Blacklists Compared

14 October 2006

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the exemptions.ahbl.org and query.bondedsender.org zones because they are not blacklists, and because it is too aggressive to be widely useful the block.blars.org zone is also excluded.

HitsDNS Zone
115931(total number of IP addresses tested, including 500 at SDSC)
106922(union of most IP zones)
85965t1.dnsbl.net.au
70965block.blars.org
62600dnsbl.sorbs.net (union of all results)
59529zen.spamhaus.org (union of all results)
59525sbl-xbl.spamhaus.org (union of all results)
58750xbl.spamhaus.org (union of all results)
57479cbl.abuseat.org
57407zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
57402xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
57402sbl-xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
55568psbl.surriel.com
54329blackholes.five-ten-sg.com (union of all results)
54175no-more-funn.moensted.dk (union of all results)
52881blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
52243dnsbl.sorbs.net (result 127.0.0.10 = dialup)
51563dnsbl.tqmcube.com (union of all results)
36489dynablock.njabl.org
34601no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
25380dnsbl.tqmcube.com (result 127.0.0.2 = dialup)
23579dnsbl-1.uceprotect.net
21041bl.spamcop.net
19324dnsbl-3.uceprotect.net
18363cn-kr.blackholes.us (result 127.0.0.2 = China)
18363cn-kr.blackholes.us (union of all results)
17094no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
14325dnsbl-2.uceprotect.net
12678china.blackholes.us
12541dnsbl.tqmcube.com (result 127.0.0.5 = China)
11819unconfirmed.dsbl.org
11669list.dsbl.org
11659dsbl.dnsbl.net.au
11023ubl.unsubscore.com
10989bl.csma.biz
10804blacklist.spambag.org
9048dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
8216wpbl.dnsbl.net.au
8065dnsbl.tqmcube.com (result 127.0.0.3 = spam source)
6962dnsbl.njabl.org (union of all results)
6212korea.services.net
5698korea.blackholes.us
5579dnsbl.tqmcube.com (result 127.0.0.4 = South Korea)
5423combined-hib.dnsiplists.completewhois.com (union of all results)
5389combined-hib.dnsiplists.completewhois.com (result 127.0.0.4 = bad whois data)
5216dnsbl.njabl.org (result 127.0.0.9 = open proxy)
4425mail-abuse.blacklist.jippg.org
4208unsure.nether.net
4103rmst.dnsbl.net.au
3924dnsbl.ahbl.org (union of all results)
3876dnsbl.sorbs.net (result 127.0.0.6 = spam source)
3597zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
3597xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
3597sbl-xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
3586dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
3568brazil.blackholes.us
3275spamsources.fabel.dk
2125no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
2023tr.countries.nerd.dk
1985turkey.blackholes.us
1840probes.dnsbl.net.au
1756dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
1600russia.blackholes.us
1517argentina.blackholes.us
1448dnsbl.njabl.org (result 127.0.0.3 = dialup)
1380taiwan.blackholes.us
1316japan.blackholes.us
1131l2.spews.dnsbl.sorbs.net
1030l1.spews.dnsbl.sorbs.net
962dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
935zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
935sbl-xbl.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
935sbl.spamhaus.org
847blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
787thailand.blackholes.us
695malaysia.blackholes.us
637mexico.blackholes.us
568spews.dnsbl.net.au
461spam.wytnij.to
412hongkong.blackholes.us
407no-more-funn.moensted.dk (result 127.0.0.9 = misc)
336singapore.blackholes.us
327dnsbl.ahbl.org (result 127.0.0.4 = spam source)
302no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
301blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
233blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
225sbl.csma.biz
204dnsbl.njabl.org (result 127.0.0.4 = spam source)
171work.drbl.croco.net
167blackholes.uceb.org (union of all results)
129query.bondedsender.org (not a blacklist!)
117multihop.dsbl.org
105blackholes.uceb.org (result 127.0.0.3 = spam source)
96dnsbl.njabl.org (result 127.0.0.2 = open relay)
95dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
72dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
66relays.ordb.org
65flowgoaway.com
58ricn.dnsbl.net.au
58blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
53ohps.dnsbl.net.au
50blackholes.uceb.org (result 127.0.0.5 = dialup)
38bl.spamcannibal.org
34relays.nether.net
34combined-hib.dnsiplists.completewhois.com (result 127.0.0.2 = unallocated IP address)
26tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
26dnsbl.antispam.or.id
26tor.dnsbl.sectoor.de (union of all results)
17multi.surbl.org
17exemptions.ahbl.org (not a blacklist!)
16nigeria.blackholes.us
15osps.dnsbl.net.au
13spamguard.leadmon.net (union of all results)
12spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
11blackholes.uceb.org (result 127.0.0.2 = open relay)
10dnsbl.ahbl.org (result 127.0.0.15 = open relay)
7rdts.dnsbl.net.au
7blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
5dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
4owps.dnsbl.net.au
4blackholes.brainerd.net
4dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)
3dnsbl.sorbs.net (result 127.0.0.5 = open relay)
3osrs.dnsbl.net.au
3no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
3bl.deadbeef.com
2dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
1blackholes.uceb.org (result 127.0.0.8 = spam source with fake sender)
1spamguard.leadmon.net (result 127.0.0.3 = spam source)
1no-more-funn.moensted.dk (result 127.0.0.8 = open web form)
1blackholes.five-ten-sg.com (result 127.0.0.11 = TCPA violator)
1blackholes.five-ten-sg.com (result 127.0.0.13 = challenge-response source)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
115931(total number of IP addresses whose names were tested, including 500 at SDSC)
68187(union of all domain zones)
49536rddn.dnsbl.net.au
46760abuse.rfc-ignorant.org
34732dynamic.rhs.mailpolice.com
32525whois.rfc-ignorant.org (union of all results)
22774whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
9751whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
3278webmail.rhs.mailpolice.com
536postmaster.rfc-ignorant.org
497adv.rhs.mailpolice.com
338rhsbl.ahbl.org
277multi.surbl.org
101bulk.rhs.mailpolice.com
92bogusmx.rfc-ignorant.org
90dsn.rfc-ignorant.org (zone not intended for this use)
3porn.rhs.mailpolice.com

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
83599(total number of domains tested, including 427 at SDSC)
13432(union of all domain zones)
5015whois.rfc-ignorant.org (union of all results)
4241whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
4048abuse.rfc-ignorant.org
2039multi.surbl.org
1712postmaster.rfc-ignorant.org
1534webmail.rhs.mailpolice.com
1091bogusmx.rfc-ignorant.org
1065dsn.rfc-ignorant.org
774whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
637rhsbl.ahbl.org
405porn.rhs.mailpolice.com
235bulk.rhs.mailpolice.com
217adv.rhs.mailpolice.com
179blackhole.securitysage.com
62rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
62rhsbl.sorbs.net (union of all results)
28rddn.dnsbl.net.au (zone not intended for this use)
18ex.dnsbl.org
11dynamic.rhs.mailpolice.com
1fraud.rhs.mailpolice.com

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 20 October 2006.