--- title: "IP Blacklist Check: IP Reputation Signals" url: "https://lookvalid.com/tools/ip-blacklist-check.md" canonical_url: "https://lookvalid.com/tools/ip-blacklist-check" last_updated: "2026-10-20" type: "tool" summary: "Check an IP address for reputation signals and get a band." related: ["https://lookvalid.com/docs/api/ip.md"] --- # IP Blacklist Check: IP Reputation Signals Check an IP address for reputation signals and get a band. Enter an IP address to see the reputation signals held on it. Each signal that applies is listed with its points, and the total score places the address in a band from no signals to strong signal. ## Facts - Free, no account needed. The address you enter is sent from your browser to LookValid's lookup service to be checked. The service keeps the result, address included, for up to seven days so repeat checks are quick. - Related API product: [ip](https://lookvalid.com/docs/api/ip.md), 1 credit through the API. ## How it works 1. Enter an IPv4 or IPv6 address, for example one from a signup, a failed login or a mail server log. 2. The address is matched against the Tor Project exit list and the address ranges that cloud and hosting providers publish. Each match adds its points to a score from 0 to 100. 3. The score sets the band: no signals (0), light signal (1 to 49), strong signal (50 to 100). You also see which lists matched and who owns the network. ## Example result IP address 108.61.189.136, a Tor exit on the Tor Project list file read on 2026-10-17 that also sits in a published hosting range, checked on 2026-10-19. Captured 2026-10-19. - Band: Strong reputation signal - Score: 95 of 100 - Tor exit list, 70 points: The address is a Tor exit node. - Cloud and hosting ranges, 25 points: The address belongs to a cloud or hosting provider (Vultr), where traffic is often automated. - Network owner: AS20473 The Constant Company, LLC ## What this check reads It reads two lists. The first is the Tor Project exit list, the relays through which Tor traffic leaves the network. The second is the set of address ranges that cloud and hosting providers publish for their own networks. Each list that matches adds points to the score, and the result shows every match on its own line with the points it added. The network owner comes from the DB-IP ASN data and is there for context, not as a signal. This check does not query DNS blocklists. It reports the signals LookValid holds itself, so an address can have a listing elsewhere that this page does not show. ## What a blocklist listing is A blocklist, also called a blacklist or DNSBL, is a list of addresses that other systems consult to refuse or score traffic. Mail servers use them to reject spam, and firewalls and websites use them to slow down abusive sources. Operators add an address after it sends spam, scans networks or hosts malware, and remove it after a clean-up or after a set time. Each list has its own rules, so being on one list does not mean being on another. To find out whether a particular mail blocklist lists an address, ask that list directly. Use this page for the reputation signals LookValid holds. ## How to use the band A light signal calls for a closer look, not a block. A strong signal is a reason to add a step, such as a verification prompt or a tighter rate limit. Hosting ranges hold many ordinary services, and a Tor exit carries traffic from many people, so no band is proof that an address is abusive. ## The reputation bands, their score ranges and what to do with each | Band | Score | What it means | | --- | --- | --- | | No signals | 0 | No reputation signals found on the lists this check reads | | Light signal | 1 to 49 | A weak signal alone rarely justifies blocking. Use it to weigh the request alongside others, for example by asking for one more verification step. | | Strong signal | 50 to 100 | Treat traffic from this address with extra checks, such as a verification step or a lower rate limit, before you trust it. | ## Sources - [Tor Project bulk exit list](https://check.torproject.org/torbulkexitlist), read 2026-10-19 - [Amazon Web Services published IP ranges, one of the provider range lists](https://ip-ranges.amazonaws.com/ip-ranges.json), read 2026-10-19 - [DB-IP IP to ASN Lite (network owner), CC BY 4.0](https://db-ip.com/db/download/ip-to-asn-lite), read 2026-10-19 ## Questions ### Which lists does this check read? It reads the Tor exit list and published hosting ranges, and the page names both, so you know exactly what a result covers. ### What does "No reputation signals found" tell me? The address is not a listed Tor exit and sits in no published hosting range. It says nothing about the lists this check does not read, such as a mail blocklist. ### How is the score worked out? Every matching list adds its points and the total is capped at 100. The result shows each match with its points, so you can see where the total comes from. ### Why is a hosting address only a light signal? Hosting ranges hold websites, corporate gateways and other ordinary services next to bots and proxies. A Tor exit adds many more points because anyone on the Tor network can send traffic from it. ### Can I check a private address such as 192.168.1.1? No. Private, loopback and other reserved addresses are not public internet addresses, so there is nothing to look up for them. ## Related - [IP Intelligence reference](https://lookvalid.com/docs/api/ip.md)