Blacklists Compared

7 April 2007

[ Fighting Spam | Dialup Zones | Blacklists Compared | Current Blacklist Comparison | Sendmail Configuration ]

Survey results for all known public IP-based DNS blacklists. Lookups were done on connecting IP addresses. The "union of most IP zones" line excludes the exemptions.ahbl.org, query.bondedsender.org, list.dnswl.org, accredit.habeas.com, iadb.isipp.com, and iadb2.isipp.com zones because they are not blacklists.

HitsDNS Zone
124216(total number of IP addresses tested, including 491 at SDSC)
116254(union of most IP zones)
94340t1.dnsbl.net.au
93256zen.spamhaus.org (union of all results)
70702dnsbl.sorbs.net (union of all results)
70011sbl-xbl.spamhaus.org (union of all results)
69460xbl.spamhaus.org (union of all results)
69092cbl.abuseat.org
69066sbl-xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
69061xbl.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
69058zen.spamhaus.org (result 127.0.0.4 = Composite Blocking List)
66031no-more-funn.moensted.dk (union of all results)
62074dnsbl.tqmcube.com (union of all results)
61735dynablock.njabl.org
61735pbl.spamhaus.org (union of all results)
56652blackholes.five-ten-sg.com (union of all results)
55935zen.spamhaus.org (result 127.0.0.11 = Spamhaus PBL, Spamhaus entry)
55935pbl.spamhaus.org (result 127.0.0.11 = Spamhaus entry)
53815dnsbl.sorbs.net (result 127.0.0.10 = dialup)
51891blackholes.five-ten-sg.com (result 127.0.0.2 = spam source)
45026no-more-funn.moensted.dk (result 127.0.0.3 = dialup)
43269psbl.surriel.com
40981dnsbl-1.uceprotect.net
38722dnsbl.tqmcube.com (result 127.0.0.2 = dialup)
32335dnsbl-2.uceprotect.net
24468dnsbl.sorbs.net (result 127.0.0.7 = hacked/vulnerable)
19965bl.spamcop.net
17817db.wpbl.info
16862dnsbl-3.uceprotect.net
14823no-more-funn.moensted.dk (result 127.0.0.2 = spam source)
14593dnsbl.tqmcube.com (result 127.0.0.3 = spam source)
12048unconfirmed.dsbl.org
11969list.dsbl.org
11917dsbl.dnsbl.net.au
9695dnsbl.tqmcube.com (result 127.0.0.5 = China)
8419cn-kr.blackholes.us (result 127.0.0.2 = China)
8419cn-kr.blackholes.us (union of all results)
8348mail-abuse.blacklist.jippg.org
8117ix.dnsbl.manitu.net
8073ubl.unsubscore.com
6153korea.services.net
6122dnsbl.tqmcube.com (result 127.0.0.4 = South Korea)
5960no-more-funn.moensted.dk (result 127.0.0.10 = open proxy)
5819zen.spamhaus.org (result 127.0.0.10 = Spamhaus PBL, ISP contributed)
5819pbl.spamhaus.org (result 127.0.0.10 = ISP contributed)
5653blacklist.spambag.org
5574unsure.nether.net
5376china.blackholes.us
4933sbl.csma.biz
4896combined-hib.dnsiplists.completewhois.com (union of all results)
4880combined-hib.dnsiplists.completewhois.com (result 127.0.0.4 = bad whois data)
4765tr.countries.nerd.dk
4526turkey.blackholes.us
3688blackholes.five-ten-sg.com (result 127.0.0.9 = misc)
3565rmst.dnsbl.net.au
3538dnsbl.njabl.org (union of all results)
3161dnsbl.njabl.org (result 127.0.0.9 = open proxy)
3131korea.blackholes.us
2727dnsbl.sorbs.net (result 127.0.0.6 = spam source)
2377bl.spamcannibal.org
2205dnsbl.ahbl.org (union of all results)
2106dnsbl.ahbl.org (result 127.0.0.3 = open proxy)
2103spamsources.fabel.dk
1929russia.blackholes.us
1583zen.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
1583xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
1583sbl-xbl.spamhaus.org (result 127.0.0.5 = time-expired NJABL open proxy)
1523list.dnswl.org (not a blacklist!)
1098probes.dnsbl.net.au
953blackholes.five-ten-sg.com (result 127.0.0.4 = unconfirmed opt-in)
907japan.blackholes.us
880taiwan.blackholes.us
765malaysia.blackholes.us
716zen.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
716sbl-xbl.spamhaus.org (result 127.0.0.2 = Spamhaus SBL)
716sbl.spamhaus.org
639thailand.blackholes.us
601dnsbl.sorbs.net (result 127.0.0.2 = open http proxy)
474dnsbl.sorbs.net (result 127.0.0.3 = open socks proxy)
398blackholes.uceb.org (union of all results)
350blackholes.uceb.org (result 127.0.0.6 = spam haven)
318argentina.blackholes.us
293hongkong.blackholes.us
279no-more-funn.moensted.dk (result 127.0.0.7 = spam haven)
267bl.csma.biz
257l2.apews.dnsbl.uceprotect.net
207blackholes.uceb.org (result 127.0.0.3 = spam source)
205no-more-funn.moensted.dk (result 127.0.0.9 = misc)
201dnsbl.njabl.org (result 127.0.0.2 = open relay)
188singapore.blackholes.us
176dnsbl.njabl.org (result 127.0.0.4 = spam source)
161work.drbl.croco.net
158query.bondedsender.org (not a blacklist!)
127iadb2.isipp.com (not a blacklist!)
127accredit.habeas.com (not a blacklist!)
123iadb.isipp.com (not a blacklist!)
119bl.deadbeef.com
91spam.wytnij.to
81flowgoaway.com
72blackholes.five-ten-sg.com (result 127.0.0.7 = spam haven)
58multihop.dsbl.org
56dnsbl.ahbl.org (result 127.0.0.4 = spam source)
46dnsbl.sorbs.net (result 127.0.0.4 = open proxy)
46blackholes.five-ten-sg.com (result 127.0.0.12 = spam-friendly freemail provider)
36tor.dnsbl.sectoor.de (result 127.0.0.2 = /24 contains a Tor server)
36tor.dnsbl.sectoor.de (union of all results)
33blackholes.uceb.org (result 127.0.0.5 = dialup)
28ohps.dnsbl.net.au
28dnsbl.ahbl.org (result 127.0.0.7 = spam haven)
26exemptions.ahbl.org (not a blacklist!)
22mexico.blackholes.us
20relays.nether.net
18multi.surbl.org
16osps.dnsbl.net.au
16combined-hib.dnsiplists.completewhois.com (result 127.0.0.2 = unallocated IP address)
14osrs.dnsbl.net.au
9nigeria.blackholes.us
9rdts.dnsbl.net.au
9dnsbl.ahbl.org (result 127.0.0.19 = open proxy test zone)
8dnsbl.ahbl.org (result 127.0.0.15 = open relay)
7spamguard.leadmon.net (union of all results)
6blackholes.brainerd.net
5brazil.blackholes.us
5spamguard.leadmon.net (result 127.0.0.7 = spam source netblock)
4multi.uribl.com (result 127.0.0.2 = spam resource)
4dnsbl.sorbs.net (result 127.0.0.9 = zombie network)
4multi.uribl.com (union of all results)
2blackholes.uceb.org (result 127.0.0.2 = open relay)
2spamguard.leadmon.net (result 127.0.0.3 = spam source)
1dnsbl.sorbs.net (result 127.0.0.5 = open relay)
1owps.dnsbl.net.au
1spamsites.dnsbl.net.au
1omrs.dnsbl.net.au
1no-more-funn.moensted.dk (result 127.0.0.4 = unconfirmed opt-in)
1blackholes.five-ten-sg.com (result 127.0.0.6 = open relay)
1blackholes.five-ten-sg.com (result 127.0.0.5 = relay output)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on the domain names of connecting IP addresses.

