Blacklists Compared

27 March 2010

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (all results but 127.0.0.2, 127.0.0.3, and 127.0.0.4), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, iadb2.isipp.com, and wl.mailspike.net zones because they are not blacklists. Because it is too aggressive to be widely useful the l2.apews.org zone is also excluded from the union.

HitsDNS Zone
187375(total number of IP addresses tested, including 199 at SDSC)
183479(union of most IP zones)
174835b.barracudacentral.org
172120zen.spamhaus.org (union of all results)
156356l2.apews.org
147449cbl.abuseat.org
147441zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
133596dnsbl-1.uceprotect.net
132970hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
124299dnsbl-2.uceprotect.net
119303dnsbl-3.uceprotect.net
117200dnsbl.sorbs.net (union of all results)
108326psbl.surriel.com
103383zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
100591bl.mailspike.net (union of all results)
89794dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
88464hostkarma.junkemailfilter.com (result 127.0.1.1 = MTA sends QUIT)
65347ubl.unsubscore.com
60942bl.spameatingmonkey.net
57387spam.dnsbl.sorbs.net
48740bl.mailspike.net (result 127.0.0.12 = bad reputation)
42830blackholes.five-ten-sg.com (union of all results)
42603bl.tiopan.com
42450dnsbl.sorbs.net (result 127.0.0.10 = dialup)
39085blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
38513bl.spamcop.net
36925no-more-funn.moensted.dk (union of all results)
34475db.wpbl.info
32522zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
26674no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
26408ix.dnsbl.manitu.net
26059bl.mailspike.net (result 127.0.0.11 = very bad reputation)
22282bl.score.senderscore.com
22085bl.mailspike.net (result 127.0.0.10 = worst possible reputation)
19370mail-abuse.blacklist.jippg.org
17694bl.mailspike.net (result 127.0.0.2 = distributed spam wave participant)
11774dnsbl.inps.de
10009hostkarma.junkemailfilter.com (result 127.0.1.2 = MTA does not send QUIT)
8277no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
7711korea.services.net
6285bl.spamcannibal.org
4526dnsbl.ahbl.org (union of all results)
4469list.dnswl.org (not a blacklist!)
4419dnsbl.ahbl.org (result 127.0.0.4 = spam source)
4149spamsources.fabel.dk
3445dnsbl.sorbs.net (result 127.0.0.6 = spam source)
3003wl.mailspike.net (union of all results) (not a blacklist!)
2884hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
2818blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
2624ips.backscatterer.org
2359tr.countries.nerd.dk
2319wl.mailspike.net (result 127.0.0.17 = possible legitimate sender) (not a blacklist!)
1971hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
1935dnsbl.njabl.org (union of all results)
1680dnsbl.njabl.org (result 127.0.0.9 = open proxy)
1376hostkarma.junkemailfilter.com (result 127.0.0.5 = do not blacklist)
1267no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
912blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
684wl.mailspike.net (result 127.0.0.18 = good reputation) (not a blacklist!)
674no-more-funn.moensted.dk (result 127.0.0.9 = misc)
524accredit.habeas.com (not a blacklist!)
493zen.spamhaus.org (union of SBL and SBLCSS results)
473aspews.ext.sorbs.net
456zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
432query.bondedsender.org (not a blacklist!)
212l2.bbfh.ext.sorbs.net
180dnsbl.njabl.org (result 127.0.0.2 = open relay)
123iadb2.isipp.com (not a blacklist!)
122tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
122tor.dnsbl.sectoor.de (union of all results)
106dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
99hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
87no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
82iadb.isipp.com (not a blacklist!)
75dnsbl.njabl.org (result 127.0.0.4 = spam source)
71l1.bbfh.ext.sorbs.net
42bl.deadbeef.com
37zen.spamhaus.org (result 127.0.0.3 = Spamhaus SBLCSS)
28dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
25dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
20multi.surbl.org
18dnsbl-0.uceprotect.net
15blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
8zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
8multi.uribl.com (result 127.0.0.2 = spam resource)
8multi.uribl.com (union of all results)
7hostkarma.junkemailfilter.com (result 127.0.2.3 = domain first seen more than 7 days ago)
6spamguard.leadmon.net (union of all results)
4blackholes.brainerd.net
3spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
3spamguard.leadmon.net (result 127.0.0.8 = open proxy)
2dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
2dnsbl.sorbs.net (result 127.0.0.5 = open relay)
2dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
1dnsbl.ahbl.org (result 127.0.0.20 = blog/wiki/comment spam source)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses. The "union of most domain zones" line includes data from the hostkarma.junkemailfilter.com zone only when the results are 127.0.0.2, 127.0.0.3, or 127.0.0.4 because other results are not blacklists.

