Blacklists Compared

9 January 2010

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (all results but 127.0.0.2, 127.0.0.3, and 127.0.0.4), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
198369(total number of IP addresses tested, including 195 at SDSC)
194906(union of most IP zones)
182709zen.spamhaus.org (union of all results)
167294l2.apews.org
159489b.barracudacentral.org
149939cbl.abuseat.org
149876zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
138813dnsbl-1.uceprotect.net
129771hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
129668dnsbl-2.uceprotect.net
129269dnsbl-3.uceprotect.net
124094psbl.surriel.com
120353dnsbl.sorbs.net (union of all results)
109727zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
104292ubl.unsubscore.com
84807hostkarma.junkemailfilter.com (result 127.0.1.1 = MTA sends QUIT)
84114dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
54627bl.spameatingmonkey.net
51013blackholes.five-ten-sg.com (union of all results)
50314dnsbl.sorbs.net (result 127.0.0.10 = dialup)
47417blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
45519no-more-funn.moensted.dk (union of all results)
40742bl.spamcop.net
33594zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
31838bl.score.senderscore.com
30237no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
29330db.wpbl.info
25084ix.dnsbl.manitu.net
18893mail-abuse.blacklist.jippg.org
13963spam.dnsbl.sorbs.net
11478hostkarma.junkemailfilter.com (result 127.0.1.2 = MTA does not send QUIT)
10836korea.services.net
9839no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
9475dnsbl.inps.de
6946bl.spamcannibal.org
4511spamsources.fabel.dk
4348list.dnswl.org (not a blacklist!)
3531no-more-funn.moensted.dk (result 127.0.0.9 = misc)
2786hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
2772tr.countries.nerd.dk
2589blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
2515ips.backscatterer.org
2079dnsbl.njabl.org (union of all results)
1869no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
1831dnsbl.njabl.org (result 127.0.0.9 = open proxy)
1740hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
1309hostkarma.junkemailfilter.com (result 127.0.0.5 = do not blacklist)
994blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
488zen.spamhaus.org (union of SBL and SBLCSS results)
467accredit.habeas.com (not a blacklist!)
443l2.bbfh.ext.sorbs.net
425aspews.ext.sorbs.net
391zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
369query.bondedsender.org (not a blacklist!)
225dnsbl.sorbs.net (result 127.0.0.6 = spam source)
218l1.bbfh.ext.sorbs.net
158dnsbl.njabl.org (result 127.0.0.2 = open relay)
156dnsbl.ahbl.org (union of all results)
139no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
135tor.dnsbl.sectoor.de (union of all results)
134tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
122iadb2.isipp.com (not a blacklist!)
104dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
97zen.spamhaus.org (result 127.0.0.3 = Spamhaus SBLCSS)
90dnsbl.njabl.org (result 127.0.0.4 = spam source)
83iadb.isipp.com (not a blacklist!)
79hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
52bl.deadbeef.com
52dnsbl.ahbl.org (result 127.0.0.4 = spam source)
37dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
36dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
19multi.surbl.org
16zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
15multi.uribl.com (union of all results)
14dnsbl-0.uceprotect.net
12multi.uribl.com (result 127.0.0.2 = spam resource)
12blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
5spamguard.leadmon.net (union of all results)
4spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
4hostkarma.junkemailfilter.com (result 127.0.2.3 = domain first seen more than 7 days ago)
3multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
1tor.dnsbl.sectoor.de (result 127.0.0.1 = Tor server)
1dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
1dnsbl.sorbs.net (result 127.0.0.5 = open relay)
1dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
1blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses. The "union of most domain zones" line includes data from the hostkarma.junkemailfilter.com zone only when the results are 127.0.0.2, 127.0.0.3, or 127.0.0.4 because other results are not blacklists.

HitsDNS Zone
198369(total number of IP addresses whose names were tested, including 195 at SDSC)
126572hostkarma.junkemailfilter.com (result 127.0.2.3 = domain first seen more than 7 days ago)
115353hostkarma.junkemailfilter.com (result 127.0.1.1 = MTA sends QUIT)
104428(union of most domain zones)
91844l1.apews.org
82655abuse.rfc-ignorant.org
39008dynamic.rhs.mailpolice.com
34820whois.rfc-ignorant.org (union of all results)
23875whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
11753hostkarma.junkemailfilter.com (result 127.0.0.5 = do not blacklist)
10945whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
4481webmail.rhs.mailpolice.com
3013hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
2999hostkarma.junkemailfilter.com (result 127.0.1.4 = no verify host)
832adv.rhs.mailpolice.com
417hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
326urired.spameatingmonkey.net
275hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
127hostkarma.junkemailfilter.com (result 127.0.1.2 = MTA does not send QUIT)
90hostkarma.junkemailfilter.com (result 127.0.2.2 = domain first seen in last 7 days)
66postmaster.rfc-ignorant.org
64rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
64rhsbl.sorbs.net (union of all results)
60rhsbl.ahbl.org
44bulk.rhs.mailpolice.com
33dsn.rfc-ignorant.org (zone not intended for this use)
30bogusmx.rfc-ignorant.org
29multi.uribl.com (result 127.0.0.2 = spam resource)
29multi.uribl.com (union of all results)
20fresh.spameatingmonkey.net
20dob.sibl.support-intelligence.net
18multi.surbl.org
11porn.rhs.mailpolice.com
5bl.deadbeef.com

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains. The "union of most domain zones" line includes data from the hostkarma.junkemailfilter.com zone only when the results are 127.0.0.2, 127.0.0.3, or 127.0.0.4 because other results are not blacklists.

HitsDNS Zone
53010(total number of domains tested, including 184 at SDSC)
50788hostkarma.junkemailfilter.com (result 127.0.2.3 = domain first seen more than 7 days ago)
12559(union of most domain zones)
6979hostkarma.junkemailfilter.com (result 127.0.1.1 = MTA sends QUIT)
4101whois.rfc-ignorant.org (union of all results)
3906hostkarma.junkemailfilter.com (result 127.0.0.5 = do not blacklist)
3826whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
3341urired.spameatingmonkey.net
2967abuse.rfc-ignorant.org
2163hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
1891postmaster.rfc-ignorant.org
1557hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
1347multi.surbl.org
1102l1.apews.org
1074bogusmx.rfc-ignorant.org
783multi.uribl.com (union of all results)
768multi.uribl.com (result 127.0.0.2 = spam resource)
722webmail.rhs.mailpolice.com
495dsn.rfc-ignorant.org
448hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
275whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
267adv.rhs.mailpolice.com
171porn.rhs.mailpolice.com
69hostkarma.junkemailfilter.com (result 127.0.2.2 = domain first seen in last 7 days)
59bulk.rhs.mailpolice.com
28hostkarma.junkemailfilter.com (result 127.0.1.2 = MTA does not send QUIT)
20rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
20hostkarma.junkemailfilter.com (result 127.0.1.4 = no verify host)
20rhsbl.sorbs.net (union of all results)
18rhsbl.ahbl.org
14ex.dnsbl.org
13multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
13dynamic.rhs.mailpolice.com
6hostkarma.junkemailfilter.com (result 127.0.2.1 = domain first seen today)
4dob.sibl.support-intelligence.net
3fresh.spameatingmonkey.net
2multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
2bl.deadbeef.com
1hostkarma.junkemailfilter.com (result 127.0.1.3 = MTA somtimes sends QUIT)

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 14 January 2010.