Selected sources

IP Blacklist Checker

Check a public IPv4 address against selected blacklist and reputation sources with source-by-source results.

By: Katia Belokon · Updated October 21, 2026

MyIPScan only reports what the configured sources return. A "not listed" result means not listed on the checked sources, not a guarantee that an IP is safe.

Lookup

Check an IP

Ready

Current IP: Loading...

Direct answer

IP Blacklist Checker: the short answer

An IP blacklist (DNSBL) lists addresses seen sending spam or malware, and mail servers and firewalls check it before accepting traffic. This checker queries three sources: the SpamCop blocking list, blocklist.de and abuse.ch Feodo Tracker. A clean result covers those three lists, not the many others in use.

Results

Blacklist check

Enter a public IPv4 address to check selected blacklist sources.

Checked at: Not checked yet

Providers checked

Provider details appear after a lookup.

What to fix before requesting delisting

Delisting works best when the root cause is gone. Spamhaus's listing removal guidance starts with checking the affected IP or domain and following the instructions for the specific listing. That is a better path than sending repeated vague requests.

For home users: reboot only after checking for malware, unknown devices, exposed services, and router issues. A new dynamic IP can help, but it does not clean an infected device.
For VPN users: switch server if a shared exit IP is blocked, but also check whether the website is blocking VPN ranges by policy.
For server owners: patch software, close open relays, remove compromised scripts, check outbound mail logs, and rotate exposed credentials.
For mail senders: verify SPF, DKIM, DMARC, PTR/rDNS, HELO/EHLO name, bounce handling, complaint rate, and sending volume.
For business networks: review firewall logs, endpoint alerts, NAT logs, and any new automation that could look abusive.

Email-specific checklist

If the problem is email delivery, treat it as a mail-authentication and sender-reputation issue, not just a blacklist checkbox. The standards behind common authentication include SPF in RFC 7208, DKIM in RFC 6376, and DMARC in RFC 7489.

Make sure SPF includes only legitimate sending systems and avoids reckless mechanisms.
Sign mail with DKIM and confirm the selector is published correctly in DNS.
Publish DMARC, monitor reports, and move policy gradually if you are not ready for enforcement.
Set PTR/reverse DNS for dedicated mail servers where your provider supports it.
Confirm the HELO/EHLO name, sending domain, and reverse DNS make sense together.
Stop compromised scripts, form abuse, or unexpected outbound bursts before requesting removal.

How to write a delisting request

Use the list owner's process. If Microsoft 365 recipients are rejecting mail, Microsoft's external sender delist guidance explains its portal-based process for blocked senders. Other lists have their own forms, timing, and evidence requirements.

A good request is short and specific:

State the IP address and the exact list or error message.
Explain the root cause you found, if known.
List the fixes already completed.
Include relevant timestamps, bounce codes, or log summaries.
Avoid blame, threats, or repeated duplicate tickets.

Do not claim the problem is fixed if you only changed the IP. If the same compromised sender or open relay keeps running, the next address can be listed too.

Limitations

Only selected sources are checked.
Not listed does not guarantee an IP is safe.
Listed does not always prove malicious activity.
Blacklist and reputation databases can be stale or incomplete.
IPv6 support depends on provider coverage.

Want the full picture? Run the Privacy Exposure Report.

Combine IP, WebRTC, IPv6, DNS leak, fingerprint, user-agent, and related privacy signals in one report.

Run report Scan website Check email exposure

Related tools

Continue the privacy check

Domain Intelligence ReportReview bounded domain reputation context alongside DNS, RDAP, ASN, and PTR hints. VPN Leak TestCompare IP, DNS, WebRTC, IPv6, and browser signals. IP Geolocation LookupReview approximate network location fields. ASN LookupSee network ownership and route context. Blacklist GuideLearn how blacklist checks and delisting usually work.

How the report is built

Email domain diagnostics

Email checks connect MX, SPF, DMARC, optional DKIM selector records, PTR/rDNS, sender-IP context, blacklist context, and email-header evidence.

How these reports are structured, and how to share them safely

SummaryStart with a plain-language status for the public target.

Top issuesPrioritize the few findings that need attention first.

What passedShow expected public signals without turning them into a certification.

What needs reviewSeparate limited, unavailable, and review-worthy signals.

