Blacklists Compared

6 February 2010

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]


Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (all results but 127.0.0.2, 127.0.0.3, and 127.0.0.4), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
219214(total number of IP addresses tested, including 192 at SDSC)
215438(union of most IP zones)
200922zen.spamhaus.org (union of all results)
183241l2.apews.org
172770b.barracudacentral.org
163270cbl.abuseat.org
163244zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
148931dnsbl-1.uceprotect.net
144794dnsbl-2.uceprotect.net
144259hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
140943dnsbl-3.uceprotect.net
131913dnsbl.sorbs.net (union of all results)
131906psbl.surriel.com
124233zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
119069ubl.unsubscore.com
99163dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
85345hostkarma.junkemailfilter.com (result 127.0.1.1 = MTA sends QUIT)
61943bl.spameatingmonkey.net
57888blackholes.five-ten-sg.com (union of all results)
52975blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
49255dnsbl.sorbs.net (result 127.0.0.10 = dialup)
46566bl.tiopan.com
44904bl.spamcop.net
42166no-more-funn.moensted.dk (union of all results)
41487db.wpbl.info
39971bl.score.senderscore.com
35127zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
29877ix.dnsbl.manitu.net
29801no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
21884mail-abuse.blacklist.jippg.org
16132spam.dnsbl.sorbs.net
14926hostkarma.junkemailfilter.com (result 127.0.1.2 = MTA does not send QUIT)
11694dnsbl.inps.de
9693no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
9594korea.services.net
7537bl.spamcannibal.org
5066spamsources.fabel.dk
4771list.dnswl.org (not a blacklist!)
3782blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
3414dnsbl.ahbl.org (union of all results)
3291dnsbl.ahbl.org (result 127.0.0.4 = spam source)
3156ips.backscatterer.org
2982hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
2431dnsbl.njabl.org (union of all results)
2380tr.countries.nerd.dk
2112dnsbl.njabl.org (result 127.0.0.9 = open proxy)
2053no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
2024hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
1500hostkarma.junkemailfilter.com (result 127.0.0.5 = do not blacklist)
1112blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
570no-more-funn.moensted.dk (result 127.0.0.9 = misc)
544zen.spamhaus.org (union of SBL and SBLCSS results)
527l2.bbfh.ext.sorbs.net
505aspews.ext.sorbs.net
490zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
465accredit.habeas.com (not a blacklist!)
364query.bondedsender.org (not a blacklist!)
342dnsbl.sorbs.net (result 127.0.0.6 = spam source)
288l1.bbfh.ext.sorbs.net
188dnsbl.njabl.org (result 127.0.0.2 = open relay)
158no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
157iadb2.isipp.com (not a blacklist!)
151tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
151tor.dnsbl.sectoor.de (union of all results)
131dnsbl.njabl.org (result 127.0.0.4 = spam source)
122dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
113iadb.isipp.com (not a blacklist!)
102hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
54zen.spamhaus.org (result 127.0.0.3 = Spamhaus SBLCSS)
47dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
43dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
41bl.deadbeef.com
18blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
11dnsbl-0.uceprotect.net
8zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
8multi.uribl.com (result 127.0.0.2 = spam resource)
8multi.uribl.com (union of all results)
5hostkarma.junkemailfilter.com (result 127.0.2.3 = domain first seen more than 7 days ago)
5spamguard.leadmon.net (union of all results)
3multi.surbl.org
3spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
2dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
1dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1spamguard.leadmon.net (result 127.0.0.8 = open proxy)
1blackholes.five-ten-sg.com (result 127.0.0.11 = TCPA violator)
1blackholes.brainerd.net
1dnsbl.ahbl.org (result 127.0.0.20 = blog/wiki/comment spam source)


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses. The "union of most domain zones" line includes data from the hostkarma.junkemailfilter.com zone only when the results are 127.0.0.2, 127.0.0.3, or 127.0.0.4 because other results are not blacklists.

