Comparison of DNS blacklists
The following table lists technical information for a number of DNS blacklists used for blocking spam.
Blacklist operator | DNS blacklist | Zone | Listing goal | Nomination | Listing lifetime | Notes | Collateral listings | Notifies upon listing |
---|---|---|---|---|---|---|---|---|
Abusix | combined | combined.mail.abusix.zone | Aggregate zone | Aggregate zone | Aggregate Zone | Single lookup that contains results from black, exploit and policy lists. | No | No |
black | black.mail.abusix.zone | Lists individual IP addresses that have sent mail to spam traps. And some manual added netblocks. | Mostly Automatic with some manual additions. | For automated listings 5.6 days after last event, manual additions are permanent. | No | No (but planned) | ||
exploit | exploit.mail.abusix.zone | Lists IP addresses behaving in a way that indicates the IP is compromised, infected, proxy, VPN, TOR, malware, | Automatic | 5.6 days after last event | No | No (but planned) | ||
policy | dynamic.mail.abusix.zone | Lists IP addresses that should not be connecting directly to MX, such as residential IPs etc. | Automatic | Permanent (until delist requested) | Lists ranges that have generic or templated rDNS. Individual IPs can be delisted immediately via web. | No | No | |
dblack | dblack.mail.abusix.zone | Lists domains seen in spam hitting traps. | Automatic | 5.6 days after last event | Can be used as an RHSBL and a URIBL. | No | No (but planned) | |
nod | nod.mail.abusix.zone | Lists domains that are newly observed (first use) | Automatic | 25 hours | Based on historical passive DNS data, lists domains first seen in the wild within the last 25 hours). | No | No | |
shorthash | shorthash.mail.abusix.zone | Lists short URLs (SHA-1 hashed) seen in traps. | Automatic | 5.6 days after last event | Created to handle popular shorteners that are misused to hide domains from blacklisting. | No | No | |
drivehash | drivehash.mail.abusix.zone | Lists URLs of online drive services (SHA-1 hashed) seen in traps. | Automatic | 5.6 days after last event | Current only listing Google Drive and Yandex Disk URLs that are used to avoid domain blacklisting. | No | No | |
Domain expired in early 2020 | ||||||||
Domain expired in early 2020 | ||||||||
ARM Research Labs, LLC GBUdb | Truncate | truncate.gbudb.net | Extremely conservative list of single IP4 addresses that produce exclusively spam/malware as indicated by the GBUdb IP Reputation system. Most systems should be able to safely reject connections based on this list. | Automatic: IPs are added when the GBUdb "cloud" statistics reach a probability figure that indicates 95% of messages produce a spam/malware pattern match and a confidence figure that indicates sufficient data to trust the probability data. | Automatic: Continuous while reputation statistics remain bad. Warning: Produces false positives, and has no remedy/removal process. IPs are dropped quickly if the statistics improve (within an hour). IPs are dropped within 36 hours (typ) if no more messages are seen (dead zombie). | Source data is derived from a global network of Message Sniffer[1] filtering nodes in real-time. Truncate data is updated from statistics every 10 minutes.
Warning: Unreliable, as it produces false positives. It is impossible to find additional information or to manually troubleshoot the problem. It is based on results created by their proprietary software running a proprietary algorithm. |
No | No |
invaluement DNSBL | ivmSIP | Paid access via rsync | Single IP addresses which only send UBE. Specializing in snowshoe spam and other 'under the radar' spams which evade many other DNSBLs. Has FP-level comparable to Zen. | Automatic (upon receipt of a spam to a real person's mailbox), with extensive whitelists and filtering to prevent false positives | Typically an automatic expiration 11 days after the last abuse was seen, but with some exceptions | Spam samples are always kept on file for each listing. Removal requests are manually reviewed and processed without fees. | No | No |
ivmSIP/24 | Paid access via rsync | Lists /24 blocks of IP addresses which usually only send UBE and containing at least several addresses which are confirmed emitters of junk mail. Collateral listings are kept to a minimum because subsections are often carved from /24 listings when spammers and legit senders share the same /24 block. | Automatic once at least several IP addresses from a given block are individually listed on ivmSIP, with extensive whitelists and filtering to prevent false positives | Expiration time increases to many weeks as the fraction of IP addresses in the /24 block in question sending junk mail increases | Removal requests are quickly and manually reviewed and processed without fees. | Yes | No | |
