IP Blacklists and Reputation: How to Check, Why IPs Get Listed, and What to Do Next

A freshly bought IP gets blocked right away, outgoing email lands in spam, registrations keep triggering CAPTCHAs. Many people suspect "this IP must be blacklisted." But "blacklist" actually covers several different things, and without separating them you can look in the wrong place and waste effort.

This article sorts out the concepts, gives you checks you can run yourself, and explains how to think about handling a listing.

Three kinds of "bad" to tell apart

1. DNSBLs (DNS-based blocklists). The oldest and most common type, built mainly for email anti-spam. When a mail server receives a message, it checks whether the sending IP appears on a list. Spamhaus's lists are the well-known example. The lists differ in nature: some list IPs that actually sent spam or were compromised, while others (such as Spamhaus's PBL) list end-user IP ranges that "should not send mail directly." These mean completely different things.

2. Commercial IP reputation scores. Some risk vendors combine proxy detection, abuse history and network type into a score. Each model is proprietary and they don't agree with each other.

3. A platform's internal risk control. Each platform has its own undisclosed system. Whether it consults public blocklists, and how much, is not officially stated, so don't assume.

So before saying "this IP is blacklisted," ask: blacklisted by which kind?

Why an IP becomes "dirty"

• A previous user abused it. Second-hand IPs, recycled and reallocated IPs, and repeatedly sublet IPs can inherit a bad history.
• Neighbors drag it down. If someone in the same subnet sends large volumes of spam or launches attacks, the whole block may be flagged together.
• Your own device has a problem. An infected computer or router sending spam or joining attacks without you knowing.
• Shared exits. Public proxies and shared mobile exits mean any user's behavior affects the IP; see CGNAT and Shared IPs.
• The datacenter IP itself. Datacenter IPs are often used in bulk for automation, so their reputation is generally lower; see Datacenter vs Residential IP.

How to check

Query a DNSBL manually

The principle is to reverse the four octets of the IP and append the list's domain for a DNS lookup. To check whether 203.0.113.5 is on Spamhaus's ZEN list:

dig +short 5.113.0.203.zen.spamhaus.org

How to read the result:

• An address of the form 127.0.0.x: the IP is listed, and the last number identifies the list type.
• No output (NXDOMAIN): the IP is not listed.
• An address like 127.255.255.x: this usually does not mean "listed." It means the query was refused, commonly because you used a public DNS resolver or sent too many queries. Switch to your own resolver and don't draw conclusions from it.

Also note that Spamhaus and others restrict commercial use and high-volume queries in their terms, so read them before running bulk checks.

Compare multiple sources with online tools

Many sites check several lists and reputation databases at once. Use at least two sources, because each has a different methodology, and a single source saying "clean" or "problem" shouldn't be fully trusted.

What ipscoper can and can't do

To be clear: ipscoper does not check blocklists and cannot see an IP's abuse history. Our risk value is a heuristic estimate based on ASN and carrier naming. It reflects whether an IP looks like a datacenter, with limits described on the methodology page. Use the IP lookup to see the network type and ASN first, then pair it with a dedicated blocklist checker.

What to do after a listing

1. Confirm the cause. Email abuse, a compromised device, or collateral listing of the whole block? Each calls for a different fix.
2. Clean up the source. Run a full malware scan, close unnecessary open services (open mail relays, exposed admin ports) and change leaked passwords. If the source isn't cleaned, a delisting will be reversed quickly.
3. Follow each list's removal process. Most lists have a public removal page that explains the conditions. Some allow self-service removal, others require remediation first.
4. For leased IPs, go to your provider. Individuals often lack the authority, so the provider should handle it, or you should switch.
5. Some listings expire on their own. For a minor problem that has already stopped, waiting is an option, but it depends on that list's rules.

If a newly bought IP is already problematic, the most cost-effective move is usually to replace it, not spend time cleaning it.

What this means for account operations

No platform has said publicly whether it uses public blocklists, so we don't make claims either way. In practical terms, though, treat it as a variable to rule out. An IP with problems in both blocklists and reputation databases often has other risks at the same time (network type, how widely it is shared, past use), so it isn't a good investment for important accounts.

Checklist before buying or switching an IP

• Check the network type and ASN, and confirm it is the type you want.
• Check DNSBLs and at least two reputation sources.
• Ask whether the IP is dedicated or shared, and whether it is second-hand.
• Trial it or test at small scale before committing heavily.
• Compare the result against the 5-Point Checklist Before Buying an IP.

Summary

"Blacklisted" isn't one state. It is several different things. Work out which one you face, then choose the matching check and fix. That is the least effort. An IP's reputation is only one part of the environment. For the overall approach, see How to Systematically Check Your Network and Device Environment When a TikTok Account Is Restricted, and for what risk scores mean, see IP Risk Score Explained.