Why it mattersExplain the business, delivery, crawl, or implementation impact.

Recommended fixesPoint to the DNS, hosting, email, CMS, or SEO owner who can act.

What this tool cannot checkThis does not send mail, inspect private mailboxes, guarantee inbox placement, or certify sender reputation everywhere.

Client-safe copyClient-safe copy should keep authentication findings and fixes while removing email local-parts, raw TXT payloads, raw sender IP details, and private mailbox context.

Monitoring beta (optional)Optional monitoring beta can compare MX, SPF, DKIM selector checks, DMARC policy, PTR/rDNS, and selected blacklist signals for approved domains.

Client-safe report

Share findings without leaking raw technical material

Use Safe Copy or this page's summary when sending results to a client, vendor, developer, or support team. Raw headers, credentials, tokens, cookies, private addresses, email local-parts, and oversized payloads should stay out of client-facing copy.

Review Safe Copy Ask about monitoring beta

About this checkWhat it checks, what it cannot, and how to read it

Check my browser/privacy

What this checks

Visible browser/session signals such as public route, DNS/WebRTC/IPv6 behavior, fingerprint traits, user-agent, or public IP context.

Limits

What this cannot check

It cannot certify anonymity, inspect every app, or prove that a VPN, ISP, device, or account is safe.

Read results

How to use the output

Treat results as review signals for this browser/session or public target. Re-test after one change, then use Safe Copy or notes that avoid raw identifiers.

Quick reference

IP Blacklist Checker: what this tool does

Checks limited IP reputation and blacklist signals for public IP addresses.

How to use

Enter one public IPv4 address, or use the current-IP button.
Read the per-source row rather than the headline verdict.
Take a listing up with the listing source, which is the only party that can remove it.

What the result means

The address is checked against three sources: the SpamCop blocking list, blocklist.de and abuse.ch Feodo Tracker. A listing means one of them has a record for the address now. No listing means those three had nothing, which says nothing about the many other lists in use.

Known limitations

Selected sources only, so a not-listed result is not a clean bill of reputation across the internet.
A listing is not proof of malicious activity. Shared, dynamic and carrier-NAT addresses are listed for their neighbours' behaviour.
IPv6 is rejected rather than guessed at; the three sources are queried for IPv4 only.

IP Blacklist Checker — Common Questions

Why would my IP be blacklisted?

The most common causes: a device on your network sent spam emails, your IP was used in a brute-force attack, malware ran on a connected device and triggered abuse reports, your IP block was previously owned by a spammer, or your residential IP shares a range with flagged addresses. Dynamic IPs (most home connections) rotate over time, so you may inherit a previously blacklisted address. Static IPs (business connections) stay flagged until you request delisting.

My IP is blacklisted — what do I do?

1. Find which list flagged it — each blacklist has its own removal process. 2. Identify and fix the cause (scan for malware, secure open email relays, check for compromised accounts). 3. Submit a delisting request to each list directly — most have a web form. Major lists: Spamhaus, Barracuda, SpamCop. 4. Retest the next day. SpamCop drops a listing 24 hours after the last report and blocklist.de 48 hours after the last attack; other lists need a removal request.

Does an IP blacklist affect my website or email?

A blacklisted sending IP will cause emails to be rejected or sent to spam by mail servers that check that list. Website IP blacklisting is less common but can cause some security services, firewalls, and CDN rules to block requests. If your site is behind Cloudflare or another CDN, the CDN's IP shows to visitors — your origin IP blacklisting matters mainly for server-to-server communications and email.

How often do blacklists update?

Each list sets its own timing. SpamCop removes an address 24 hours after the last spam report; blocklist.de keeps it 48 hours after the last reported attack and applies a delisting request within an hour; Feodo Tracker rebuilds its list every 5 minutes and holds only recently active botnet servers. If you have fixed the cause, check again after a day. Persistent listings usually mean the root cause (malware, open relay, compromised account) is not fully resolved.

Next checks and references

IP and Network ToolsParent hub for this tool category.What Is My IPCurrent public IP and basic exposure summary.Tor Exit Node CheckTor exit list lookup.ASN LookupASN and network prefix lookup.Relevant guideBackground reading for interpreting this result.MethodologyHow MyIPScan labels confidence, limits, and safe-copy outputs.