What is IP reputation

9 November 2026

IP reputation is the judgement that blocklists and scoring services hold about an address, based on what came from it before and on the kind of network it belongs to. Websites and mail servers use it to decide whether to accept a request, ask for extra verification, or refuse it. An address can inherit that reputation from a previous user who has nothing to do with you.

Where reputation comes from

There is no single official reputation score for an address. Each organisation builds its own judgement from different sources, most commonly:

• Observed behaviour. Spam, port scanning, repeated sign-in attempts with guessed passwords, or malware calling known command servers.
• Network type. An address at a hosting company is treated differently from a home or mobile subscriber's. The difference is explained in Residential, data center and mobile proxies.
• Known use. Whether the address is a known exit for a VPN service, a proxy, or the Tor network.
• How many people sit behind it. An address shared by thousands of subscribers is not judged by one of them the way a server address is.
• History. Ranges that changed owners, or were used for abuse in the past, can carry traces of it for some time.

How DNS blocklists work

The oldest and most widespread form of reputation is a list queried through the domain name system, described in RFC 5782. A mail server, for example, checks a sender's address like this:

1. It reverses the order of the address's octets, so 192.0.2.99 becomes 99.2.0.192.
2. It appends the list's domain and asks for the A record of the resulting name.
3. If no record exists, the address is not listed.
4. If an address in 127.0.0.0/8 comes back, the address is listed. The usual value is 127.0.0.2, and other values can mark different sublists.
5. It may also ask for the TXT record of the same name to learn why, and that reason often appears in the mail rejection message.

Here is the shape of the query and the answer, using the standard's own example; the domain is illustrative only:

$ dig +short 99.2.0.192.bad.example.com A
127.0.0.2
$ dig +short 99.2.0.192.bad.example.com TXT
"Dynamic address, see http://bad.example.com?192.0.2.99"

The standard also requires every list to contain an entry for 127.0.0.2, for testing, and never one for 127.0.0.1. That lets a client confirm the list is working and is not answering yes to every query.

Spamhaus lists as an example

Spamhaus is one of the best-known publishers of such lists, and each of its lists targets one kind of behaviour. Here is a summary of what its official pages describe:

Details, including the terms for free and commercial queries, are on the Spamhaus blocklists page. These lists were built for mail in the first place. A home or mobile address on the PBL is normal and does not mean websites will block it.

How services score addresses in general

Large websites and anti-fraud services do not rely on one list. They combine signals about the address with signals about the request itself into a risk score, then compare it with thresholds they set.

1. Low score: the request goes through untouched.
2. Medium score: an extra check, such as a CAPTCHA or a code sent to your email or phone.
3. High score: the request is refused, or the operation is held for review.

Address signals are only part of the decision. Account age, the usual device, and whether the country matches the device's settings all count. That is why a middling address may pass for an old account while a clean one is refused for an account created minutes ago. The general methods for spotting proxies are in How sites detect VPNs and proxies.

Reputation is not permanent. Most systems give old incidents less weight over time, and many lists drop a listing once the behaviour behind it stops.

Shared addresses and reputation

Mobile networks and some home networks put many subscribers behind one public address. Abuse by one of them is attributed to the whole address, and a block hits everyone. Scoring systems therefore usually give the address less weight in these ranges and lean more on account and device signals. The mechanism is in What is CGNAT.

The range, not just the address

Many scoring systems do not look at an address in isolation. If many addresses in one range misbehave, the whole range may be treated with caution, clean addresses included. The SBL itself lists whole network ranges, not only single addresses.

With IPv6, scoring by range becomes a necessity. A single subscriber usually receives a whole prefix holding a vast number of addresses and can change address inside it at will. Systems therefore usually score the whole prefix, such as a /64, rather than the single address.

How to check an address's reputation

1. Find your current address and network with My IP, while the connection you want to check is up.
2. Check the address in the Spamhaus reputation checker. It explains the reason for any listing and the steps to remove it.
3. Tell the two kinds of result apart: a PBL listing on its own is expected for a shared address, while XBL or CSS means behaviour was observed from it.
4. If the problem is with one particular site, its refusal message or repeated verification prompts are a better signal than public lists.

How to protect or repair an address's reputation

• If the address is your own, scan your devices for malware and close any open proxy or mail relay on your router. Then ask for removal on the list's own page.
• Do not send mail directly from a home or mobile connection; send it through your provider's mail server or a trusted mail service.
• Avoid open and free proxies. Their addresses are used by many people for purposes you cannot see, and their reputation is often poor.
• Work at a reasonable pace. Thousands of requests a minute from one address earn a bad reputation for you and for everyone sharing it.

syriaproxy addresses are mobile addresses on the Syriatel network, shared with ordinary subscribers, so their reputation reflects how that whole network is used. We cannot guarantee that every site accepts them. If an address keeps being refused, use Request a new address in your account.

FAQ

Look up the address being refused with the free lookup tool to see its owner, network type and country.