ivmURI | Paid access via rsync | Comparable to uribl.com and surbl.org, this is a list of IP addresses and domains which are used by spammers in the clickable links found in the body of spam messages | Automatic (upon receipt of a spam to a real person's mailbox), with extensive whitelists and filtering to prevent false positives | Typically an automatic expiration several weeks after the last abuse was seen. | Spam samples are always kept on file for each listing. Removal requests are quickly and manually reviewed and processed without fees. | No | No | |
UCEPROTECT-Network | UCEPROTECT Level 1 | dnsbl-1.uceprotect.net (also free available via rsync [3]) |
Single IP addresses that send mail to spamtraps | Automatic by a cluster of more than 60 trapservers [4] | Automatic expiration 7 days after the last abuse was seen, optionally express delisting for a small fee. | UCEPROTECT's primary and the only independent list | No | No |
UCEPROTECT Level 2 | dnsbl-2.uceprotect.net (also free available via rsync [3]) |
Allocations with exceeded UCEPROTECT Level 1 listings | Automatic calculated from UCEPROTECT-Level 1 | Automatic removal as soon as Level 1 listings decrease below Level 2 listing border, optionally express delisting (for a fee) | Fully depending on Level 1 | Yes | No | |
UCEPROTECT Level 3 | dnsbl-3.uceprotect.net (also free available via rsync [3]) |
ASN's with excessive UCEPROTECT Level 1 listings | Automatic calculated from UCEPROTECT-Level 1 | Automatic removal as soon as Level 1 listings decrease below Level 3 listing border, optionally express delisting (fee) | Fully depending on Level 1 | Yes | No | |
Spam and Open Relay Blocking System (SORBS) | dnsbl | dnsbl.sorbs.net | Unsolicited bulk/commercial email senders | N/A (See individual zones) | N/A (See individual zones) | Aggregate zone (all aggregates and what they include are listed on SORBS)[5] | As per component list | Via SORBS Report Manager |
safe.dnsbl | safe.dnsbl.sorbs.net | Unsolicited bulk/commercial email senders | N/A (See individual zones) | N/A (See individual zones) | "Safe" Aggregate zone (all zones in dnsbl.sorbs.net except "recent", "old", "spam" and "escalations") | No | Via SORBS Report Manager | |
http.dnsbl | http.dnsbl.sorbs.net | Open HTTP proxy servers | Feeder servers | Until delisting requested. | No | Via SORBS Report Manager | ||
socks.dnsbl | socks.dnsbl.sorbs.net | Open SOCKS proxy servers | Feeder servers | Until delisting requested. | No | Via SORBS Report Manager | ||
misc.dnsbl | misc.dnsbl.sorbs.net | Additional proxy servers | Feeder servers | Until delisting requested. | Those not already listed in the HTTP or SOCKS databases | No | Via SORBS Report Manager | |
smtp.dnsbl | smtp.dnsbl.sorbs.net | Open SMTP relay servers | Feeder servers | Until delisting requested. | No | Via SORBS Report Manager | ||
web.dnsbl | web.dnsbl.sorbs.net | IP addresses with vulnerabilities that are exploitable by spammers (e.g. FormMail scripts) | Feeder servers | Until delisting requested or Automated Expiry | No | Via SORBS Report Manager | ||
new.spam.dnsbl | new.spam.dnsbl.sorbs.net | Hosts that have sent spam to the admins of SORBS or SORBS Spamtraps in the last 48 hours | SORBS Admin and Spamtrap | Renewed every 20 minutes based inclusion in on 'spam.dnsbl.sorbs.net' | No | Via SORBS Report Manager | ||
recent.spam.dnsbl | recent.spam.dnsbl.sorbs.net | Hosts that have sent spam to the admins of SORBS or SORBS Spamtraps in the last 28 days | SORBS Admin and Spamtrap | Renewed every 20 minutes based inclusion in on 'spam.dnsbl.sorbs.net' | No | Via SORBS Report Manager | ||
old.spam.dnsbl | old.spam.dnsbl.sorbs.net | Hosts that have sent spam to the admins of SORBS or SORBS Spamtraps in the last year | SORBS Admin and Spamtrap | Renewed every 20 minutes based inclusion in on 'spam.dnsbl.sorbs.net' | No | Via SORBS Report Manager | ||
spam.dnsbl | spam.dnsbl.sorbs.net | Hosts that have allegedly sent spam to the admins of SORBS or SORBS Spamtraps at any time | SORBS Admin and Spamtrap. | Until delisting requested. | No | Via SORBS Report Manager | ||
escalations.dnsbl | escalations.dnsbl.sorbs.net | Netblocks of service providers believed to support spammers | SORBS Admin fed. | Until delisting requested and matter resolved. | Service providers are added on receipt of a 'third strike' spam | Yes | Via SORBS Report Manager | |
block.dnsbl | block.dnsbl.sorbs.net | Hosts demanding that they never be tested | Request by host | N/A | No | Via SORBS Report Manager | ||
zombie.dnsbl | zombie.dnsbl.sorbs.net | Hijacked networks | SORBS Admin (manual submission) | Until delisting requested. | No | Via SORBS Report Manager | ||
