IP blacklist check

Your own address is checked when the page loads; enter any IPv4 or IPv6 address to check another one (a mail server, a VPN exit, a new cloud instance). Results are cached for ten minutes; every row shows when it was checked.

One row per list: the operator, what the list tracks (spam sources, open proxies, attack sources), the result and, for listings, the return code with its documented meaning and a link to the delisting page.

The list contains your address. The return code tells you why — a spam trap hit, a compromised machine, an open proxy, an ASN-wide policy listing. Two of the UCEPROTECT levels list whole network ranges and whole providers; we show those as informational because they describe your provider, not your address.

The list answered and your address is not in it. Note that we query ten lists chosen because their operators allow free public queries; a site that uses a commercial list (Spamhaus, for example) may still see a listing we cannot show.

The list did not answer, refused our resolver, or we hit its query limit. This is reported as an error, never as a listing, and the row says what happened.

An address is listed because the list operator observed something from it: spam delivered to a spam trap, connections to a botnet controller, brute-force logins reported by other servers, an open proxy or relay. Often the cause is not you.

Home and mobile addresses are reassigned constantly, and behind carrier-grade NAT thousands of people share one address. A listing on such an address usually reflects a previous user or a neighbor's infected device. Reconnecting for a new address is the practical fix; some lists (policy lists of dynamic ranges) list the whole range by design and only matter if you try to run a mail server from it.

For a server that sends mail, a listing is serious and almost always has a concrete cause: a compromised account sending spam, a web form being abused, a misconfigured relay, missing reverse DNS or SPF/DKIM. Fix the cause first; a delisting without a fix is reverted within days.

Each operator runs its own process; there is no central place to delist.

1. Open the delisting link in the result row. 2) Fix the cause before you ask — most forms require you to confirm that. 3) Submit the address; many lists (PSBL, SpamCop, blocklist.de) delist automatically after a period without new reports, others want a form or an email. 4) Re-run this check after the time the operator states; cached results refresh after ten minutes. The guide how to get your IP off a blacklist walks through each of the ten lists.

Blocklists are one input into IP reputation, the trust score mail servers, websites and fraud systems assign to an address. Other inputs are the network type (hosting addresses start with less trust), the age and consistency of the address's traffic, and whether it appears in attack telemetry. A clean result here does not guarantee a good reputation everywhere, but a listing here guarantees a bad one somewhere. The IP fraud score combines the signals we can see into one number with a published formula.