IP Blacklist Checker

What DNS blocklists are for

A DNS blocklist, or DNSBL, publishes IP addresses as DNS records so that any server can ask about an address in a few milliseconds. RFC 5782 describes the convention. Reverse the four octets of the address, append the list's zone and look up an A record: for 192.0.2.10 on bl.spamcop.net the name is 10.2.0.192.bl.spamcop.net. An answer inside 127.0.0.0/8, usually 127.0.0.2, means the address is listed. A "no such name" answer means it is not.

Almost all of these lists were built for email. A receiving mail server checks the address that connects to it and rejects, scores or tags the message. A few track something else. DroneBL records hosts abused as IRC drones, DDoS bots and open proxies, with a class code for each, and the dan.me.uk list publishes current Tor exit nodes, which is a fact about the address rather than an accusation.

So read a listing in context. It matters most if you send email from the address. For logging in to websites it is at most an indirect signal: the lists were designed for mail servers, and large platforms lean mainly on their own traffic data and commercial feeds.

Why a shared mobile IP can appear

Mobile carriers usually put many subscribers behind each public IPv4 address with carrier-grade NAT, described in RFC 6888. If one infected phone or router behind that address sends mail to a spamtrap, lists that work from trap hits, such as PSBL, s5h.net and 0spam, can list the shared address, and every other user of it inherits the listing. Home connections have a similar problem after an address is reassigned. The PSBL FAQ points out that a dynamic address may have been used by someone else before you.

Most trap-based listings expire without anyone asking. SpamCop drops an address 24 hours after the last report, and PSBL expires entries after a few weeks without new hits. On a dedicated mobile line you can also move to a new address yourself: Coronium lines change IP from the dashboard, through the API, with a rotation link or on a timer. The new address comes from the carrier's pool and has its own history, so check it again rather than assuming it is clean.

This checker queries UCEPROTECT Level 1 only. Its Level 2 escalates to whole allocations when spam arrives from several addresses in one block, and Level 3 lists every address of an ASN once its spam score passes a threshold. The operator itself says Level 3 will probably cause collateral damage to innocent users. Both levels describe a network, not the address you entered.

How this differs from the reputation check

The IP reputation check looks the address up in IPsum, a daily aggregate of public threat feeds that counts how many feeds name an address, mostly for scanning, brute force and web attacks. This page asks spam and abuse blocklists directly, one zone at a time, at the moment you press the button. They answer different questions, so run both, and read the IP reputation guide for how to weigh them. Commercial fraud scores are a third kind of signal again, covered in what an IPQS fraud score means.

Reading a not checked result

A list can fail to answer for reasons that say nothing about the address. The query may time out after three seconds, the resolver may return an error, or the operator may refuse the query. Some lists refuse queries that arrive through large shared resolvers and answer with a code in 127.255.255.0/24 instead of a result. The checker reports all of these as not checked and never counts them as clean.

When we queried Spamhaus ZEN through a shared resolver on October 30, 2026, it answered 127.255.255.254 even for its own test entry. Spamhaus's fair use policy reserves its public mirrors for non-commercial use and does not accept queries from large shared hosting, so Spamhaus is not part of this check. Look an address up on Spamhaus's own checker instead.

If an address you use is listed

1. Open the list's lookup page from the result and read why the address was listed and when.
2. If you send mail from the address, find the source first: an infected device, an open relay or a script on a server. Delisting before the cause is fixed only buys time.
3. Request removal where the list offers it, or wait for its automatic expiry.
4. On a proxy or mobile line that you do not use for email, move to another address and check that one too.
5. For a server address, ask the hosting provider, which manages the reputation of its ranges.

If logins fail on a particular site, the listing may not be the cause. The IP ban diagnosis guide separates address problems from account and browser problems.