HitsDNS Zone
124216(total number of IP addresses whose names were tested, including 491 at SDSC)
72405(union of all domain zones)
50996rddn.dnsbl.net.au
47441abuse.rfc-ignorant.org
44737l1.apews.rhsbl.uceprotect.net
34538dynamic.rhs.mailpolice.com
24610whois.rfc-ignorant.org (union of all results)
13753whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
10857whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
4291webmail.rhs.mailpolice.com
521postmaster.rfc-ignorant.org
495adv.rhs.mailpolice.com
447multi.surbl.org
342multi.uribl.com (union of all results)
338multi.uribl.com (result 127.0.0.2 = spam resource)
150bl.deadbeef.com
120rhsbl.ahbl.org
89rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
89rhsbl.sorbs.net (union of all results)
87bulk.rhs.mailpolice.com
62dsn.rfc-ignorant.org (zone not intended for this use)
61bogusmx.rfc-ignorant.org
14porn.rhs.mailpolice.com
2multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
2multi.uribl.com (result 127.0.0.4 = opt-out spam resource)

Survey results for all known public domain-name-based DNS blacklists. Lookups were done on SMTP sender domains.

HitsDNS Zone
65441(total number of domains tested, including 459 at SDSC)
12900(union of all domain zones)
4833whois.rfc-ignorant.org (union of all results)
4264whois.rfc-ignorant.org (result 127.0.0.7 = no whois data at all)
3532abuse.rfc-ignorant.org
2109multi.surbl.org
1669multi.uribl.com (union of all results)
1613multi.uribl.com (result 127.0.0.2 = spam resource)
1611postmaster.rfc-ignorant.org
1358webmail.rhs.mailpolice.com
1031bogusmx.rfc-ignorant.org
778dsn.rfc-ignorant.org
569whois.rfc-ignorant.org (result 127.0.0.5 = bad whois data)
404l1.apews.rhsbl.uceprotect.net
292porn.rhs.mailpolice.com
281rhsbl.ahbl.org
189bulk.rhs.mailpolice.com
182adv.rhs.mailpolice.com
83rhsbl.sorbs.net (result 127.0.0.11 = domain uses bad address space)
83rhsbl.sorbs.net (union of all results)
50multi.uribl.com (result 127.0.0.4 = opt-out spam resource)
37rddn.dnsbl.net.au (zone not intended for this use)
15dynamic.rhs.mailpolice.com
13ex.dnsbl.org
6multi.uribl.com (result 127.0.0.8 = new domain or concealed contact)
2bl.deadbeef.com
1cart00ney.surriel.com

This document was last updated by Jeff Makey <jeff@sdsc.edu> on 13 April 2007.