HitsDNS Zone
187375(total number of IP addresses whose names were tested, including 199 at SDSC)
113062hostkarma.junkemailfilter.com (result 127.0.2.3 = domain first seen more than 7 days ago)
102520hostkarma.junkemailfilter.com (result 127.0.1.1 = MTA sends QUIT)
95424(union of most domain zones)
81798l1.apews.org
76296abuse.rfc-ignorant.org
33988whois.rfc-ignorant.org (union of all results)
30816dynamic.rhs.mailpolice.com
26268whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
12044hostkarma.junkemailfilter.com (result 127.0.0.5 = do not blacklist)
7720whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
4029webmail.rhs.mailpolice.com
3150hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
1503hostkarma.junkemailfilter.com (result 127.0.1.4 = no verify host)
912adv.rhs.mailpolice.com
499hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
412urired.spameatingmonkey.net
317hostkarma.junkemailfilter.com (result 127.0.1.2 = MTA does not send QUIT)
283dbl.spamhaus.org
258hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
120rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
120rhsbl.sorbs.net (union of all results)
79hostkarma.junkemailfilter.com (result 127.0.2.2 = domain first seen in last 7 days)
69multi.uribl.com (union of all results)
67multi.uribl.com (result 127.0.0.2 = spam resource)
51postmaster.rfc-ignorant.org
41bulk.rhs.mailpolice.com
39rhsbl.ahbl.org
35dsn.rfc-ignorant.org (zone not intended for this use)
31bogusmx.rfc-ignorant.org
29multi.surbl.org
17porn.rhs.mailpolice.com
10fresh.spameatingmonkey.net
7dob.sibl.support-intelligence.net
3bl.deadbeef.com
2multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
2hostkarma.junkemailfilter.com (result 127.0.2.1 = domain first seen today)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains. The "union of most domain zones" line includes data from the hostkarma.junkemailfilter.com zone only when the results are 127.0.0.2, 127.0.0.3, or 127.0.0.4 because other results are not blacklists.

HitsDNS Zone
73340(total number of domains tested, including 183 at SDSC)
70902hostkarma.junkemailfilter.com (result 127.0.2.3 = domain first seen more than 7 days ago)
12460(union of most domain zones)
6213hostkarma.junkemailfilter.com (result 127.0.1.1 = MTA sends QUIT)
3961whois.rfc-ignorant.org (union of all results)
3726whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
3688urired.spameatingmonkey.net
3195hostkarma.junkemailfilter.com (result 127.0.0.5 = do not blacklist)
2749abuse.rfc-ignorant.org
1947hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
1675postmaster.rfc-ignorant.org
1395bogusmx.rfc-ignorant.org
1173l1.apews.org
956hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
831dbl.spamhaus.org
790multi.surbl.org
746multi.uribl.com (union of all results)
735multi.uribl.com (result 127.0.0.2 = spam resource)
561webmail.rhs.mailpolice.com
387hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
330dsn.rfc-ignorant.org
277adv.rhs.mailpolice.com
235whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
176porn.rhs.mailpolice.com
56hostkarma.junkemailfilter.com (result 127.0.2.2 = domain first seen in last 7 days)
55bulk.rhs.mailpolice.com
30dob.sibl.support-intelligence.net
29rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
29rhsbl.sorbs.net (union of all results)
26hostkarma.junkemailfilter.com (result 127.0.1.2 = MTA does not send QUIT)
25fresh.spameatingmonkey.net
21rhsbl.ahbl.org
19hostkarma.junkemailfilter.com (result 127.0.1.4 = no verify host)
16hostkarma.junkemailfilter.com (result 127.0.2.1 = domain first seen today)
9ex.dnsbl.org
8multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
6dynamic.rhs.mailpolice.com
3multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
1fraud.rhs.mailpolice.com
1bl.deadbeef.com

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 31 March 2010.