Blacklists Compared

24 December 2005

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the exemptions.ahbl.org and query.bondedsender.org zones because they are not blacklists, and because it is too aggressive to be widely useful the block.blars.org zone is also excluded.

HitsDNS Zone
49835(total number of IP addresses tested, including 489 at SDSC)
43273(union of most IP zones)
30835block.blars.org
26050t1.dnsbl.net.au
25478dnsbl.sorbs.net (union of all results)
23549blackholes.five-ten-sg.com (union of all results)
22780sbl-xbl.spamhaus.org (union of all results)
22393blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
20807xbl.spamhaus.org (union of all results)
20114sbl-xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
20111xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
20103cbl.abuseat.org
19303dnsbl.sorbs.net (result 127.0.0.10 = dialup)
17388psbl.surriel.com
13382dynablock.njabl.org
10479no-more-funn.moensted.dk (union of all results)
9910cn-kr.blackholes.us (result 127.0.0.2 = China)
9910cn-kr.blackholes.us (union of all results)
8313unconfirmed.dsbl.org
8218list.dsbl.org
8212dsbl.dnsbl.net.au
7168china.blackholes.us
6709sbl.csma.biz
6099blacklist.spambag.org
5230bl.spamcop.net
4741no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
4427combined-hib.dnsiplists.completewhois.com (union of all results)
4422combined-hib.dnsiplists.completewhois.com (result 127.0.0.4 = bad whois data)
4075dnsbl.sorbs.net (result 127.0.0.6 = spam source)
3945l2.spews.dnsbl.sorbs.net
3380l1.spews.dnsbl.sorbs.net
3128no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
3002bl.csma.biz
2917dnsbl.njabl.org (union of all results)
2915wpbl.dnsbl.net.au
2797unsure.nether.net
2795dnsbl.rangers.eu.org (union of all results)
2742korea.blackholes.us
2731korea.services.net
2592sbl.spamhaus.org
2591sbl-xbl.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
2581dnsbl.rangers.eu.org (result 127.0.0.2 = dialup)
2543spews.dnsbl.net.au
2509dnsbl.ahbl.org (union of all results)
2468rmst.dnsbl.net.au
2356dnsbl.regedit64.net
2331ricn.dnsbl.net.au
2195no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
2177dnsbl.sorbs.net (result 127.0.0.7 = open formmail.cgi)
2159spamsources.fabel.dk
2086dnsbl.njabl.org (result 127.0.0.9 = open proxy)
2070brazil.blackholes.us
1715dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
1590russia.blackholes.us
1312opm.blitzed.org
1311xbl.spamhaus.org (result 127.0.0.6 = Blitzed Open Proxy Monitor List)
1311sbl-xbl.spamhaus.org (result 127.0.0.6 = Blitzed Open Proxy Monitor List)
1171dnsbl.antispam.or.id
1054spam.wytnij.to
1031japan.blackholes.us
1015dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
1006xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
1006sbl-xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
983dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
832bl.spamcannibal.org
796probes.dnsbl.net.au
782dnsbl.ahbl.org (result 127.0.0.4 = spam source)
613blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
553dnsbl.njabl.org (result 127.0.0.3 = dialup)
549tr.countries.nerd.dk
548turkey.blackholes.us
545taiwan.blackholes.us
532mexico.blackholes.us
460argentina.blackholes.us
399blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
360mail-abuse.blacklist.jippg.org
309malaysia.blackholes.us
247hongkong.blackholes.us
243thailand.blackholes.us
243no-more-funn.moensted.dk (result 127.0.0.9 = misc)
194no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
173query.bondedsender.org (not a blacklist!)
169blackholes.intersil.net
160singapore.blackholes.us
159dnsbl.njabl.org (result 127.0.0.4 = spam source)
133dnsbl.njabl.org (result 127.0.0.2 = open relay)
132relays.ordb.org
131dnsbl.rangers.eu.org (result 127.0.0.16 = spam haven)
104blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
100dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
98ohps.dnsbl.net.au
95flowgoaway.com
79multihop.dsbl.org
69dnsbl.rangers.eu.org (result 127.0.0.8 = spam source)
64dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
27rdts.dnsbl.net.au
24blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
23osps.dnsbl.net.au
23spamguard.leadmon.net (union of all results)
22spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
21relays.nether.net
21blackholes.uceb.org (union of all results)
14dnsbl.rangers.eu.org (result 127.0.0.4 = virus notices)
13exemptions.ahbl.org (not a blacklist!)
12dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
9nigeria.blackholes.us
9blackholes.uceb.org (result 127.0.0.6 = spam haven)
9osrs.dnsbl.net.au
9blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
9blackholes.brainerd.net
7dnsbl.sorbs.net (result 127.0.0.5 = open relay)
6blackholes.uceb.org (result 127.0.0.3 = spam source)
6blackholes.uceb.org (result 127.0.0.2 = open relay)
6tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
6hil.habeas.com
6tor.dnsbl.sectoor.de (union of all results)
5owps.dnsbl.net.au
5combined-hib.dnsiplists.completewhois.com (result 127.0.0.2 = unallocated IP address)
3blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
3dnsbl.ahbl.org (result 127.0.0.15 = open relay)
2blackholes.five-ten-sg.com (result 127.0.0.8 = open web form)
2blackholes.five-ten-sg.com (result 127.0.0.6 = open relay)
1dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
1spamsites.dnsbl.net.au
1omrs.dnsbl.net.au
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
1bl.deadbeef.com
1dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems.

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
49835(total number of IP addresses whose names were tested, including 489 at SDSC)
25404(union of all domain zones)
17826abuse.rfc-ignorant.org
15507rddn.dnsbl.net.au
11663whois.rfc-ignorant.org (union of all results)
8914whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
7420dynamic.rhs.mailpolice.com
2749whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
1891webmail.rhs.mailpolice.com
895rhsbl.ahbl.org
486adv.rhs.mailpolice.com
428bulk.rhs.mailpolice.com
363bl.deadbeef.com
237postmaster.rfc-ignorant.org
99bogusmx.rfc-ignorant.org
90dsn.rfc-ignorant.org (zone not intended for this use)
3blackhole.securitysage.com
3porn.rhs.mailpolice.com

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
31920(total number of domains tested, including 429 at SDSC)
8013(union of all domain zones)
2882whois.rfc-ignorant.org (union of all results)
2774abuse.rfc-ignorant.org
2112whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
1330rhsbl.ahbl.org
1164postmaster.rfc-ignorant.org
1078webmail.rhs.mailpolice.com
806dsn.rfc-ignorant.org
770whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
528bogusmx.rfc-ignorant.org
486rddn.dnsbl.net.au (zone not intended for this use)
470bulk.rhs.mailpolice.com
267dynamic.rhs.mailpolice.com
217adv.rhs.mailpolice.com
159bl.deadbeef.com
116blackhole.securitysage.com
101porn.rhs.mailpolice.com
49rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
49rhsbl.sorbs.net (union of all results)
14ex.dnsbl.org
1fraud.rhs.mailpolice.com
1cart00ney.surriel.com

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 5 January 2006.