Home / Industry

IP Blacklist and Blacklist Removal

Everyone hates spam. Even worse is malware—something that infects your computer and sends spam out to you and others or tries to hack into systems. In response to these problems, many people began to maintain lists recording who generates spam and malware. An “IP blacklist” is used by most mail servers and some firewalls as a step in deciding whether to accept emails, mark as “Junk,” or just drop traffic altogether.

IP Blacklist Listings

Different blacklists have different ways of collecting addresses. Some mail servers collect data from users clicking “This is spam” and report this to blacklist maintainers, while other blacklist operators have “honeypots.” Honeypots are systems designed to attract spam, so they can blacklist any IP address from which they receive spam.

A significant amount of spam comes from home computers and other devices that have been infected with malware, making them part of a “botnet.” Some operators even actively scan the Internet, looking for devices with certain vulnerabilities that they know have been exploited by botnets. Residential users and cell phones generally don’t run mail servers, so any indication that an IP address is part of a pool used for those may put an address range on a blacklist.

Problems with Blacklists

The main problem with blacklists is collateral damage—traffic blocked that shouldn’t be. A few blacklists intentionally do this, to force large IPv4 block holders to take action in preventing spam from reaching their customers. In some cases, a device got blacklisted for spam, but was later patched and the spam stopped. Many blacklists have an “aging” policy, where if no further problems are seen or reported over a period of time, an IP address will be removed from the list. If it’s reported again, it may take longer to age out next time.

Often, IPv4 addresses for sale will include some that have been blacklisted. Companies looking to buy, should always conduct some diligence. But it is important to remember that IP addresses can be listed (or de-listed) at any time, so a blacklist check two weeks ago may have no correlation with one today.

Checking Blacklists

Most blacklists offer a web page where you can check whether an IP address has been listed. That’s not going to work if you want to check 65,536 IPv4 addresses. A few blacklists allow you to download their list to search locally (or sync with github). For two major operators, SORBS and Spamhaus, you’ll need to script a test.

Both SORBS and Spamhaus operate DNSBLs, for Domain Name Service Black-Lists. They allow queries over DNS and return a code that tells you which list an address is on.

For instance, if I want to find out about, I can run the Unix command:

$ dig @dnsbl.sorbs.net +short

I may get a response like “,” which SORBS tells me means it’s on their spam list. The equivalent command in Windows command line console is:

> nslookup [email protected]

To query an entire block, you’ll need a script that queries every address in that block. IPv4.Global is able and happy to run such a check for our customers.

IP Blacklist Removal

Every blacklist maintainer has their own mechanism for getting addresses removed that often requires some demonstration that the original cause of the listing has been removed. For several SORBS lists, you have to request a retest:

  1. Log into a machine using the blacklisted IP address, browse to their support page, and click “Request Key”
  2. You then email the key to SORBS and they retest

If the test passes, SORBS will flag the address to be removed. If you don’t have access to that machine, or it doesn’t have a browser, you can try to open a support ticket.

Spamhaus similarly provides a web interface, which tells you which list you’re on with links to clean up.

Fortunately, most blacklist operators recognize that spam doesn’t come from unrouted IP addresses, so simply taking the network offline, as you would in preparation to sell, provides a good reason why you can’t retest and why they should reconsider. Similarly, showing the record of when an IPv4 address block was transferred is often acceptable documentation: the old management may have been lacs, but you, the IP address buyer, are not responsible for their actions.

As with so many parts of buying and selling IP addresses, you can do it yourself, but the help of an experienced broker like IPv4.Global can make your life a whole lot easier. Reach out to us today for all of your IPv4 needs.

By IPv4.Global, Premier IPv4 Broker and Online Marketplace

IPv4.Global by Hilco Streambank helps companies with IPv4 addresses to sell, find companies who need to buy IPv4 addresses. Our business is founded on the belief that the transaction that yields mutual satisfaction is worth pursuing. We customize solutions that work for both buyers and sellers and help evaluate options for acquiring the IP addresses you need, given your Regional Internet Registry requirements.

Visit Page

Filed Under


Commenting is not available in this channel entry.
CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

Co-designer of the TCP/IP Protocols & the Architecture of the Internet




Sponsored byDNIB.com

IPv4 Markets

Sponsored byIPv4.Global

New TLDs

Sponsored byRadix


Sponsored byVerisign

Domain Names

Sponsored byVerisign

Threat Intelligence

Sponsored byWhoisXML API

Brand Protection

Sponsored byCSC