.us (result 127.7.0.2 = Singapore)
234hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
214zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
201accredit.habeas.com (not a blacklist!)
173no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
160dnsbl.sorbs.net (result 127.0.0.6 = spam source)
152work.drbl.croco.net
151iadb2.isipp.com (not a blacklist!)
127countries.blackholes.us (result 127.4.5.8 = Malaysia)
112iadb.isipp.com (not a blacklist!)
101tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
101tor.dnsbl.sectoor.de (union of all results)
89probes.dnsbl.net.au
76dnsbl.njabl.org (result 127.0.0.2 = open relay)
68bl.deadbeef.com
59l2.bbfh.ext.sorbs.net
44multi.surbl.org
44exemptions.ahbl.org (not a blacklist!)
42dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
41l2.apews.org
38dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
33blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
30dnsbl-0.uceprotect.net
27blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
10spamguard.leadmon.net (union of all results)
9countries.blackholes.us (result 127.5.6.6 = Nigeria)
5spam.wytnij.to
5blackholes.brainerd.net
4dnsbl.sorbs.net (result 127.0.0.5 = open relay)
4dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
4rdts.dnsbl.net.au
4spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
3spamguard.leadmon.net (result 127.0.0.3 = spam source)
3multi.uribl.com (union of all results)
2multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
2spamguard.leadmon.net (result 127.0.0.8 = open proxy)
2no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
1multi.uribl.com (result 127.0.0.2 = spam resource)
1spamguard.leadmon.net (result 127.0.0.5 = open relay)
1blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
1blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
1dob.sibl.support-intelligence.net


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
122328(total number of IP addresses whose names were tested, including 487 at SDSC)
65361(union of all domain zones)
47223abuse.rfc-ignorant.org
38345rddn.dnsbl.net.au
25863whois.rfc-ignorant.org (union of all results)
25080dynamic.rhs.mailpolice.com
16624l1.apews.org
15905whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
9959whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
4201webmail.rhs.mailpolice.com
725adv.rhs.mailpolice.com
234bl.deadbeef.com
145multi.surbl.org
97postmaster.rfc-ignorant.org
97multi.uribl.com (union of all results)
95multi.uribl.com (result 127.0.0.2 = spam resource)
81bogusmx.rfc-ignorant.org
73dsn.rfc-ignorant.org (zone not intended for this use)
57bulk.rhs.mailpolice.com
47rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
47rhsbl.sorbs.net (union of all results)
26dob.sibl.support-intelligence.net
9porn.rhs.mailpolice.com
2multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
1ex.dnsbl.org


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
98814(total number of domains tested, including 446 at SDSC)
22790(union of all domain zones)
13103whois.rfc-ignorant.org (union of all results)
12501whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
4359abuse.rfc-ignorant.org
3572bogusmx.rfc-ignorant.org
2052postmaster.rfc-ignorant.org
1060multi.surbl.org
986webmail.rhs.mailpolice.com
787multi.uribl.com (union of all results)
749dsn.rfc-ignorant.org
734multi.uribl.com (result 127.0.0.2 = spam resource)
602whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
322adv.rhs.mailpolice.com
289porn.rhs.mailpolice.com
95bulk.rhs.mailpolice.com
72rddn.dnsbl.net.au (zone not intended for this use)
54dynamic.rhs.mailpolice.com
50multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
34rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
34rhsbl.sorbs.net (union of all results)
21l1.apews.org
13ex.dnsbl.org
11dob.sibl.support-intelligence.net
5fraud.rhs.mailpolice.com
3multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
3bl.deadbeef.com


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 7 November 2008.