Blacklists Compared

26 October 2013

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the hostkarma.junkemailfilter.com (all results but 127.0.0.2, 127.0.0.3, and 127.0.0.4), exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, iadb2.isipp.com, swl.spamhaus.org, and wl.mailspike.net zones because they are not blacklists. Because they are too aggressive to be widely useful the spam.dnsbl.sorbs.net and l2.apews.org zones are also excluded from the union.

HitsDNS Zone
64540(total number of IP addresses tested, including 151 at SDSC)
59666(union of most IP zones)
51840b.barracudacentral.org
50757l2.apews.org
50470zen.spamhaus.org (union of all results)
46087cbl.abuseat.org
46086zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
41221bl.tiopan.com
40464hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
39983hostkarma.junkemailfilter.com (result 127.0.1.1 = MTA sends QUIT)
39130spam.dnsbl.sorbs.net
38281dnsbl-1.uceprotect.net
32573bl.mailspike.net (union of all results)
30977zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
28836db.wpbl.info
28680psbl.surriel.com
27786dnsbl.sorbs.net (union of all results)
24096bl.mailspike.net (result 127.0.0.11 = very bad reputation)
22261all.spamrats.com (union of all results)
21031bl.spameatingmonkey.net
20065dnsbl.inps.de
15891dnsbl-2.uceprotect.net
15287all.spamrats.com (result 127.0.0.36 = dialup)
14892dnsbl-3.uceprotect.net
14579dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
14054truncate.gbudb.net
13554ubl.unsubscore.com
12875dnsbl.sorbs.net (result 127.0.0.6 = spam source)
12705bl.spamcop.net
10289dnsbl.sorbs.net (result 127.0.0.10 = dialup)
7569ips.backscatterer.org
7285bl.mailspike.net (result 127.0.0.12 = bad reputation)
6542all.spamrats.com (result 127.0.0.37 = no reverse DNS entry)
6293list.dnswl.org (not a blacklist!)
5764bl.score.senderscore.com
5501wl.mailspike.net (union of all results) (not a blacklist!)
5018zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
3467hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
3324wl.mailspike.net (result 127.0.0.18 = good reputation) (not a blacklist!)
3186bl.mailspike.net (result 127.0.0.2 = distributed spam wave participant)
3088hostkarma.junkemailfilter.com (result 127.0.0.5 = do not blacklist)
3002all.s5h.net
2981hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
2500hostkarma.junkemailfilter.com (result 127.0.1.2 = MTA does not send QUIT)
2337ix.dnsbl.manitu.net
1634bl.spamcannibal.org
1494wl.mailspike.net (result 127.0.0.17 = possible legitimate sender) (not a blacklist!)
1308spamsources.fabel.dk
1273zen.spamhaus.org (union of SBL and SBLCSS results)
1002mail-abuse.blacklist.jippg.org
875tr.countries.nerd.dk
808accredit.habeas.com (not a blacklist!)
678query.bondedsender.org (not a blacklist!)
662free.v4bl.org
657zen.spamhaus.org (result 127.0.0.3 = Spamhaus SBLCSS)
620wl.mailspike.net (result 127.0.0.19 = very good reputation) (not a blacklist!)
616zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
543korea.services.net
508all.spamrats.com (result 127.0.0.38 = spam source)
212iadb.isipp.com (not a blacklist!)
194hostkarma.junkemailfilter.com (result 127.0.0.4 = spam source aspirant)
137iadb2.isipp.com (not a blacklist!)
126bl.mav.com.br
125dnsbl.ahbl.org (union of all results)
121dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
121dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
121dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
100dnsbl.ahbl.org (result 127.0.0.4 = spam source)
66tor.dnsbl.sectoor.de (union of all results)
63wl.mailspike.net (result 127.0.0.20 = excellent reputation) (not a blacklist!)
62tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
57bl.mailspike.net (result 127.0.0.10 = worst possible reputation)
25dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
8l1.bbfh.ext.sorbs.net
7wadb.isipp.com
7l2.bbfh.ext.sorbs.net
6dnsbl-0.uceprotect.net
5multi.surbl.org
5dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
5spamguard.leadmon.net (union of all results)
4tor.dnsbl.sectoor.de (result 127.0.0.1 = Tor server)
4spamguard.leadmon.net (result 127.0.0.9 = abused DNS server)
2aspews.ext.sorbs.net
1spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
1hostkarma.junkemailfilter.com (result 127.0.2.3 = domain first seen more than 7 days ago)
Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses. The "union of most domain zones" line includes data from the hostkarma.junkemailfilter.com zone only when the results are 127.0.0.2, 127.0.0.3, or 127.0.0.4 because other results are not blacklists.

