Blacklists Compared

20 June 2009

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (all results but 127.0.0.2, 127.0.0.3, and 127.0.0.4), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
165154(total number of IP addresses tested, including 199 at SDSC)
161531(union of most IP zones)
146940zen.spamhaus.org (union of all results)
140782l2.apews.org
116439b.barracudacentral.org
111130cbl.abuseat.org
111070zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
105870dnsbl.sorbs.net (union of all results)
103175hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
102245dnsbl-2.uceprotect.net
101052dnsbl-3.uceprotect.net
93698dnsbl-1.uceprotect.net
87778zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
79811dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
79784psbl.surriel.com
66892t1.dnsbl.net.au
57297ubl.unsubscore.com
51193hostkarma.junkemailfilter.com (result 127.0.1.1 = MTA sends QUIT)
46472blackholes.five-ten-sg.com (union of all results)
43762no-more-funn.moensted.dk (union of all results)
42372blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
41442dnsbl.sorbs.net (result 127.0.0.10 = dialup)
37975bl.spamcop.net
30922ix.dnsbl.manitu.net
29531no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
27745zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
26054db.wpbl.info
16144mail-abuse.blacklist.jippg.org
14587spam.dnsbl.sorbs.net
12798no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
12096korea.services.net
10577dnsbl.inps.de
9306tr.countries.nerd.dk
8840bl.spamcannibal.org
8747hostkarma.junkemailfilter.com (result 127.0.1.2 = MTA does not send QUIT)
4519ips.backscatterer.org
3877list.dnswl.org (not a blacklist!)
3839spamsources.fabel.dk
3344hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
2860blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
2386dnsbl.njabl.org (union of all results)
2070dnsbl.njabl.org (result 127.0.0.9 = open proxy)
1866hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
1734rmst.dnsbl.net.au
1429hostkarma.junkemailfilter.com (result 127.0.0.5 = do not blacklist)
1218blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
1066hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
808no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
626aspews.ext.sorbs.net
555l2.bbfh.ext.sorbs.net
546no-more-funn.moensted.dk (result 127.0.0.9 = misc)
378query.bondedsender.org (not a blacklist!)
355dnsbl.sorbs.net (result 127.0.0.6 = spam source)
251l1.bbfh.ext.sorbs.net
216accredit.habeas.com (not a blacklist!)
194zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
189dnsbl.njabl.org (result 127.0.0.4 = spam source)
166iadb2.isipp.com (not a blacklist!)
133tor.dnsbl.sectoor.de (union of all results)
131tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
127dnsbl.njabl.org (result 127.0.0.2 = open relay)
127iadb.isipp.com (not a blacklist!)
122no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
74probes.dnsbl.net.au
73bl.deadbeef.com
72spamguard.leadmon.net (union of all results)
70dnsbl.ahbl.org (union of all results)
69spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
59dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
47zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
41dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
40dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
21blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
10dnsbl.ahbl.org (result 127.0.0.4 = spam source)
9multi.surbl.org
8rdts.dnsbl.net.au
6hostkarma.junkemailfilter.com (result 127.0.2.3 = domain first seen more than 7 days ago)
6blackholes.brainerd.net
5multi.uribl.com (result 127.0.0.2 = spam resource)
5multi.uribl.com (union of all results)
4dnsbl-0.uceprotect.net
2tor.dnsbl.sectoor.de (result 127.0.0.1 = Tor server)
2dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
2dnsbl.sorbs.net (result 127.0.0.5 = open relay)
2spamguard.leadmon.net (result 127.0.0.8 = open proxy)
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
1dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses. The "union of most domain zones" line includes data from the hostkarma.junkemailfilter.com zone only when the results are 127.0.0.2, 127.0.0.3, or 127.0.0.4 because other results are not blacklists.

HitsDNS Zone
165154(total number of IP addresses whose names were tested, including 199 at SDSC)
100754hostkarma.junkemailfilter.com (result 127.0.2.3 = domain first seen more than 7 days ago)
92192hostkarma.junkemailfilter.com (result 127.0.1.1 = MTA sends QUIT)
84640(union of most domain zones)
72682l1.apews.org
64554abuse.rfc-ignorant.org
48893rddn.dnsbl.net.au
27377whois.rfc-ignorant.org (union of all results)
22316dynamic.rhs.mailpolice.com
15598whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
11779whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
8296hostkarma.junkemailfilter.com (result 127.0.0.5 = do not blacklist)
3629hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
3292webmail.rhs.mailpolice.com
922hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
726adv.rhs.mailpolice.com
514rhsbl.ahbl.org
332hostkarma.junkemailfilter.com (result 127.0.2.2 = domain first seen in last 7 days)
300hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
166hostkarma.junkemailfilter.com (result 127.0.1.2 = MTA does not send QUIT)
65rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
65rhsbl.sorbs.net (union of all results)
62postmaster.rfc-ignorant.org
62multi.uribl.com (union of all results)
61multi.uribl.com (result 127.0.0.2 = spam resource)
47multi.surbl.org
44dsn.rfc-ignorant.org (zone not intended for this use)
41bogusmx.rfc-ignorant.org
35hostkarma.junkemailfilter.com (result 127.0.2.1 = domain first seen today)
28bulk.rhs.mailpolice.com
23dob.sibl.support-intelligence.net
17bl.deadbeef.com
3porn.rhs.mailpolice.com
1multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains. The "union of most domain zones" line includes data from the hostkarma.junkemailfilter.com zone only when the results are 127.0.0.2, 127.0.0.3, or 127.0.0.4 because other results are not blacklists.

HitsDNS Zone
45068(total number of domains tested, including 176 at SDSC)
35559hostkarma.junkemailfilter.com (result 127.0.2.3 = domain first seen more than 7 days ago)
12789(union of most domain zones)
6927hostkarma.junkemailfilter.com (result 127.0.1.1 = MTA sends QUIT)
5855whois.rfc-ignorant.org (union of all results)
5116whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
4418hostkarma.junkemailfilter.com (result 127.0.0.5 = do not blacklist)
3526abuse.rfc-ignorant.org
2535hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
2066l1.apews.org
1830hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
1324bogusmx.rfc-ignorant.org
1199postmaster.rfc-ignorant.org
1147multi.surbl.org
1013multi.uribl.com (union of all results)
992multi.uribl.com (result 127.0.0.2 = spam resource)
961hostkarma.junkemailfilter.com (result 127.0.2.2 = domain first seen in last 7 days)
943webmail.rhs.mailpolice.com
739whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
682hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
544rddn.dnsbl.net.au (zone not intended for this use)
387dsn.rfc-ignorant.org
293adv.rhs.mailpolice.com
162porn.rhs.mailpolice.com
147dynamic.rhs.mailpolice.com
128bulk.rhs.mailpolice.com
104rhsbl.ahbl.org
65hostkarma.junkemailfilter.com (result 127.0.1.2 = MTA does not send QUIT)
29hostkarma.junkemailfilter.com (result 127.0.2.1 = domain first seen today)
22rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
22rhsbl.sorbs.net (union of all results)
20multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
15dob.sibl.support-intelligence.net
11ex.dnsbl.org
1multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
1fraud.rhs.mailpolice.com
1bl.deadbeef.com

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 25 June 2009.