dul.dnsbl | dul.dnsbl.sorbs.net | Dynamic IP address ranges | SORBS Admin (manual submission) | Until delisting requested. | Not a list of dial-up IP addresses | No | Via SORBS Report Manager | |
noservers.dnsbl | noservers.dnsbl.sorbs.net | No Servers Permitted by ISP Policy | Netblock Owner Administered | Not Applicable. | No Servers Permitted by ISP Policy | No | Via SORBS Report Manager | |
rhsbl | rhsbl.sorbs.net | Aggregate RHS zones | N/A | N/A | No | No | ||
badconf.rhsbl | badconf.rhsbl.sorbs.net | Domains with invalid A or MX records in DNS | Open submission via automated testing page. | Until delisting requested. | No | No | ||
nomail.rhsbl | nomail.rhsbl.sorbs.net | Domains which the owners have confirmed will not be used for sending email | Owner submission | Until delisting requested. | No | No | ||
Spamhaus | SBL Advisory | sbl.spamhaus.org | Verified sources of spam, including spammers and their support services, per policy | Manual | From five minutes to a year or more, depending on issue and resolution | Rarely (escalation) | Yes (partial) | |
XBL Advisory | xbl.spamhaus.org | Illegal third-party exploits (e.g. open proxies, email spambots, malware download sites
and botnets) |
Third-party with automated additions | Varies, under a month, self removal via Composite Blocking List lookup. | Consists of the Composite Blocking List | No | No | |
DBL | dbl.spamhaus.org | Low reputation domains including legitimate domains which have been hacked. | Ranking of over 80 different metrics and machine learning | A few days. Self-removal generally allowed. | {{}} | Rarely | ||
PBL Advisory | pbl.spamhaus.org | Addresses not meant to be initiating SMTP connections, such as residential dynamic IPs | Manual, by providers controlling the IPs or by Spamhaus PBL Team | Self-removal (see spamhaus web site) | Should not be confused with the MAPS DUL and Wirehub Dynablocker lists | No | No | |
ZRD | <key>.dbl.dq.spamhaus.net | Domains registered within the last 24 hours. | Automated | No | No | |||
SBL+XBL | sbl-xbl.spamhaus.org | A single lookup for querying the SBL and XBL databases | As per component list | As per component list | ||||
Zen | zen.spamhaus.org | A single lookup for querying the SBL, XBL and PBL databases. | Preferred list to check all Spamhaus listings with one query. | As per component list | As per component list | |||
CBL | cbl.abuseat.org (also free available rsync access, on request see FAQ [7]) |
Only IP addresses exhibiting characteristics specific to open proxies, spamware, malware downloaders, botnets and the like. | Automatic: large spamtraps, production mail servers and other detection methods. | Less than a month after last listable event, self-removal via CBL lookup. | Use Spamhaus XBL or Spamhaus Zen instead; they include CBL. | No | No | |
IBM DNS Blacklist | Cobion | dnsbl.cobion.com |
This DNSBL zone is part of the default configuration for Proventia Mail Security System and Lotus Protector for Mail Security | No | No | |||
Passive Spam Block List | PSBL | psbl.surriel.com (also free available via rsync ) |
IP addresses used to send spam to trap | spamtraps | Temporary, until spam stops | No | No | |
DNSRBL - DNS Real-time Blackhole List | DNSRBL | dnsrbl.org | IP addresses used to send spam to trap | spamtraps | Temporary, until spam stops | No | No | |
Weighted Private Block List | WPBL | db.wpbl.info | IP addresses used to send UBE to members | spamtraps | Temporary, until spam stops | No | No | |
SpamCop Blocking List | SCBL | bl.spamcop.net | IP addresses which have been used to transmit reported email to SpamCop users | Users submit | Temporary, until spam stops, has self removal | No | Yes (partial) | |
SpamRats | RATS-NoPtr | noptr.spamrats.com | IP addresses detected as abusive at ISP's using MagicMail Servers, with no reverse DNS service | Automatically Submitted | Listed until removed, and reverse DNS configured | Yes | No | |
RATS-Dyna | dyna.spamrats.com | IP addresses detected as abusive at ISP's using MagicMail Servers, with non-conforming reverse DNS service (See Best Practises) indicative of compromised systems | Automatically Submitted | Listed until removed, and reverse DNS set to conform to Best Practises | Yes | No | ||
RATS-Spam | spam.spamrats.com | IP addresses detected as abusive at ISP's using MagicMail Servers, and manually confirmed as spam sources | Manually Submitted | Listed until removed | Yes | No | ||
RATS-Auth | auth.spamrats.com | IP addresses detected probing passwords or authenticating without sending mail | Automatically Submitted | Listed until removed | Yes | No | ||
Junk Email Filter | Hostkarma | hostkarma.junkemailfilter.com |