HitsDNS Zone
64540(total number of IP addresses whose names were tested, including 151 at SDSC)
38931hostkarma.junkemailfilter.com (result 127.0.2.3 = domain first seen more than 7 days ago)
31242hostkarma.junkemailfilter.com (result 127.0.1.1 = MTA sends QUIT)
18580l1.apews.org
5291hostkarma.junkemailfilter.com (result 127.0.0.5 = do not blacklist)
2551hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
2550(union of most domain zones)
989hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
863hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
794dbl.spamhaus.org (union of all results)
793dbl.spamhaus.org (result 127.0.1.2 = spam source)
500hostkarma.junkemailfilter.com (result 127.0.2.2 = domain first seen in last 7 days)
242hostkarma.junkemailfilter.com (result 127.0.1.4 = no verify host)
118multi.surbl.org
113hostkarma.junkemailfilter.com (result 127.0.1.2 = MTA does not send QUIT)
62rhsbl.ahbl.org
21urired.spameatingmonkey.net
18hostkarma.junkemailfilter.com (result 127.0.2.1 = domain first seen today)
16fresh.spameatingmonkey.net
15dob.sibl.support-intelligence.net
1dbl.spamhaus.org (result 127.0.1.3 = domain redirects to spammer)
Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains. The "union of most domain zones" line includes data from the hostkarma.junkemailfilter.com zone only when the results are 127.0.0.2, 127.0.0.3, or 127.0.0.4 because other results are not blacklists.

HitsDNS Zone
26249(total number of domains tested, including 119 at SDSC)
22510hostkarma.junkemailfilter.com (result 127.0.2.3 = domain first seen more than 7 days ago)
4593hostkarma.junkemailfilter.com (result 127.0.1.1 = MTA sends QUIT)
3289(union of most domain zones)
2404dbl.spamhaus.org (union of all results)
2401dbl.spamhaus.org (result 127.0.1.2 = spam source)
2203hostkarma.junkemailfilter.com (result 127.0.0.2 = spam source)
1780hostkarma.junkemailfilter.com (result 127.0.2.2 = domain first seen in last 7 days)
1549hostkarma.junkemailfilter.com (result 127.0.0.1 = whitelisted)
1477hostkarma.junkemailfilter.com (result 127.0.0.5 = do not blacklist)
1033multi.surbl.org
921l1.apews.org
751fresh.spameatingmonkey.net
715dob.sibl.support-intelligence.net
198hostkarma.junkemailfilter.com (result 127.0.0.3 = mix of spam and nonspam)
100urired.spameatingmonkey.net
36hostkarma.junkemailfilter.com (result 127.0.1.2 = MTA does not send QUIT)
28rhsbl.ahbl.org
17hostkarma.junkemailfilter.com (result 127.0.1.4 = no verify host)
16hostkarma.junkemailfilter.com (result 127.0.2.1 = domain first seen today)
6ex.dnsbl.org
3hostkarma.junkemailfilter.com (result 127.0.1.3 = MTA somtimes sends QUIT)
3dbl.spamhaus.org (result 127.0.1.3 = domain redirects to spammer)
This document was last updated by Jeff Makey <jeff@sdsc.edu> on 28 October 2013.