# IP Blacklist Check and IP Risk Score | ProxyJam IP blacklist check against Spamhaus DROP, FireHOL, blocklist.de and the Tor exit list, plus an IP risk score from three fraud-scoring services. - Canonical: https://proxyjam.com/ip-checker/ - Updated: 2026-10-22 - Language: en Find out whether an address is on a published blocklist, is a Tor exit, has been reported for abuse recently, or looks like a proxy or a VPN to fraud-scoring services. The IP checker looks an address up in four published lists and asks three fraud-scoring services about it, then gives one verdict — clean, suspicious, risky or blacklisted — by a fixed rule, with every source's reading beside it. It tells you how others already rate an address, not whether one particular site will accept it. ## Three kinds of evidence, kept apart ### Published blocklists Spamhaus DROP and FireHOL Level 1, lists published for networks and firewalls to block. An address on one of them is reported as blacklisted, whatever the other sources say about it. ### Tor exits and recent abuse Whether the address is on the Tor Project's list of exit nodes, and whether servers reporting to blocklist.de saw it attacking them in the last 48 hours. An attack report can come from a single compromised device behind a shared address, and running an exit is not abuse, so neither list decides the verdict on its own; the check still says which list said what. Two of the scoring services rate a Tor exit high risk themselves, though, so in practice an exit usually comes out risky. ### Three fraud-scoring sources Scamalytics, IPQualityScore and ipdata.co score the address. The verdict follows a fixed rule rather than an average of their scores, and a source that cannot be reached is left out instead of being counted as clean. ## For anyone about to rely on an address ### Anyone who bought an address Find out whether it is already treated as a risk before you depend on it. ### Anyone who was given one See how others already rate it before you rely on it for an account or a payment. ### Anyone checking a sign-up or an order Get one verdict on the address it came from, with every source's own reading beside it. ## How to check if an IP is blacklisted ### Enter the address Type any public IPv4 or IPv6 address into the field above. Your own address is already there, so to check your connection, leave it as it is. ### Sign in or create an account The check runs in the ProxyJam app. If you are not signed in, you sign in or sign up first, and the address you entered is still in the field when you arrive. ### Look the address up in the public lists Checking the four published lists alone is free. It shows whether the address is on Spamhaus DROP, FireHOL Level 1, blocklist.de or the Tor exit list. ### Run the full IP fraud check The full check also asks the three scoring services and gives the verdict, the risk score and each source's reading. It uses a free check if you have one and is charged to your USD wallet balance otherwise, and the result is kept in your history. ## Four verdicts, and the rule behind each | | Given when | What it tells you | |---|---|---| | Blacklisted | A blocklist lists the address — Spamhaus DROP, FireHOL Level 1 or one a scoring service reports — or a service knows it as an abuser | A record of listing or known abuse, not an opinion. Networks that filter on those lists may refuse the address outright | | Risky | One service rates it high risk, or two or more rate it suspicious | One strong opinion, or several, against it. Test it with a real request to your target before relying on it | | Suspicious | Exactly one service rates it suspicious | One service disagrees with the others, and its reading beside the verdict shows what it saw | | Clean | None of the rules above matches | No blocklist and no scoring service counts against it. A blocklist.de report can still be shown beside the verdict, and a site can apply rules of its own | Read from the top: the first rule that matches gives the verdict. The risk score beside it is the highest of the services' readings on a 0–100 scale, the flag-based service included: its flags are first put on the same scale. ## What the check returns, IP risk score included - **Verdict:** Clean, suspicious, risky or blacklisted - **Risk score:** 0 to 100 — the highest score any scoring service gave, not the average. The lists add nothing to it, so a blacklisted address can still score low - **Signals:** Tor, VPN, proxy, datacenter, recent abuse, known abuser and blocklist listings - **Each source's reading:** Side by side, with what each source's numbers actually measure - **Partial results:** Marked as partial when a source could not be reached ## Questions about checking an IP address ### What does an IP address checker tell you? Whether other people already treat the address as a risk. The check reads published blocklists, the Tor exit list and recent abuse reports, and asks three fraud-scoring services for their opinion, then gives one verdict with every source's reading beside it. ### How do I check whether my IP address is blacklisted? Leave your own address in the field above and look it up in the public lists, which is free. A listing on Spamhaus DROP or FireHOL Level 1 makes the verdict blacklisted, and so does a blocklist or a record of known abuse that a scoring service reports, which only the full check asks for. ### What is an IP fraud score, or IP risk score? A number a fraud-scoring service gives an address, usually on a 0–100 scale, for how likely traffic from it is to be abusive. Each service weighs its own evidence, so scores for one address differ; the check shows each service's reading and takes the highest score rather than an average. ### Does "proxy detected" mean the address is bad? No. The proxy and datacenter signals are reported for information and are not part of the verdict rule, because an address