Detects viruses by behavior using fake high MX and tracking non-use of QUIT | Automated [de]listing | Black list Data lives for 4 days. White list data lives for 10 days. | 127.0.0.1=white 127.0.0.2=black 127.0.0.3=yellow | Yes | No |
Heise Zeitschriften Verlag GmbH & Co. KG, hosted by manitu GmbH | NiX Spam (nixspam) | ix.dnsbl.manitu.net | Lists single IPs (no IP ranges) that send spam to spamtraps. Lists mailhosts, rather than domains, and thus blocks entire hosting providers and ISPs. | Automated listing due to spamtrap hits. Exceptions apply to bounces, NDRs and whitelisted IPs. | 12 hours after last listing or until self delisting | TXT records provide information of listing incident - NiX Spam also provides hashes for fuzzy checksum plugin (iXhash) for SpamAssassin. | No | Yes (for ISPs/ESPs on request) |
inps.de-DNSBL | Site Deactivated by sponsor Christian Jung per http://inps.de/ [12] as seen 2020-05-25 |
|||||||
blocklist.de | dnsbl | bl.blocklist.de | IP-Addresses who Attacks other Server/Honeypots over ssh, imap, smtp, ftp, web, rfi, sqli, ddos.... | Automatic: over Honeypots and with over 515 Users and 630 Servers from blocklist.de via Fail2Ban or own scripts | Automatic: 48 Hours after the last Attack. But earlier remove is available over the Delist-Link | Services are free. Source data is from Honeypot-Systems and over 515 User with 630 Servern there reports Attacks with Fail2Ban | No | Yes |
Yes | No | |||||||
s5h.net Internet Services | s5h.net | all.s5h.net | Spam sources from email, forums, referrer spam and dictionary attacks | Traps | Twelve months unless ISPs request removal earlier | By request. ISPs can provide request exclusion. | Yes | No |
realtimeBLACKLIST.com | RBL | rbl.realtimeblacklist.com | Spam Trap | List of IP addresses that sends spam or causing troubles with botnets or phishing | Until delisting requested. | Removal requests will be investigated and processed within 24 hours of submission. Previously known as IPrange.net RBL Project |
No | No |
James Sawyer | Blocklist | security.jamessawyer.co.uk | Collection of Bad Actors from various sources, Works great with PiHole for personal use. | Spammers, Scammers, Malware, Cryptominers, TOR, botnets, phishing, attackers, harvesters, exfiltration etc. Basically anything and everything "bad" | Until delisting requested. | Removal requests will be investigated. Contact details provided. | Yes | No |
BarracudaCentral | RBL | b.barracudacentral.org | Spam Trap | Provides a list of IP addresses which are sending spam. The Barracuda Reputation system uses automated collection methods to add and delete IP addresses from the BRBL. | Until delisting requested. | Requires registration of administrator and hosts to use. Removal requests are typically investigated and processed within 12 hours of submission if provided with a valid explanation. | No | No |
SPFBL.net | RBL | dnsbl.spfbl.net | Bad reputation, difficult to identify the responsible, dynamic IP, SLAAC flag without genuine email service and inappropriate use of the URL | Provides a list of IPv4/IPv6 addresses and domains which are sending spam or phishing. | Until delisting requested or seven days with good reputation. | The feedback system runs at SMTP layer. See https://spfbl.net/en/feedback | Yes | Yes |
LashBack | UBL | ubl.unsubscore.com | IP addresses which have sent email to addresses harvested from suppression (opt-out) files | Traps | For 30 days after last offending message unless removal is requested | No | No | |
The NordSpam Project | NordSpam IP Blacklist | bl.nordspam.com | IP addresses detected as unsolicited bulk/commercial email senders, webspam | Manual | Until delisting requested. | Removal requests are manually reviewed and processed without fees. | Rarely (escalation) | Sometimes |
NordSpam Domain Blacklist | dbl.nordspam.com | Unsolicited bulk/commercial email senders, webspam | Manual | Until delisting requested. | Removal requests are manually reviewed and processed without fees. | No | Sometimes | |
0Spam Project | DNSBL | 0spam.fusionzero.com | Spam Traps | A single IP(127.0.0.#) is listed upon sending spam to a spam trap, sending from multiple IPs within a range within a short period of time will result in a class C listing(127.0.#.0). | Until an IP owner/authorized admin requests listing removal. | Single IP Listed with Data result 127.0.0.#
Class C IP Block Listed with Data result 127.0.#.0 Codes are as follows: (ie. General spam single IP result 127.0.0.1)
|
No | No |
Brukalai.lt | DNSBL | black.dnsbl.brukalai.lt | IPs and domains for junk mail filtering (aggregate zone). | Mostly automatic with some manual additions. | Until delisting requested. | Yes | No |
Notes
"Collateral Listings" - Deliberately listing non-offending IP addresses, in order to coerce ISPs to take action against spammers under their control.
