Every IP address on the internet carries a reputation — a rolling assessment of "does traffic from here usually behave or misbehave." Mail servers use it to decide whether to accept your email; CDNs use it to decide whether to challenge with a CAPTCHA; corporate firewalls use it to decide whether to drop your connection on the floor.
If a service is silently refusing connections from one of your IPs, the most common explanation is reputation, not a router config or DNS issue.
How reputation is built
Reputation scoring is a black box at each operator, but the inputs are pretty consistent:
- Spam reports. A user clicks "junk" on an email; the address ends up on the sender's IP scoreboard. Big mail providers (Gmail, Microsoft, Yahoo) operate enormous private versions of this.
- Honey pot traps. Hidden email addresses, hidden URLs, hidden form submissions. Anything that contacts a honey pot is, by definition, scraping or attacking.
- Authentication failures. SSH brute-force attempts, repeated WordPress login fails, oversized header probes. fail2ban-style detectors aggregate.
- Connection patterns. Massive parallel requests, residential IPs sending mail (genuinely suspicious — most home networks don't), TOR exits, known proxy/VPN ranges, hosting-provider blocks (datacenter IPs sending consumer-style traffic).
- Allocation-block bad neighbours. Bad behaviour on adjacent IPs in the same /24 raises suspicion for the whole block — especially common with cheaper VPS and residential-proxy providers.
The blocklists that actually matter
- Spamhaus — the bedrock for email. SBL (snowshoe spammers), CSS (compromised hosts), PBL (residential / dynamic ranges that shouldn't be sending mail), XBL (malware infections). If you're on Spamhaus, your email is going nowhere.
- Composite Blocking List (CBL) — botnet-traffic listings, included in XBL.
- SORBS — older, broader, less authoritative. Still widely consulted.
- Project Honey Pot — comment-spam and harvester focus. The HTTPBL is where most "is this IP a spammer?" lookups end up for web traffic.
- AbuseIPDB — crowdsourced abuse reports, queryable via API. Useful for security teams.
- Cloud-provider lists. Cloudflare's threat-score, AWS WAF, Akamai's managed lists — all internal to the operator, but they affect a lot of traffic.
How to check whether you're listed
For mail-focused lookups, MXToolbox's blacklist check queries ~80 RBLs simultaneously. For broader threat intel, AbuseIPDB shows reports filed against an IP, and Shodan shows what services the IP is exposing.
Most blocklists publish a "why is my IP listed" lookup URL. Spamhaus' is check.spamhaus.org.
Getting delisted
- Fix the underlying problem first. If you got listed for botnet activity, your endpoint is compromised. Listings will return immediately if the cause isn't resolved.
- Submit the delisting request. Each blocklist has its own form. Spamhaus is usually a same-day automated process if the listing is automated; manual ones take longer.
- Warm up the IP carefully. If you're a new sender (just rented a fresh VPS, configured a new mail server), Gmail and Microsoft will treat you as suspicious until you've sent a few hundred legitimate, opened emails. Don't blast a 10k newsletter on day one.
- Set up SPF, DKIM, and DMARC. Without all three, modern mail providers treat you as junk by default. The DMARC record published in DNS lets you receive reports on who is rejecting your mail.
Checking an IP yourself
IPFerret surfaces a few reputation signals on its home page when the geo provider supplies them — the "Privacy" flags from ipinfo cover VPN / proxy / Tor / hosting / relay. For deeper checks:
- /whois/<ip> gives you the abuse contact for the allocation — that's the address responsible parties answer to.
- /asn/<asn> tells you who operates the entire range; bad neighbours often share a network operator.
- External blocklist checks (MXToolbox, AbuseIPDB) for the actual reputation signal.
Reputation is sticky. The further upstream the listing — Tier-1 transit, major CDN — the longer the cleanup. Move email to a dedicated, reputable sender (SendGrid, Postmark, AWS SES with a dedicated IP) if your own IP is poisoned and you can't wait.