IP Reputation Checker

Server assisted New Internet & Network

Queries the SpamCop, PSBL, UCEPROTECT level 1 and Barracuda blocklists over DNS from the Cloudflare edge (Spamhaus ZEN too when a Spamhaus key is configured) and, when an AbuseIPDB key is configured on the server, asks AbuseIPDB for the address's abuse confidence score, number of reports and last report in the past 90 days. Each source is reported on its own; a list or service that cannot answer is shown as exactly that, and no result is presented as proof that an address is clean.

Privacy: The domain, address or URL you enter is sent from the Mutqan server to the public data service named on this page (a registry, a resolver, a certificate log or a measurement network). Nothing is stored.

What does an IP address's reputation tell you?

An address's reputation is what others have recorded about traffic from it: DNS blocklists publish addresses seen sending spam or abuse, answered through a simple DNS query (RFC 5782), and abuse-report databases count reports from their users over a recent window. It is evidence about the address, not the person: shared, reassigned and VPN addresses inherit other users' history, each list has its own listing and removal policy (RFC 6471), and an address that no list names is not thereby proven clean.

Security note: Do not block or accuse on one listing or one score alone: combine reputation with your own logs, and expect shared addresses (carrier-grade NAT, VPN exits, cloud ranges) to carry other users' history.

How to use IP Reputation Checker

  1. Enter one public IPv4 or IPv6 address: a mail server's sending address, a visitor in your logs, or an address you are about to allow.
  2. Press Check reputation; the blocklists and the reputation service are asked at the same time.
  3. Read the summary, then the abuse reports and the blocklist table; a source shown as not available has said nothing about the address.

IP Reputation Checker features

  • Five DNS blocklists in one run: SpamCop, PSBL, UCEPROTECT level 1 and Barracuda without a key, and Spamhaus ZEN when a Spamhaus key is configured
  • AbuseIPDB's abuse confidence score, report count, last report, usage type, ISP, domain and Tor exit flag for the last 90 days, when an AbuseIPDB key is configured on the server
  • Every list and service reported on its own: refused, failed and unconfigured sources are named as such and never counted as "not listed"
  • A plain reading that never calls an address clean: what the listings and reports say, and what they cannot say
  • The blocklists' own test address 127.0.0.2 accepted, to see the lists answer
  • The blocklist table downloadable as CSV

Inputs and outputs

Inputs

  • IP address: one public IPv4 or IPv6 address; private, shared, documentation and reserved ranges are refused before any request.
  • The test address 127.0.0.2 checks that the blocklists answer; it is not sent to the reputation service.

Outputs

  • Summary: abuse confidence score, reports in the last 90 days, how many answering blocklists list the address and how many lists gave no answer.
  • Abuse reports (AbuseIPDB): score, report count, last report, usage type, ISP, domain, Tor exit and allow-list flags, or why they are not available.
  • DNS blocklists: every list with its zone, result and return code, and a plain reading of what the results mean.

IP Reputation Checker example

Google Public DNS's address, on a server without AbuseIPDB or Spamhaus keys

Input:

IP address: 8.8.8.8

Output:

Abuse confidence score: Not available · Reports (90 days): — · Blocklists listing it: 0 / 4 · Lists not checked: 1
Abuse reports: Not available: no abuse-report service is configured on this server
List | Zone | Result | Code returned
SpamCop Blocking List | bl.spamcop.net | Not listed (no entry) | —
Passive Spam Block List | psbl.surriel.com | Not listed (no entry) | —
UCEPROTECT Level 1 | dnsbl-1.uceprotect.net | Not listed (no entry) | —
Barracuda Reputation Block List | b.barracudacentral.org | Not listed (no entry) | —
Spamhaus ZEN | zen.spamhaus.org | Not checked: needs a key on the server | —
What this means: Not listed on any blocklist that answered. That is a statement about those lists at this moment, not proof that the address is clean.

How to read the IP Reputation Checker results

Blocklists matter most for mail: a listing on a list that receiving servers use leads to rejected or filtered mail from that address.

As a rough reading of the abuse confidence score: 0 means no recent reports or only discounted ones, low values a few or older reports, and values from about 75 upward many recent reports from different users. Services that use such data are likely to block or challenge high-scoring addresses.

A score of 0 with reports can happen when AbuseIPDB has the address on its allow list or the reports are old; the report count and last-report date show which.