"Notifies upon listing" - Warns the owner of the IP/Domain when they list an IP. (so owners can take action to fix the problem)
gollark: 🌵world
gollark: \🌵life
gollark: \🌵freedom
gollark: \🌵discrimination
gollark: ⬡⬡🌵
References
- "armresearch.com". armresearch.com. Retrieved 2012-05-06.
- "Archived copy". Archived from the original on 2015-06-23. Retrieved 2015-06-22.CS1 maint: archived copy as title (link)
- UCEPROTECT® abc@uceprotect.org. "UCEPROTECT®-Network - Germanys first Spam protection database". Uceprotect.net. Retrieved 2012-05-06.
- Simpson, Ken. "Getting Onto a Blacklist Without Sending Any Spam". MailChannels Anti-Spam Blog. MailChannels Corporation. Archived from the original on 19 September 2011. Retrieved 16 September 2011.
- "sorbs.net". sorbs.net. Retrieved 2012-05-06.
- "Archived copy". Archived from the original on 2020-01-11. Retrieved 2020-07-26.CS1 maint: archived copy as title (link)
- "The Cbl Faq". Cbl.abuseat.org. 2006-12-31. Archived from the original on 2012-05-11. Retrieved 2012-05-06.
- "Fraudulent DNSBL uncovered: Protected Sky (bad.psky.me)". www.spamhaus.org.
- "Wayback Machine". web.archive.org. March 10, 2010.
- "Archived copy". Archived from the original on 2015-01-28. Retrieved 2015-01-06.CS1 maint: archived copy as title (link)
- "Services - Abusive Hosts Blocking List". 27 April 2007. Archived from the original on 27 April 2007.
- "Archived copy". Archived from the original on 2019-11-21. Retrieved 2020-05-25.CS1 maint: archived copy as title (link)
- Iverson, Al. "Status of megarbl.net: DEAD".
External links
- Blacklist Checker queries the major DNS Blacklists for specific IP address and returns whether it is listed for any malicious activities.
- RBL Check, RBL Check, Multiple & Real-Time
- Blacklists Compared, weekly reports since July 2001 (no new reports since 13 September 2014)
- Intra2net Blacklist Monitor, tracking more than 40 blacklists and giving weekly reports on hits and false positives
- Instant Multiple DNSBL Check Test, Open-to-use, Multiple DNSBL Check Test
- Multi-RBL Checking Tool, Multi-RBL Checker Tool (Check to see if your IP is showing up one or more RBLs)
- RBLTracker DNSBL Monitoring, Automated, Real-Time Black List Monitoring Service.
- SpamAssassin rule statistics, SpamAssassin's rule ham/spam ratios over time.
- List of all RBLs, Information about all existing blacklists including discontinued blacklists.
- Mail Server Blacklist Monitor, Blacklist monitoring service checking 150 blacklists, can be used freely.
- Barracuda Central, Devoted to sharing information with Barracuda Networks customers and the Internet security community.
- WebIron, Dedicated to advanced bot network detection, tracking, blocking and eradication through cleanup and reporting.
- WebSitePulse. Real-time monitoring service ensures the IP a mail server has not fallen into one of the major DNSBL blacklists.
- INPS Comparison of DNS blacklists and whitelists including spam hits, non-spam hits and error rates.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.