Blacklists Compared

4 March 2006

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the exemptions.ahbl.org and query.bondedsender.org zones because they are not blacklists, and because it is too aggressive to be widely useful the block.blars.org zone is also excluded.

HitsDNS Zone
70204(total number of IP addresses tested, including 484 at SDSC)
62730(union of most IP zones)
42962block.blars.org
37533t1.dnsbl.net.au
37486dnsbl.sorbs.net (union of all results)
33575blackholes.five-ten-sg.com (union of all results)
32564blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
32304sbl-xbl.spamhaus.org (union of all results)
30112xbl.spamhaus.org (union of all results)
29965dnsbl.sorbs.net (result 127.0.0.10 = dialup)
28619sbl-xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
28611xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
28604cbl.abuseat.org
23689psbl.surriel.com
22177dynablock.njabl.org
16309no-more-funn.moensted.dk (union of all results)
14112cn-kr.blackholes.us (result 127.0.0.2 = China)
14112cn-kr.blackholes.us (union of all results)
13052sbl.csma.biz
11669unconfirmed.dsbl.org
11565list.dsbl.org
11558dsbl.dnsbl.net.au
10337blacklist.spambag.org
10163bl.spamcop.net
9819china.blackholes.us
7860no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
6299dnsbl-1.uceprotect.net
6205combined-hib.dnsiplists.completewhois.com (union of all results)
6198combined-hib.dnsiplists.completewhois.com (result 127.0.0.4 = bad whois data)
6149dnsbl-2.uceprotect.net
5932dnsbl.sorbs.net (result 127.0.0.6 = spam source)
5781bl.csma.biz
5167unsure.nether.net
5107l2.spews.dnsbl.sorbs.net
4860wpbl.dnsbl.net.au
4809dnsbl.sorbs.net (result 127.0.0.7 = open formmail.cgi)
4547l1.spews.dnsbl.sorbs.net
4547spews.dnsbl.net.au
4391no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
4305korea.services.net
4293korea.blackholes.us
4119dnsbl.njabl.org (union of all results)
3735rmst.dnsbl.net.au
3372no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
3199dnsbl.ahbl.org (union of all results)
2939ricn.dnsbl.net.au
2924dnsbl.njabl.org (result 127.0.0.9 = open proxy)
2783sbl.spamhaus.org
2777sbl-xbl.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
2744spamsources.fabel.dk
2293dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
1932xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
1932sbl-xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
1836opm.blitzed.org
1833xbl.spamhaus.org (result 127.0.0.6 = Blitzed Open Proxy Monitor List)
1833sbl-xbl.spamhaus.org (result 127.0.0.6 = Blitzed Open Proxy Monitor List)
1775brazil.blackholes.us
1659spam.wytnij.to
1636russia.blackholes.us
1506japan.blackholes.us
1107mail-abuse.blacklist.jippg.org
1066dnsbl-3.uceprotect.net
1023probes.dnsbl.net.au
1001bl.spamcannibal.org
960dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
942taiwan.blackholes.us
912dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
887tr.countries.nerd.dk
885dnsbl.njabl.org (result 127.0.0.3 = dialup)
885dnsbl.ahbl.org (result 127.0.0.4 = spam source)
882turkey.blackholes.us
842mexico.blackholes.us
584argentina.blackholes.us
489blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
488dnsbl.antispam.or.id
410no-more-funn.moensted.dk (result 127.0.0.9 = misc)
402hongkong.blackholes.us
390thailand.blackholes.us
390malaysia.blackholes.us
318blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
279no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
247singapore.blackholes.us
189dnsbl.njabl.org (result 127.0.0.2 = open relay)
185query.bondedsender.org (not a blacklist!)
168blackholes.intersil.net
149relays.ordb.org
142blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
128dnsbl.njabl.org (result 127.0.0.4 = spam source)
117ohps.dnsbl.net.au
81multihop.dsbl.org
75flowgoaway.com
69dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
49dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
48blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
28osps.dnsbl.net.au
26spamguard.leadmon.net (union of all results)
23relays.nether.net
22spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
22blackholes.uceb.org (union of all results)
20rdts.dnsbl.net.au
17dnsbl.sorbs.net (result 127.0.0.5 = open relay)
17osrs.dnsbl.net.au
16exemptions.ahbl.org (not a blacklist!)
15tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
15tor.dnsbl.sectoor.de (union of all results)
14nigeria.blackholes.us
11dnsbl.ahbl.org (result 127.0.0.15 = open relay)
10hil.habeas.com
9blackholes.uceb.org (result 127.0.0.3 = spam source)
9dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
8blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
8dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)
7combined-hib.dnsiplists.completewhois.com (result 127.0.0.2 = unallocated IP address)
6blackholes.uceb.org (result 127.0.0.5 = dialup)
5blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
5blackholes.brainerd.net
4blackholes.uceb.org (result 127.0.0.2 = open relay)
4blackholes.uceb.org (result 127.0.0.6 = spam haven)
4owps.dnsbl.net.au
4spamguard.leadmon.net (result 127.0.0.3 = spam source)
1dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
1spamsites.dnsbl.net.au
1no-more-funn.moensted.dk (result 127.0.0.8 = open web form)
1no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
1blackholes.five-ten-sg.com (result 127.0.0.11 = TCPA violator)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems.

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
70204(total number of IP addresses whose names were tested, including 484 at SDSC)
37929(union of all domain zones)
26439abuse.rfc-ignorant.org
24844rddn.dnsbl.net.au
18809whois.rfc-ignorant.org (union of all results)
14807whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
10534dynamic.rhs.mailpolice.com
4003whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
2341webmail.rhs.mailpolice.com
1115rhsbl.ahbl.org
598bl.deadbeef.com
494adv.rhs.mailpolice.com
328bulk.rhs.mailpolice.com
305postmaster.rfc-ignorant.org
133bogusmx.rfc-ignorant.org
128dsn.rfc-ignorant.org (zone not intended for this use)
5porn.rhs.mailpolice.com
1blackhole.securitysage.com

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
42679(total number of domains tested, including 402 at SDSC)
7213(union of all domain zones)
2216abuse.rfc-ignorant.org
2124whois.rfc-ignorant.org (union of all results)
1630whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
1247bogusmx.rfc-ignorant.org
1172rhsbl.ahbl.org
1130postmaster.rfc-ignorant.org
962webmail.rhs.mailpolice.com
733dsn.rfc-ignorant.org
494whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
224bulk.rhs.mailpolice.com
184adv.rhs.mailpolice.com
168porn.rhs.mailpolice.com
135bl.deadbeef.com
118blackhole.securitysage.com
39rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
39rhsbl.sorbs.net (union of all results)
23rddn.dnsbl.net.au (zone not intended for this use)
13dynamic.rhs.mailpolice.com
12ex.dnsbl.org
2cart00ney.surriel.com

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 20 March 2006.