Shared addresses (carrier-grade NAT, VPN exits, Tor, cloud providers) collect reports caused by other users of the same address, so a listing does not identify who was responsible.

"Not listed" and a low score describe the sources that answered at that moment. They are not proof that an address is clean.

When to use IP Reputation Checker

  • Checking why mail from a server is rejected or lands in spam, before contacting the receiving provider.
  • Reviewing an address from a login alert, a WAF log or a fraud report before deciding whether to block it.
  • Vetting a newly rented server or VPS address, which may carry a previous tenant's history, before sending mail from it.

Troubleshooting

  • "Refused the query" on a list: some blocklists do not answer queries that arrive through public resolvers. It says nothing about the address; check that list on its own website.
  • No reputation score: no AbuseIPDB key is configured on this server, or AbuseIPDB did not answer or its daily quota is used up; the abuse reports section says which.
  • A limit or busy message: the blocklist check makes several upstream queries per run, so the per-visitor budget allows only a few checks per minute. Wait a minute and try again.
  • Listed although the server is fine now: blocklists remove an entry some time after the abuse stops, and some only on request; follow the removal process on the list's website.

Frequently asked questions about IP Reputation Checker

Does "not listed" mean the address is safe?

No. It means the blocklists that answered had no entry for the address at that moment, and, if a score is shown, that AbuseIPDB's users reported it little or not at all in the last 90 days. Large providers keep their own reputation data, which no public lookup can see, and an address can be clean today and abused tomorrow.

What is the abuse confidence score?

AbuseIPDB's own 0 to 100 estimate of how likely an address is to be abusive, based on how many of its users reported it in the last 90 days, how recently and how trusted the reporters are. The tool shows the number exactly as AbuseIPDB returns it, with the report count and the date of the last report, and does not adjust it.

Why is there no score in my result?

The score comes from AbuseIPDB and is only requested when an AbuseIPDB key is configured on the server. Without one, the page says that no reputation score is available and shows the blocklist results alone; it never fills the gap with a guess.

How is this different from the IP Blacklist Checker?

The IP Blacklist Checker is about mail: it explains each list's return code for a mail server's address. This tool asks the same DNS blocklists but adds an abuse-report score when one is configured, for a broader view of how an address has behaved, for example before allowing it into a firewall or an application.

My server's address is listed or has reports. What should I do?

Find and fix the cause first: a compromised account or device, an open relay or proxy, a vulnerable web form or a misbehaving script. Then request removal on each blocklist's own website, which most lists do once the problem stops. AbuseIPDB reports age out of the 90-day window by themselves.

Why is my home connection's address listed when I never sent spam?

Addresses are reused: a previous holder, another device on your network or another customer behind the same carrier-grade NAT may have caused the listing. Some lists also include whole residential ranges by policy, because mail from home lines is expected to go through the provider's own mail server.

Technical notes

A DNS blocklist is queried by reversing the address and appending the list's zone (203.0.113.25 → 25.113.0.203.bl.spamcop.net, nibble-reversed for IPv6): an A record in 127.0.0.0/8 means listed, NXDOMAIN means not listed (RFC 5782). POST /api/v1/internet/dns/dnsbl sends these queries through Google Public DNS over HTTPS, with Cloudflare 1.1.1.1 as the second try, from the Cloudflare edge.

A list that refuses queries from public resolvers answers with a refusal code; the tool reports it as "refused the query" and does not count it as checked. RFC 6471 describes how blocklists are expected to operate, including listing and removal policies.

POST /api/v1/internet/providers/ip-reputation asks AbuseIPDB's check API with a 90-day window when ABUSEIPDB_KEY is configured; without it the answer says the provider is not configured and the page shows no score. The score, counts and dates are shown exactly as AbuseIPDB returns them.

Limitations and methodology

Only the five IP blocklists named here and, when configured, AbuseIPDB are asked. Large mailbox and security providers use their own reputation data, which no public lookup can show.

The blocklist queries come from the Cloudflare edge through public resolvers, which some lists refuse; Spamhaus ZEN needs a key on the server.

A score and listings are a snapshot of reports about an address. They do not identify who used the address, and shared addresses carry other people's history.

Security and privacy

The address you enter is sent from the Mutqan server to Google Public DNS (and Cloudflare 1.1.1.1 if needed) as blocklist queries, which the list operators receive, and, when configured, to AbuseIPDB. Your own address is not sent. Nothing is stored.

References