Blacklists Compared

26 December 2009

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (all results but 127.0.0.2, 127.0.0.3, and 127.0.0.4), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
173885(total number of IP addresses tested, including 163 at SDSC)
170832(union of most IP zones)
162985b.barracudacentral.org
160905zen.spamhaus.org (union of all results)
148062l2.apews.org
145960cbl.abuseat.org
145864zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
114649dnsbl-2.uceprotect.net
114239dnsbl-3.uceprotect.net
113749dnsbl-1.uceprotect.net
111127hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
108144psbl.surriel.com
103979dnsbl.sorbs.net (union of all results)
100877zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
92411ubl.unsubscore.com
76374dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
66963hostkarma.junkemailfilter.com (result 127.0.1.1 = MTA sends QUIT)
44933blackholes.five-ten-sg.com (union of all results)
41315blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
39276dnsbl.sorbs.net (result 127.0.0.10 = dialup)
36707bl.spameatingmonkey.net
35072bl.spamcop.net
33628bl.score.senderscore.com
32679no-more-funn.moensted.dk (union of all results)
30533db.wpbl.info
26226zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
21881no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
21492ix.dnsbl.manitu.net
15244mail-abuse.blacklist.jippg.org
13446spam.dnsbl.sorbs.net
10661hostkarma.junkemailfilter.com (result 127.0.1.2 = MTA does not send QUIT)
9640korea.services.net
9092dnsbl.inps.de
7291bl.spamcannibal.org
5643no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
4390spamsources.fabel.dk
3870list.dnswl.org (not a blacklist!)
3372no-more-funn.moensted.dk (result 127.0.0.9 = misc)
3264tr.countries.nerd.dk
2659blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
2603ips.backscatterer.org
2295hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
1862dnsbl.njabl.org (union of all results)
1793no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
1634dnsbl.njabl.org (result 127.0.0.9 = open proxy)
1508hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
1109hostkarma.junkemailfilter.com (result 127.0.0.5 = do not blacklist)
943blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
524l2.bbfh.ext.sorbs.net
451zen.spamhaus.org (union of SBL and SBLCSS results)
450accredit.habeas.com (not a blacklist!)
390zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
386aspews.ext.sorbs.net
367query.bondedsender.org (not a blacklist!)
201dnsbl.sorbs.net (result 127.0.0.6 = spam source)
145dnsbl.njabl.org (result 127.0.0.2 = open relay)
137iadb2.isipp.com (not a blacklist!)
120dnsbl.ahbl.org (union of all results)
115tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
115tor.dnsbl.sectoor.de (union of all results)
110iadb.isipp.com (not a blacklist!)
100l1.bbfh.ext.sorbs.net
96dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
83dnsbl.njabl.org (result 127.0.0.4 = spam source)
83no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
61zen.spamhaus.org (result 127.0.0.3 = Spamhaus SBLCSS)
45hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
44bl.deadbeef.com
34dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
32multi.surbl.org
28dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
24dnsbl.ahbl.org (result 127.0.0.4 = spam source)
16blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
14multi.uribl.com (result 127.0.0.2 = spam resource)
14multi.uribl.com (union of all results)
11zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
7dnsbl-0.uceprotect.net
5dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
5spamguard.leadmon.net (union of all results)
3hostkarma.junkemailfilter.com (result 127.0.2.3 = domain first seen more than 7 days ago)
2spamguard.leadmon.net (result 127.0.0.8 = open proxy)
1dnsbl.sorbs.net (result 127.0.0.5 = open relay)
1spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1spamguard.leadmon.net (result 127.0.0.9 = abused DNS server)
1no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses. The "union of most domain zones" line includes data from the hostkarma.junkemailfilter.com zone only when the results are 127.0.0.2, 127.0.0.3, or 127.0.0.4 because other results are not blacklists.

HitsDNS Zone
173885(total number of IP addresses whose names were tested, including 163 at SDSC)
106400hostkarma.junkemailfilter.com (result 127.0.2.3 = domain first seen more than 7 days ago)
95439hostkarma.junkemailfilter.com (result 127.0.1.1 = MTA sends QUIT)
88255(union of most domain zones)
75774l1.apews.org
72645abuse.rfc-ignorant.org
30590whois.rfc-ignorant.org (union of all results)
30586dynamic.rhs.mailpolice.com
22326whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
9710hostkarma.junkemailfilter.com (result 127.0.0.5 = do not blacklist)
8264whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
3753webmail.rhs.mailpolice.com
2507hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
1349hostkarma.junkemailfilter.com (result 127.0.1.4 = no verify host)
760adv.rhs.mailpolice.com
371hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
329urired.spameatingmonkey.net
262hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
240bl.deadbeef.com
160hostkarma.junkemailfilter.com (result 127.0.1.2 = MTA does not send QUIT)
63hostkarma.junkemailfilter.com (result 127.0.2.2 = domain first seen in last 7 days)
61rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
61rhsbl.sorbs.net (union of all results)
42postmaster.rfc-ignorant.org
42rhsbl.ahbl.org
37bulk.rhs.mailpolice.com
25dsn.rfc-ignorant.org (zone not intended for this use)
24bogusmx.rfc-ignorant.org
22multi.surbl.org
20multi.uribl.com (result 127.0.0.2 = spam resource)
20multi.uribl.com (union of all results)
14porn.rhs.mailpolice.com
12dob.sibl.support-intelligence.net
11fresh.spameatingmonkey.net
2hostkarma.junkemailfilter.com (result 127.0.2.1 = domain first seen today)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains. The "union of most domain zones" line includes data from the hostkarma.junkemailfilter.com zone only when the results are 127.0.0.2, 127.0.0.3, or 127.0.0.4 because other results are not blacklists.

HitsDNS Zone
54584(total number of domains tested, including 156 at SDSC)
51672hostkarma.junkemailfilter.com (result 127.0.2.3 = domain first seen more than 7 days ago)
12122(union of most domain zones)
5943hostkarma.junkemailfilter.com (result 127.0.1.1 = MTA sends QUIT)
4052hostkarma.junkemailfilter.com (result 127.0.0.5 = do not blacklist)
3781whois.rfc-ignorant.org (union of all results)
3467whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
3155abuse.rfc-ignorant.org
3098urired.spameatingmonkey.net
2100hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
1830postmaster.rfc-ignorant.org
1449l1.apews.org
1086bogusmx.rfc-ignorant.org
1079hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
772multi.surbl.org
736webmail.rhs.mailpolice.com
659multi.uribl.com (union of all results)
647multi.uribl.com (result 127.0.0.2 = spam resource)
469hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
442dsn.rfc-ignorant.org
314whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
262adv.rhs.mailpolice.com
160porn.rhs.mailpolice.com
84hostkarma.junkemailfilter.com (result 127.0.2.2 = domain first seen in last 7 days)
72dynamic.rhs.mailpolice.com
62bulk.rhs.mailpolice.com
33hostkarma.junkemailfilter.com (result 127.0.1.2 = MTA does not send QUIT)
28rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
28rhsbl.sorbs.net (union of all results)
26hostkarma.junkemailfilter.com (result 127.0.1.4 = no verify host)
16rhsbl.ahbl.org
15ex.dnsbl.org
11hostkarma.junkemailfilter.com (result 127.0.2.1 = domain first seen today)
10multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
8fresh.spameatingmonkey.net
4dob.sibl.support-intelligence.net
3fraud.rhs.mailpolice.com
2multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
2hostkarma.junkemailfilter.com (result 127.0.1.3 = MTA somtimes sends QUIT)
1bl.deadbeef.com

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 31 December 2009.