- There are many blacklists, and each one answers its own question: spam, fraud, proxies or breaking a website's rules
- A listing in a spam database (DNSBL) matters for mail servers and barely affects ordinary browsing
- A home IP is cleaned in three steps: find the cause, submit a removal request and, if needed, write to your provider
- With proxies it is simpler: the pool is shared, and a "dirty" address only needs to be swapped for another
- The anonymity filter in the pool settings cuts out addresses websites have already marked as proxy or VPN
A website suddenly asks for a captcha at every step, your emails go to spam, and a sign-up form returns an error. A common reason is that your IP has ended up on a blacklist. It sounds scary, but in most cases it can be fixed in an evening.
Below: what kinds of blacklists exist, how to check an address, how to understand the result and what to do with a home IP and with a proxy address.
What an IP blacklist is
An IP address is the number of your internet connection. A blacklist is a database of addresses that something bad came from in the past: spam, attacks, fraud or simply too many requests. Websites and mail servers check against these databases and decide whether to let a request through.
There is no single list. There are dozens of databases, each with its own rules for listing and removal. So the same address can be clean in one database and marked in another.
Three kinds of lists worth telling apart
Spam databases (DNSBL). They are run by organizations that fight spam. A mail server receives an email, checks the sender's address in a DNSBL and, if the address is there, rejects the email or puts it in spam. Ordinary websites rarely read these databases.
Risk scores and proxy detectors. These are commercial and public databases that give an address a risk score (fraud score) and a label: home, mobile, datacenter, proxy or VPN. They are used by stores, payment forms, social networks and ad systems. They are most often behind captchas and refused logins.
A website's internal lists. Large platforms keep their own databases. If there were many failed logins or suspicious actions from an address, the website restricts it by itself. You cannot see such a ban from the outside, only through the website's behavior.
| Kind of list | Who uses it | What it gets in the way of | How to check |
|---|---|---|---|
| Spam database (DNSBL) | Mail servers | Sending email from your own server | Spamhaus, MXToolbox |
| Risk score, proxy/VPN label | Stores, social networks, payment forms | Logging into accounts, signing up, paying | IP reputation check services |
| Abuse reports | Server administrators | Access to individual websites and servers | AbuseIPDB |
| A website's internal ban | A specific platform | Only this website | Cannot be checked from the outside |
How to check your address
- Find out which IP websites see. Open the my IP page: it will show the address and country.
- Check the address in spam databases. The Spamhaus check and the MXToolbox blacklist check run the address through many DNSBLs at once.
- Look at reports in AbuseIPDB. It shows whether administrators reported attacks or scanning from this address, and when.
- Check the reputation in one or two IP scoring services. They will show the address type, the risk score and a proxy or VPN label. You can also look up the country, city and provider (ASN) of any address with our IP lookup.
- If you are checking a proxy, first make sure it works and returns the right address: the proxy checker is there for that.
Check in several places. Databases update at different speeds, and one may have already removed an entry while another still keeps it.
How to read the result
A DNSBL listing. If you do not run your own mail server, this means almost nothing for browsing websites. But it is a signal: spam was sent from the address. Sometimes it is an infected device in your home network, sometimes a neighbor on the same address at your provider.
A high risk score. This is a reason for captchas and extra checks. The score is made up of reports, the address type and the request history. The same address can get different scores in different services, so look at the overall picture.
A "proxy" or "VPN" label. The website sees that the request is not coming directly. For datacenter addresses this is normal: they are issued by a network owner with an ASN number known as hosting. For a home address, such a label means that someone else's traffic has already gone through it.
The whole subnet is marked. Sometimes a database marks not one address but a whole subnet. Then it is not about you: neighboring addresses in the same block are marked the same way.
What to do if your home IP is on a list
Find the cause. Scan the devices on your network with an antivirus, change your router password and update its firmware. An infected computer or camera can quietly send spam. Until the cause is removed, removal from the database will not help: the address will end up there again.
Submit a removal request. Most databases have a delisting form on their website. Enter the address and briefly explain that you found and fixed the problem. Some databases remove the entry by themselves after a while if there are no more reports.
Write to your provider. If the whole subnet is listed or the address keeps ending up in the database through no fault of yours, that is a question for your provider. Kyivstar, Vodafone Ukraine, lifecell and home internet providers have support teams that can check the address block.
Get a new address. If your IP is dynamic, restart your router or turn it off for a few minutes. The provider often gives you a different address. On mobile internet, turning airplane mode on and off is enough.
What to do if a proxy address is on a list
With proxies it is all simpler. In Prokso the pool is shared: another client may have used the address before you, and its history may have ended up in databases. You do not need to clean such an address: it is enough to change it.
- On ports 823 (HTTP) and 824 (SOCKS5), a new IP is issued for every request, so a marked address simply will not come up again.
- If you need one address for a while, take a different port from the 10000-20000 range: each port holds its own sticky IP.
- Turn on the anonymity filter in the pool settings. It cuts out addresses websites have already marked as proxy or VPN.
- Before an important action, check the address with the same services as a home one, and change the port if the result is bad.
Keep in mind that a sticky address of residential or mobile proxies may change earlier than planned if the device goes offline. The port then gets a new IP in the same country, and it is also worth checking if the task is sensitive.
Why a clean IP is not everything
Even with an address that has no listings at all, a website may show a captcha. It looks at the browser, cookies, language, time zone and the speed of your actions. If the address is from Poland but the browser's time zone is Kyiv, that stands out.
Check what the website sees on the my IP page: the address, country and WebRTC. Do not open dozens of pages per second from one address. And remember: no proxy guarantees that a website will not block your login; it only removes the problem of an address's bad history.
Common mistakes when checking
Panicking over one listing. Services run an address through a hundred databases, and one or two listings in little-known lists are common. Look at what the database is and who reads it. A listing in a small spam list has almost no effect on logging into a social network.
Checking the wrong address. If you have a VPN or a proxy turned on in your browser, the service will check that one, not your home IP. Before checking, make sure which address websites see right now.
Submitting another removal request without fixing the cause. Databases remember that the address has already been removed. If the spam continues, the next request may be rejected or put in a long queue. First find the source, then write to the database.
Expecting a proxy to fix everything. A clean address only removes the question of the IP's history. If an account has already been flagged by a platform, changing the address will not restore it by itself.
A short plan for the future
- Check your home address once a month if you have your own mail server or store.
- Keep your router and devices updated: this is the main protection against emails being sent without your knowledge.
- For proxies, choose the mode for the task: rotation for data collection, a sticky address for accounts.
- Keep a simple list of addresses that failed the check so you do not go back to them.
FAQ
How can I tell that my IP is on a blacklist?
Find your address on the "My IP" page and check it in several public databases: the Spamhaus check, the MXToolbox blacklist check and AbuseIPDB. If the address is found in at least one, the service will show which one and why.
Is a listing in one DNSBL dangerous if I do not send email?
For ordinary browsing, hardly at all. Spam databases are read mostly by mail servers. But a listing is a signal that something was sent out from the address, so it is worth checking your devices.
How long does removal from a blacklist take?
It depends on the database. Some lists remove the entry by themselves once the spam stops. Others remove the address after a request through a form on their website, and this usually takes from a few hours to a few days.
Why might a proxy address already be in a database?
The proxy pool is shared: another client may have used this address before you. If the address is marked, take a new one: on the rotating ports it changes with every request.
What should I do if a website blocks me even with a clean IP?
Then it is not only about the address. Websites look at the browser, cookies, time zone and request rate. Make sure these match the address's country and slow down.
