Blacklists Compared

13 December 2008

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (127.0.0.1 result), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
67693(total number of IP addresses tested, including 470 at SDSC)
62026(union of most IP zones)
48942l2.apews.org
47934zen.spamhaus.org (union of all results)
41356t1.dnsbl.net.au
36810b.barracudacentral.org
35021cbl.abuseat.org
34967zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
31378zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
25311dnsbl-1.uceprotect.net
24368dnsbl-3.uceprotect.net
23278dnsbl-2.uceprotect.net
22269hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
20309blackholes.five-ten-sg.com (union of all results)
19459no-more-funn.moensted.dk (union of all results)
19001psbl.surriel.com
18927dnsbl.sorbs.net (union of all results)
16595ubl.unsubscore.com
16519blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
14723dnsbl.sorbs.net (result 127.0.0.10 = dialup)
10313no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
8223no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
7952bl.spamcop.net
7837countries.blackholes.us (result 127.1.5.6 = China)
6906spam.dnsbl.sorbs.net
6702zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
6614ix.dnsbl.manitu.net
5038db.wpbl.info
4721list.dnswl.org (not a blacklist!)
4162dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
3994bl.spamcannibal.org
3274ips.backscatterer.org
2841hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
2813spamsources.fabel.dk
2568blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
2536dnsbl.inps.de
2511countries.blackholes.us (result 127.0.7.6 = Brazil)
2208hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
2194korea.services.net
2045countries.blackholes.us (result 127.6.4.3 = Russia)
2036tr.countries.nerd.dk
1724countries.blackholes.us (result 127.4.1.0 = Korea)
1355countries.blackholes.us (result 127.7.9.2 = Turkey)
1323rmst.dnsbl.net.au
1293dnsbl.njabl.org (union of all results)
1269mail-abuse.blacklist.jippg.org
1174blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
1001countries.blackholes.us (result 127.3.9.2 = Japan)
990dnsbl.njabl.org (result 127.0.0.9 = open proxy)
878countries.blackholes.us (result 127.7.6.4 = Thailand)
867aspews.ext.sorbs.net
665countries.blackholes.us (result 127.0.3.2 = Argentina)
648no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
603zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
507countries.blackholes.us (result 127.1.5.8 = Taiwan)
320query.bondedsender.org (not a blacklist!)
302hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
296countries.blackholes.us (result 127.4.8.4 = Mexico)
257dnsbl.njabl.org (result 127.0.0.4 = spam source)
210no-more-funn.moensted.dk (result 127.0.0.9 = misc)
198accredit.habeas.com (not a blacklist!)
171iadb2.isipp.com (not a blacklist!)
154countries.blackholes.us (result 127.3.4.4 = Hong Kong)
131zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
128iadb.isipp.com (not a blacklist!)
97no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
96countries.blackholes.us (result 127.7.0.2 = Singapore)
96dnsbl.sorbs.net (result 127.0.0.6 = spam source)
92work.drbl.croco.net
84countries.blackholes.us (result 127.4.5.8 = Malaysia)
68dnsbl.ahbl.org (union of all results)
57bl.deadbeef.com
54l2.bbfh.ext.sorbs.net
46dnsbl.njabl.org (result 127.0.0.2 = open relay)
46tor.dnsbl.sectoor.de (union of all results)
45tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
43probes.dnsbl.net.au
40dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
32blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
28dnsbl.ahbl.org (result 127.0.0.4 = spam source)
25multi.surbl.org
18dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
17dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
14blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
7dnsbl-0.uceprotect.net
5multi.uribl.com (result 127.0.0.2 = spam resource)
5multi.uribl.com (union of all results)
5spamguard.leadmon.net (union of all results)
4countries.blackholes.us (result 127.5.6.6 = Nigeria)
3dnsbl.sorbs.net (result 127.0.0.5 = open relay)
3spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
2spam.wytnij.to
2dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
2blackholes.brainerd.net
1tor.dnsbl.sectoor.de (result 127.0.0.1 = Tor server)
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1spamguard.leadmon.net (result 127.0.0.8 = open proxy)
1no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
1blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
1blackholes.five-ten-sg.com (result 127.0.0.11 = TCPA violator)
1dob.sibl.support-intelligence.net


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
67693(total number of IP addresses whose names were tested, including 470 at SDSC)
32432(union of all domain zones)
23426l1.apews.org
22789abuse.rfc-ignorant.org
16580rddn.dnsbl.net.au
13030whois.rfc-ignorant.org (union of all results)
11464dynamic.rhs.mailpolice.com
8696whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
4334whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
2048webmail.rhs.mailpolice.com
809adv.rhs.mailpolice.com
330rhsbl.ahbl.org
159multi.surbl.org
105multi.uribl.com (result 127.0.0.2 = spam resource)
105multi.uribl.com (union of all results)
67postmaster.rfc-ignorant.org
62bogusmx.rfc-ignorant.org
56dsn.rfc-ignorant.org (zone not intended for this use)
51bulk.rhs.mailpolice.com
19rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
19rhsbl.sorbs.net (union of all results)
6dob.sibl.support-intelligence.net
4porn.rhs.mailpolice.com
3bl.deadbeef.com


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
41697(total number of domains tested, including 438 at SDSC)
10757(union of all domain zones)
4386whois.rfc-ignorant.org (union of all results)
3957whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
2111abuse.rfc-ignorant.org
1822bogusmx.rfc-ignorant.org
1364multi.surbl.org
1214postmaster.rfc-ignorant.org
1098l1.apews.org
1007multi.uribl.com (union of all results)
968multi.uribl.com (result 127.0.0.2 = spam resource)
663webmail.rhs.mailpolice.com
429whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
419dsn.rfc-ignorant.org
300adv.rhs.mailpolice.com
128porn.rhs.mailpolice.com
120rhsbl.ahbl.org
99bulk.rhs.mailpolice.com
37multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
32rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
32rhsbl.sorbs.net (union of all results)
17ex.dnsbl.org
15rddn.dnsbl.net.au (zone not intended for this use)
9dob.sibl.support-intelligence.net
6dynamic.rhs.mailpolice.com
2multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
2fraud.rhs.mailpolice.com
2bl.deadbeef.com


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 19 December 2008.