Blacklists Compared

11 November 2006

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the exemptions.ahbl.org and query.bondedsender.org zones because they are not blacklists, and because it is too aggressive to be widely useful the block.blars.org zone is also excluded.

HitsDNS Zone
157422(total number of IP addresses tested, including 515 at SDSC)
146746(union of most IP zones)
113582t1.dnsbl.net.au
98265block.blars.org
85690dnsbl.sorbs.net (union of all results)
74510blackholes.five-ten-sg.com (union of all results)
74230no-more-funn.moensted.dk (union of all results)
72907blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
72837dnsbl.sorbs.net (result 127.0.0.10 = dialup)
68684sbl-xbl.spamhaus.org (union of all results)
68657zen.spamhaus.org (union of all results)
68025xbl.spamhaus.org (union of all results)
67983dnsbl.tqmcube.com (union of all results)
66776sbl-xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
66755zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
66646xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
66392cbl.abuseat.org
63856psbl.surriel.com
50945dynablock.njabl.org
49277no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
47323dnsbl-3.uceprotect.net
41127dnsbl-1.uceprotect.net
37577dnsbl-2.uceprotect.net
33143dnsbl.tqmcube.com (result 127.0.0.2 = dialup)
28173bl.spamcop.net
25385bl.csma.biz
20115no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
15120unconfirmed.dsbl.org
14948list.dsbl.org
14668dnsbl.tqmcube.com (result 127.0.0.5 = China)
14518dsbl.dnsbl.net.au
14292cn-kr.blackholes.us (result 127.0.0.2 = China)
14292cn-kr.blackholes.us (union of all results)
14083dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
13583dnsbl.tqmcube.com (result 127.0.0.3 = spam source)
11710blacklist.spambag.org
9998ubl.unsubscore.com
9982china.blackholes.us
8550dnsbl.njabl.org (union of all results)
7278korea.services.net
6863mail-abuse.blacklist.jippg.org
6590dnsbl.tqmcube.com (result 127.0.0.4 = South Korea)
6529rmst.dnsbl.net.au
6051dnsbl.njabl.org (result 127.0.0.9 = open proxy)
5108spews.dnsbl.net.au
4591dnsbl.ahbl.org (union of all results)
4486korea.blackholes.us
4355wpbl.dnsbl.net.au
4181dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
4026dnsbl.sorbs.net (result 127.0.0.6 = spam source)
3997no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
3826sbl-xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
3816zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
3790xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
3693tr.countries.nerd.dk
3469spamsources.fabel.dk
3403unsure.nether.net
2821turkey.blackholes.us
2598bl.spamcannibal.org
2216dnsbl.njabl.org (result 127.0.0.3 = dialup)
1898probes.dnsbl.net.au
1814dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
1782ricn.dnsbl.net.au
1411taiwan.blackholes.us
1291japan.blackholes.us
1239brazil.blackholes.us
1147argentina.blackholes.us
1046dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
917blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
893malaysia.blackholes.us
791russia.blackholes.us
726zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
726sbl.spamhaus.org
723sbl-xbl.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
723no-more-funn.moensted.dk (result 127.0.0.9 = misc)
650thailand.blackholes.us
528mexico.blackholes.us
468spam.wytnij.to
458blackholes.uceb.org (union of all results)
452hongkong.blackholes.us
392dnsbl.ahbl.org (result 127.0.0.4 = spam source)
381l1.spews.dnsbl.sorbs.net
351no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
344blackholes.uceb.org (result 127.0.0.6 = spam haven)
317blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
296blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
286l2.spews.dnsbl.sorbs.net
278singapore.blackholes.us
219sbl.csma.biz
217work.drbl.croco.net
204blackholes.uceb.org (result 127.0.0.3 = spam source)
163dnsbl.njabl.org (result 127.0.0.4 = spam source)
142query.bondedsender.org (not a blacklist!)
124dnsbl.njabl.org (result 127.0.0.2 = open relay)
112multihop.dsbl.org
107dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
78blackholes.uceb.org (result 127.0.0.5 = dialup)
77relays.ordb.org
76dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
74dnsbl.antispam.or.id
72flowgoaway.com
64blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
49relays.nether.net
40ohps.dnsbl.net.au
32tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
32tor.dnsbl.sectoor.de (union of all results)
26bl.deadbeef.com
25rdts.dnsbl.net.au
22no-more-funn.moensted.dk (result 127.0.0.5 = relay output)
21dnsbl.ahbl.org (result 127.0.0.15 = open relay)
20multi.surbl.org
19exemptions.ahbl.org (not a blacklist!)
18spamguard.leadmon.net (union of all results)
15spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
14blackholes.uceb.org (result 127.0.0.2 = open relay)
13osps.dnsbl.net.au
11dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
10blackholes.brainerd.net
7osrs.dnsbl.net.au
6dnsbl.sorbs.net (result 127.0.0.5 = open relay)
5owps.dnsbl.net.au
4blackholes.five-ten-sg.com (result 127.0.0.10 = virus notices)
2nigeria.blackholes.us
2spamguard.leadmon.net (result 127.0.0.3 = spam source)
2blackholes.five-ten-sg.com (result 127.0.0.11 = TCPA violator)
2blackholes.five-ten-sg.com (result 127.0.0.13 = challenge-response source)
2dnsbl.ahbl.org (result 127.0.0.14 = denial-of-service attacker)
2dnsbl.ahbl.org (result 127.0.0.10 = shoot on sight spammer)
1dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
1dnsbl.njabl.org (result 127.0.0.8 = open formmail.cgi)
1spamguard.leadmon.net (result 127.0.0.8 = open proxy)
1blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)
1dnsbl.ahbl.org (result 127.0.0.11 = no postmaster or abuse e-mail)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
157422(total number of IP addresses whose names were tested, including 515 at SDSC)
95784(union of all domain zones)
69017rddn.dnsbl.net.au
66707abuse.rfc-ignorant.org
50032dynamic.rhs.mailpolice.com
45332whois.rfc-ignorant.org (union of all results)
29209whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
16123whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
4290webmail.rhs.mailpolice.com
804postmaster.rfc-ignorant.org
543adv.rhs.mailpolice.com
309rhsbl.ahbl.org
298multi.surbl.org
125bulk.rhs.mailpolice.com
90bogusmx.rfc-ignorant.org
86dsn.rfc-ignorant.org (zone not intended for this use)
11porn.rhs.mailpolice.com
4bl.deadbeef.com
1blackhole.securitysage.com
1ex.dnsbl.org

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
94161(total number of domains tested, including 423 at SDSC)
14946(union of all domain zones)
5922whois.rfc-ignorant.org (union of all results)
5120whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
4683abuse.rfc-ignorant.org
2002postmaster.rfc-ignorant.org
1972multi.surbl.org
1902webmail.rhs.mailpolice.com
1241bogusmx.rfc-ignorant.org
1128dsn.rfc-ignorant.org
802whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
571rhsbl.ahbl.org
346porn.rhs.mailpolice.com
241bulk.rhs.mailpolice.com
220adv.rhs.mailpolice.com
184blackhole.securitysage.com
75rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
75rhsbl.sorbs.net (union of all results)
27rddn.dnsbl.net.au (zone not intended for this use)
16ex.dnsbl.org
10dynamic.rhs.mailpolice.com
1fraud.rhs.mailpolice.com
1cart00ney.surriel.com

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 17 November 2006.