says nothing on its own about what it is meant to be used for. A scoring service can still weigh anonymity in its own rating, and that rating does count, which is why each service's reading is shown beside the verdict. ### What does the check say about a Tor exit or a VPN? It names them as signals. Being a Tor exit is not part of the verdict rule, but two of the scoring services rate a Tor exit high risk on their own, so an exit usually comes out risky. A VPN is reported as a signal and counts only through the services' own ratings. ### Which addresses can be checked? Any publicly routable IPv4 or IPv6 address. Private, loopback, shared and other reserved ranges, such as 10.0.0.0/8, 192.168.0.0/16 and 100.64.0.0/10, are refused because nobody publishes a reputation for them, and so are the two example addresses shown in the field. ### Why can an address that checks clean still be blocked? Fraud scores describe an address in general, and each site you connect to applies its own rules. An address can pass every public source and still be refused by the one platform you need, and the reverse happens too — the only test that settles it is a real request to that site. ### Why does the check need an account? A full check asks three paid scoring services and is charged to your USD wallet balance, and your past results are kept in the account so you can reopen them. Every proxy order delivered to you earns one free check, a recent result for the same address is reused at no charge, and looking the address up in the published lists alone is free. ### Can I check addresses through the API? Yes. The same check is part of the ProxyJam API, with an idempotency key so a retried request is not run or charged twice, and a free endpoint that returns what the four published lists say about the address without calling the scoring services. ## What to do about a flagged address - **A proxy you bought from ProxyJam.** What decides is whether the site you need accepts the address, so test it there first. If it is blocked on the target you named when ordering, the [Terms of Service](/terms-of-service/) provide a free replacement on request, up to 20 % of the addresses in the order per calendar month, unless the block came from use the [Acceptable Use Policy](/acceptable-use-policy/) forbids. - **Your own connection.** A blocklist.de report leaves that list once 48 hours pass without a new one; if it keeps coming back, check the devices on your network. A range listed on Spamhaus DROP or FireHOL Level 1 is for the network that holds it to resolve, so raise it with your internet provider. - **An address someone else used** — for a sign-up, an order or a login. Treat the verdict as one input. Only blacklisted rests on a record of listing or known abuse; the other verdicts are opinions, and a Tor exit or a VPN is not fraud on its own. ## Sources - [IANA — IPv4 Special-Purpose Address Registry](https://www.iana.org/assignments/iana-ipv4-special-registry/) — the ranges marked as not globally reachable, which the check refuses - [IANA — IPv6 Special-Purpose Address Registry](https://www.iana.org/assignments/iana-ipv6-special-registry/) — the IPv6 ranges the check refuses - [The Spamhaus Project — DROP](https://www.spamhaus.org/blocklists/do-not-route-or-peer/) — Spamhaus DROP, ranges leased or stolen by spam and cyber-crime operations - [FireHOL IP lists](https://iplists.firehol.org/) — FireHOL Level 1, and the Tor exit list as FireHOL republishes it - [blocklist.de — export](https://www.blocklist.de/en/export.html) — addresses reported attacking servers in the last 48 hours - [The Tor Project](https://www.torproject.org/) — the source of the list of current exit relays An IP reputation check tells you whether an address is already treated as a risk before you depend on it — for an account, a payment or a proxy. You get one verdict with every source's own reading beside it, so you can see why. Enter any public IPv4 or IPv6 address above. The check opens in the ProxyJam app, where it runs in your account. Private and reserved addresses, such as the ranges [IANA's special-purpose registry](https://www.iana.org/assignments/iana-ipv4-special-registry/) marks as not globally reachable, are refused. ## The lists an IP blacklist lookup reads Four published lists, copies of which ProxyJam holds, so looking an address up in them sends it nowhere: - **Spamhaus DROP** — ranges [The Spamhaus Project](https://www.spamhaus.org/blocklists/do-not-route-or-peer/) says are leased or stolen by spam and cyber-crime operations, published so networks can refuse to route them. - **FireHOL Level 1** — a firewall list [FireHOL](https://iplists.firehol.org/) compiles from several attack lists, Spamhaus DROP among them. - **blocklist.de** — addresses that servers reporting to [blocklist.de](https://www.blocklist.de/en/export.html) saw attacking them in the last 48 hours. - **Tor exit nodes** — the [Tor Project](https://www.torproject.org/)'s list of current exit relays, as republished by FireHOL. Of these four, only the first two are blocklists, and a listing on either makes the verdict blacklisted, as does a blocklist listing a scoring service reports. A blocklist.de report and a Tor exit are shown but do not decide the verdict by themselves. Spamhaus DROP, FireHOL Level 1 and the Tor list as ProxyJam holds them are IPv4 lists, so an IPv6 address is matched against blocklist.de alone, and the scoring services carry the rest of the weight. Three scoring services are asked in parallel on each full check that is not served from a recent result: Scamalytics, IPQualityScore and ipdata.co. Two give a 0–100 score and one a set of flags, so each reading is first put on its own clean, suspicious or high-risk band, and only the bands are combined. A service that does not answer is left out, and when fewer than two answer, no verdict is given and nothing is charged.