Blacklists Compared

6 May 2006

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the exemptions.ahbl.org and query.bondedsender.org zones because they are not blacklists, and because it is too aggressive to be widely useful the block.blars.org zone is also excluded.

HitsDNS Zone
87317(total number of IP addresses tested, including 498 at SDSC)
76954(union of most IP zones)
55009block.blars.org
46781dnsbl.sorbs.net (union of all results)
41557t1.dnsbl.net.au
38508dnsbl.sorbs.net (result 127.0.0.10 = dialup)
35782sbl-xbl.spamhaus.org (union of all results)
33479xbl.spamhaus.org (union of all results)
32417cbl.abuseat.org
32395xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
32384sbl-xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
29367dynablock.njabl.org
23507psbl.surriel.com
18225cn-kr.blackholes.us (result 127.0.0.2 = China)
18225cn-kr.blackholes.us (union of all results)
15788blackholes.five-ten-sg.com (union of all results)
15576blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
15143no-more-funn.moensted.dk (union of all results)
14530sbl.csma.biz
13502china.blackholes.us
12666unconfirmed.dsbl.org
12551list.dsbl.org
12541dsbl.dnsbl.net.au
11146dnsbl-1.uceprotect.net
10371blacklist.spambag.org
9867bl.spamcop.net
9052dnsbl-2.uceprotect.net
7620dnsbl.sorbs.net (result 127.0.0.6 = spam source)
7206bl.csma.biz
5908l2.spews.dnsbl.sorbs.net
5265no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
5176l1.spews.dnsbl.sorbs.net
5012wpbl.dnsbl.net.au
4906no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
4833korea.services.net
4777dnsbl.njabl.org (union of all results)
4722korea.blackholes.us
4390no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
4039rmst.dnsbl.net.au
3341unsure.nether.net
3265dnsbl.njabl.org (result 127.0.0.9 = open proxy)
3200dnsbl.ahbl.org (union of all results)
3031sbl.spamhaus.org
3008sbl-xbl.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
3000spamsources.fabel.dk
2920dnsbl.sorbs.net (result 127.0.0.7 = open formmail.cgi)
2584dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
2560ricn.dnsbl.net.au
2407brazil.blackholes.us
2154sbl-xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
2153xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
1658tr.countries.nerd.dk
1657turkey.blackholes.us
1649spam.wytnij.to
1497mail-abuse.blacklist.jippg.org
1478russia.blackholes.us
1417japan.blackholes.us
1294taiwan.blackholes.us
1285dnsbl.njabl.org (result 127.0.0.3 = dialup)
1234dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
1191spews.dnsbl.net.au
1099bl.spamcannibal.org
1005dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
958dnsbl-3.uceprotect.net
903probes.dnsbl.net.au
831dnsbl.antispam.or.id
711opm.blitzed.org
709mexico.blackholes.us
702argentina.blackholes.us
600dnsbl.ahbl.org (result 127.0.0.4 = spam source)
374malaysia.blackholes.us
334no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
287hongkong.blackholes.us
261thailand.blackholes.us
248no-more-funn.moensted.dk (result 127.0.0.9 = misc)
186singapore.blackholes.us
180query.bondedsender.org (not a blacklist!)
140work.drbl.croco.net
134blackholes.intersil.net
132dnsbl.njabl.org (result 127.0.0.4 = spam source)
116blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
101dnsbl.njabl.org (result 127.0.0.2 = open relay)
98relays.ordb.org
92multihop.dsbl.org
79flowgoaway.com
79dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
73dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
64ohps.dnsbl.net.au
60blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
27osps.dnsbl.net.au
25blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
21tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
21tor.dnsbl.sectoor.de (union of all results)
20blackholes.uceb.org (union of all results)
19rdts.dnsbl.net.au
17relays.nether.net
16dnsbl.ahbl.org (result 127.0.0.15 = open relay)
14nigeria.blackholes.us
14exemptions.ahbl.org (not a blacklist!)
12dnsbl.sorbs.net (result 127.0.0.5 = open relay)
12spamguard.leadmon.net (union of all results)
10blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
9blackholes.uceb.org (result 127.0.0.3 = spam source)
9hil.habeas.com
8osrs.dnsbl.net.au
8spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
7dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
6vox.schpider.com
6blackholes.uceb.org (result 127.0.0.5 = dialup)
5blackholes.uceb.org (result 127.0.0.2 = open relay)
5dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)
4owps.dnsbl.net.au
4blackholes.brainerd.net
3bl.deadbeef.com
2spamguard.leadmon.net (result 127.0.0.3 = spam source)
2spamguard.leadmon.net (result 127.0.0.8 = open proxy)
1no-more-funn.moensted.dk (result 127.0.0.8 = open web form)
1no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
1blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
1combined-hib.dnsiplists.completewhois.com (result 127.0.0.2 = unallocated IP address)
1combined-hib.dnsiplists.completewhois.com (union of all results)

The blackholes.intersil.net zone "lists entrenched spammers, mainsleaze and mainsleaze wannabes who have pestered users at Intersil." The flowgoaway.com zone lists FloNetwork systems.

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
87317(total number of IP addresses whose names were tested, including 498 at SDSC)
49642(union of all domain zones)
34751abuse.rfc-ignorant.org
33093rddn.dnsbl.net.au
25154dynamic.rhs.mailpolice.com
24132whois.rfc-ignorant.org (union of all results)
19386whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
4747whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
3004webmail.rhs.mailpolice.com
1536rhsbl.ahbl.org
1025bl.deadbeef.com
553adv.rhs.mailpolice.com
281postmaster.rfc-ignorant.org
130bogusmx.rfc-ignorant.org
124dsn.rfc-ignorant.org (zone not intended for this use)
103bulk.rhs.mailpolice.com
3porn.rhs.mailpolice.com
1cart00ney.surriel.com

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
62446(total number of domains tested, including 465 at SDSC)
12731(union of all domain zones)
6626whois.rfc-ignorant.org (union of all results)
5999whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
3860abuse.rfc-ignorant.org
1938webmail.rhs.mailpolice.com
1223postmaster.rfc-ignorant.org
856rhsbl.ahbl.org
822dsn.rfc-ignorant.org
799bogusmx.rfc-ignorant.org
627whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
317porn.rhs.mailpolice.com
269bl.deadbeef.com
190adv.rhs.mailpolice.com
180bulk.rhs.mailpolice.com
126blackhole.securitysage.com
33rddn.dnsbl.net.au (zone not intended for this use)
28rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
28rhsbl.sorbs.net (union of all results)
21dynamic.rhs.mailpolice.com
16ex.dnsbl.org
1fraud.rhs.mailpolice.com
1cart00ney.surriel.com

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 23 May 2006.