Blacklists Compared

21 February 2009

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (127.0.0.1 result), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
63876(total number of IP addresses tested, including 193 at SDSC)
60305(union of most IP zones)
49975zen.spamhaus.org (union of all results)
47711l2.apews.org
45269t1.dnsbl.net.au
41489b.barracudacentral.org
40060cbl.abuseat.org
39988zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
30766zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
27433ubl.unsubscore.com
26101dnsbl-1.uceprotect.net
25241hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
24907dnsbl-3.uceprotect.net
21847dnsbl-2.uceprotect.net
21813dnsbl.sorbs.net (union of all results)
19420blackholes.five-ten-sg.com (union of all results)
16775no-more-funn.moensted.dk (union of all results)
16061blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
14709dnsbl.sorbs.net (result 127.0.0.10 = dialup)
10426no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
9597bl.spamcop.net
9271db.wpbl.info
8263zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
7211dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
6814spam.dnsbl.sorbs.net
6444ix.dnsbl.manitu.net
5446no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
4550countries.blackholes.us (result 127.1.5.6 = China)
3822bl.spamcannibal.org
3770dnsbl.inps.de
3753list.dnswl.org (not a blacklist!)
2965spamsources.fabel.dk
2697tr.countries.nerd.dk
2689hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
2543psbl.surriel.com
2526countries.blackholes.us (result 127.0.7.6 = Brazil)
2169korea.services.net
2129blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
1876ips.backscatterer.org
1844countries.blackholes.us (result 127.7.9.2 = Turkey)
1786hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
1749countries.blackholes.us (result 127.6.4.3 = Russia)
1577mail-abuse.blacklist.jippg.org
1572countries.blackholes.us (result 127.4.1.0 = Korea)
1273countries.blackholes.us (result 127.7.6.4 = Thailand)
1206dnsbl.njabl.org (union of all results)
1191blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
930dnsbl.njabl.org (result 127.0.0.9 = open proxy)
772rmst.dnsbl.net.au
708countries.blackholes.us (result 127.0.3.2 = Argentina)
698no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
537aspews.ext.sorbs.net
475countries.blackholes.us (result 127.1.5.8 = Taiwan)
386countries.blackholes.us (result 127.4.8.4 = Mexico)
358query.bondedsender.org (not a blacklist!)
341countries.blackholes.us (result 127.3.9.2 = Japan)
331zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
249dnsbl.njabl.org (result 127.0.0.4 = spam source)
205countries.blackholes.us (result 127.3.4.4 = Hong Kong)
204hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
203accredit.habeas.com (not a blacklist!)
173no-more-funn.moensted.dk (result 127.0.0.9 = misc)
170iadb2.isipp.com (not a blacklist!)
131iadb.isipp.com (not a blacklist!)
124dnsbl.ahbl.org (union of all results)
121dnsbl.sorbs.net (result 127.0.0.6 = spam source)
99countries.blackholes.us (result 127.7.0.2 = Singapore)
83dnsbl.ahbl.org (result 127.0.0.4 = spam source)
80countries.blackholes.us (result 127.4.5.8 = Malaysia)
74zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
71no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
53tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
53bl.deadbeef.com
53tor.dnsbl.sectoor.de (union of all results)
48l2.bbfh.ext.sorbs.net
44ricn.dnsbl.net.au
44probes.dnsbl.net.au
41dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
27dnsbl.njabl.org (result 127.0.0.2 = open relay)
24dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
24dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
20blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
18blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
11dnsbl-0.uceprotect.net
8multi.surbl.org
5dnsbl.sorbs.net (result 127.0.0.5 = open relay)
4countries.blackholes.us (result 127.5.6.6 = Nigeria)
4spamguard.leadmon.net (union of all results)
3dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
2multi.uribl.com (result 127.0.0.2 = spam resource)
2rdts.dnsbl.net.au
2spamguard.leadmon.net (result 127.0.0.3 = spam source)
2spamguard.leadmon.net (result 127.0.0.8 = open proxy)
2multi.uribl.com (union of all results)
1blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
1dob.sibl.support-intelligence.net
1blackholes.brainerd.net


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
63876(total number of IP addresses whose names were tested, including 193 at SDSC)
32881(union of all domain zones)
24695l1.apews.org
22523abuse.rfc-ignorant.org
16696rddn.dnsbl.net.au
11546whois.rfc-ignorant.org (union of all results)
10969dynamic.rhs.mailpolice.com
6913whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
4633whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
2304webmail.rhs.mailpolice.com
674adv.rhs.mailpolice.com
445rhsbl.ahbl.org
165multi.surbl.org
129multi.uribl.com (result 127.0.0.2 = spam resource)
129multi.uribl.com (union of all results)
61postmaster.rfc-ignorant.org
46bogusmx.rfc-ignorant.org
45dsn.rfc-ignorant.org (zone not intended for this use)
35dob.sibl.support-intelligence.net
22bulk.rhs.mailpolice.com
14rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
14rhsbl.sorbs.net (union of all results)
12bl.deadbeef.com
4porn.rhs.mailpolice.com


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
41888(total number of domains tested, including 157 at SDSC)
12734(union of all domain zones)
6470whois.rfc-ignorant.org (union of all results)
6028whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
2182bogusmx.rfc-ignorant.org
2138abuse.rfc-ignorant.org
1659postmaster.rfc-ignorant.org
1064multi.surbl.org
1061l1.apews.org
936multi.uribl.com (union of all results)
908multi.uribl.com (result 127.0.0.2 = spam resource)
671webmail.rhs.mailpolice.com
442whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
390dsn.rfc-ignorant.org
254adv.rhs.mailpolice.com
134rhsbl.ahbl.org
126porn.rhs.mailpolice.com
75bulk.rhs.mailpolice.com
55dob.sibl.support-intelligence.net
33rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
33rhsbl.sorbs.net (union of all results)
30rddn.dnsbl.net.au (zone not intended for this use)
27multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
14dynamic.rhs.mailpolice.com
12ex.dnsbl.org
2fraud.rhs.mailpolice.com
1multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
1bl.deadbeef.com


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 27 February 2009.