HitsDNS Zone
219214(total number of IP addresses whose names were tested, including 192 at SDSC)
132695hostkarma.junkemailfilter.com (result 127.0.2.3 = domain first seen more than 7 days ago)
120106hostkarma.junkemailfilter.com (result 127.0.1.1 = MTA sends QUIT)
109293(union of most domain zones)
92955l1.apews.org
88872abuse.rfc-ignorant.org
38236whois.rfc-ignorant.org (union of all results)
37849dynamic.rhs.mailpolice.com
30186whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
12731hostkarma.junkemailfilter.com (result 127.0.0.5 = do not blacklist)
8050whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
4755webmail.rhs.mailpolice.com
3194hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
1786hostkarma.junkemailfilter.com (result 127.0.1.4 = no verify host)
886adv.rhs.mailpolice.com
515hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
460urired.spameatingmonkey.net
337hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
239hostkarma.junkemailfilter.com (result 127.0.1.2 = MTA does not send QUIT)
126rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
126rhsbl.sorbs.net (union of all results)
101hostkarma.junkemailfilter.com (result 127.0.2.2 = domain first seen in last 7 days)
72postmaster.rfc-ignorant.org
57fresh.spameatingmonkey.net
57dob.sibl.support-intelligence.net
44dsn.rfc-ignorant.org (zone not intended for this use)
41multi.uribl.com (result 127.0.0.2 = spam resource)
41multi.uribl.com (union of all results)
39rhsbl.ahbl.org
38multi.surbl.org
38bogusmx.rfc-ignorant.org
29bulk.rhs.mailpolice.com
10porn.rhs.mailpolice.com
6bl.deadbeef.com


Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains. The "union of most domain zones" line includes data from the hostkarma.junkemailfilter.com zone only when the results are 127.0.0.2, 127.0.0.3, or 127.0.0.4 because other results are not blacklists.

HitsDNS Zone
87379(total number of domains tested, including 181 at SDSC)
84010hostkarma.junkemailfilter.com (result 127.0.2.3 = domain first seen more than 7 days ago)
14612(union of most domain zones)
7957hostkarma.junkemailfilter.com (result 127.0.1.1 = MTA sends QUIT)
5604whois.rfc-ignorant.org (union of all results)
5289whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
4763hostkarma.junkemailfilter.com (result 127.0.0.5 = do not blacklist)
3646abuse.rfc-ignorant.org
3115urired.spameatingmonkey.net
2502hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
2046postmaster.rfc-ignorant.org
1488l1.apews.org
1365bogusmx.rfc-ignorant.org
1020hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
812multi.uribl.com (union of all results)
799multi.uribl.com (result 127.0.0.2 = spam resource)
766webmail.rhs.mailpolice.com
764multi.surbl.org
530hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
462dsn.rfc-ignorant.org
315whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
309adv.rhs.mailpolice.com
238porn.rhs.mailpolice.com
80hostkarma.junkemailfilter.com (result 127.0.2.2 = domain first seen in last 7 days)
79bulk.rhs.mailpolice.com
42hostkarma.junkemailfilter.com (result 127.0.1.2 = MTA does not send QUIT)
28rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
28rhsbl.sorbs.net (union of all results)
27dynamic.rhs.mailpolice.com
25hostkarma.junkemailfilter.com (result 127.0.1.4 = no verify host)
24rhsbl.ahbl.org
20dob.sibl.support-intelligence.net
12ex.dnsbl.org
11fresh.spameatingmonkey.net
10multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
7hostkarma.junkemailfilter.com (result 127.0.2.1 = domain first seen today)
3multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
3fraud.rhs.mailpolice.com
1hostkarma.junkemailfilter.com (result 127.0.1.3 = MTA somtimes sends QUIT)
1bl.deadbeef.com


This document was last updated by Jeff Makey <jeff@sdsc.edu> on 11 February 2010.