Blacklists Compared

27 December 2008

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (127.0.0.1 result), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
71926(total number of IP addresses tested, including 192 at SDSC)
68620(union of most IP zones)
58525zen.spamhaus.org (union of all results)
57508l2.apews.org
48497t1.dnsbl.net.au
47954b.barracudacentral.org
39140cbl.abuseat.org
39093zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
38563zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
33309dnsbl-3.uceprotect.net
32299dnsbl-1.uceprotect.net
31667dnsbl-2.uceprotect.net
28097psbl.surriel.com
26807ubl.unsubscore.com
25242dnsbl.sorbs.net (union of all results)
22785blackholes.five-ten-sg.com (union of all results)
22122no-more-funn.moensted.dk (union of all results)
19880blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
19108hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
17398dnsbl.sorbs.net (result 127.0.0.10 = dialup)
11951no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
11919db.wpbl.info
10187bl.spamcop.net
8983zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
8820no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
8414countries.blackholes.us (result 127.1.5.6 = China)
7782dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
7365ix.dnsbl.manitu.net
6685spam.dnsbl.sorbs.net
3986bl.spamcannibal.org
3480tr.countries.nerd.dk
3286spamsources.fabel.dk
3189countries.blackholes.us (result 127.0.7.6 = Brazil)
3112list.dnswl.org (not a blacklist!)
2886dnsbl.inps.de
2665korea.services.net
2487countries.blackholes.us (result 127.6.4.3 = Russia)
2362countries.blackholes.us (result 127.7.9.2 = Turkey)
2105hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
2027countries.blackholes.us (result 127.4.1.0 = Korea)
1931blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
1859mail-abuse.blacklist.jippg.org
1643hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
1501dnsbl.njabl.org (union of all results)
1387countries.blackholes.us (result 127.7.6.4 = Thailand)
1294dnsbl.njabl.org (result 127.0.0.9 = open proxy)
1141no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
992ips.backscatterer.org
975rmst.dnsbl.net.au
942blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
938countries.blackholes.us (result 127.0.3.2 = Argentina)
731aspews.ext.sorbs.net
393countries.blackholes.us (result 127.1.5.8 = Taiwan)
389zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
345countries.blackholes.us (result 127.3.9.2 = Japan)
299query.bondedsender.org (not a blacklist!)
265countries.blackholes.us (result 127.4.8.4 = Mexico)
198hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
186accredit.habeas.com (not a blacklist!)
180dnsbl.njabl.org (result 127.0.0.4 = spam source)
176no-more-funn.moensted.dk (result 127.0.0.9 = misc)
153iadb2.isipp.com (not a blacklist!)
141zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
134countries.blackholes.us (result 127.7.0.2 = Singapore)
121countries.blackholes.us (result 127.3.4.4 = Hong Kong)
121iadb.isipp.com (not a blacklist!)
115dnsbl.sorbs.net (result 127.0.0.6 = spam source)
89work.drbl.croco.net
82countries.blackholes.us (result 127.4.5.8 = Malaysia)
63l2.bbfh.ext.sorbs.net
58no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
58tor.dnsbl.sectoor.de (union of all results)
57tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
54probes.dnsbl.net.au
50dnsbl.ahbl.org (union of all results)
45bl.deadbeef.com
34dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
28spamguard.leadmon.net (union of all results)
27dnsbl.njabl.org (result 127.0.0.2 = open relay)
26dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
26dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
24spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
21blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
16dnsbl.ahbl.org (result 127.0.0.4 = spam source)
15dnsbl-0.uceprotect.net
11blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
6dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
5countries.blackholes.us (result 127.5.6.6 = Nigeria)
4multi.surbl.org
3spam.wytnij.to
3dnsbl.sorbs.net (result 127.0.0.5 = open relay)
2multi.uribl.com (result 127.0.0.2 = spam resource)
2spamguard.leadmon.net (result 127.0.0.3 = spam source)
2spamguard.leadmon.net (result 127.0.0.8 = open proxy)
2blackholes.brainerd.net
2multi.uribl.com (union of all results)
1tor.dnsbl.sectoor.de (result 127.0.0.1 = Tor server)
1rdts.dnsbl.net.au
1no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
1dob.sibl.support-intelligence.net


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
71926(total number of IP addresses whose names were tested, including 192 at SDSC)
35753(union of all domain zones)
27462l1.apews.org
25352abuse.rfc-ignorant.org
19588rddn.dnsbl.net.au
14022whois.rfc-ignorant.org (union of all results)
13441dynamic.rhs.mailpolice.com
9354whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
4668whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
2259webmail.rhs.mailpolice.com
617adv.rhs.mailpolice.com
256rhsbl.ahbl.org
171multi.surbl.org
149multi.uribl.com (result 127.0.0.2 = spam resource)
149multi.uribl.com (union of all results)
46postmaster.rfc-ignorant.org
43bogusmx.rfc-ignorant.org
41dsn.rfc-ignorant.org (zone not intended for this use)
41bulk.rhs.mailpolice.com
29rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
29rhsbl.sorbs.net (union of all results)
10bl.deadbeef.com
3porn.rhs.mailpolice.com


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
31944(total number of domains tested, including 182 at SDSC)
9272(union of all domain zones)
3839whois.rfc-ignorant.org (union of all results)
3505whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
1853abuse.rfc-ignorant.org
1520bogusmx.rfc-ignorant.org
1142postmaster.rfc-ignorant.org
1004l1.apews.org
995multi.surbl.org
832multi.uribl.com (union of all results)
810multi.uribl.com (result 127.0.0.2 = spam resource)
690webmail.rhs.mailpolice.com
395dsn.rfc-ignorant.org
334whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
242adv.rhs.mailpolice.com
118bulk.rhs.mailpolice.com
104rhsbl.ahbl.org
99porn.rhs.mailpolice.com
29rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
29rhsbl.sorbs.net (union of all results)
21multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
21dob.sibl.support-intelligence.net
17rddn.dnsbl.net.au (zone not intended for this use)
11ex.dnsbl.org
6dynamic.rhs.mailpolice.com
4fraud.rhs.mailpolice.com
1multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 2 January 2009.