Buyer's guide

Blacklist screening: check an IPv4 block's reputation before you buy

A transfer changes who the registry lists as the holder. It doesn't change the block's history. If a previous holder or its customers sent spam, ran open proxies or hosted malware, the addresses may still be on blocklists, in proxy databases or placed in the wrong country.

You find out when email bounces, logins trigger extra checks or customers see the wrong country. This guide covers what to check before you sign, what each check tells you, and how to clear a listing.

ARIN Qualified Facilitator Checked against registry and blocklist-operator sources November 9, 2026

In short

Reputation follows the addresses, not the owner. ARIN asks blocklist operators to remove stale data on blocks it reissues (ARIN).
Check before you sign: the major email blocklists (Spamhaus, Barracuda, SpamCop), Spamhaus DROP, proxy and VPN databases, routing history, leftover RPKI and route objects, and geolocation.
Check every address, not one sample: many lists record individual IPs.
Leased space needs a closer look: a 2025 peer-reviewed study found leased prefixes 2.89 times more likely than non-leased ones to appear on a set of attack, malware and reputation blocklists (February 2025; TMA 2025).
Most listings can be cleared, but the route differs by list. A Spamhaus SBL listing needs the provider responsible for the addresses to ask.

What to check, and what each check tells you

Sources: Spamhaus SBL, Spamhaus DROP FAQ, Barracuda Central, SpamCop.
Check	What it tells you	Where to look
Spamhaus lists	SBL: addresses Spamhaus has identified as malicious. CSS: low-reputation email. XBL: compromised machines. PBL: ranges that shouldn't send email directly.	Spamhaus IP and Domain Reputation Checker
Spamhaus DROP	Netblocks Spamhaus considers hijacked or run by spam or cybercrime operations. Networks are advised to drop all their traffic.	Spamhaus DROP
Barracuda	Addresses on the Barracuda Reputation Block List, used by many mail filters.	Barracuda Central lookup
SpamCop	Addresses that sent email reported by SpamCop users or caught by its spam traps.	SpamCop Blocking List lookup
Proxy and VPN databases	Whether addresses are flagged as proxies, VPNs or hosting. These flags affect logins, payments, streaming and ad traffic.	Each database's own lookup
Routing history	Which networks have announced the block, and when. Unexpected origins can point to past hijacking.	RIPEstat
RPKI and route objects	Leftover ROAs or IRR route objects that still authorize the old network to announce the block.	The registry's RPKI and IRR records
Geolocation	The country and city that geolocation databases assign to the addresses.	The main geolocation providers
Registry record	Who holds the block, its transfer history, and any sign of a dispute.	Whois/RDAP; ARIN transfer log

A pre-purchase checklist

Get the exact prefix before you sign. "A clean /22 in ARIN" isn't something you can check. A specific block is.
Run every address through the email blocklists. Many lists record single IPs, so one clean result says little about the rest of the block. Use a tool that checks whole ranges, or check each /24.
Look for DROP first. A DROP listing is the most serious result: Spamhaus says DROP covers netblocks hijacked or leased by professional spam or cybercrime operations, and recommends backbone networks drop that traffic entirely (Spamhaus).
Check proxy and VPN databases. A block that was used for proxies or VPN exit points can be flagged long after that use stopped, which matters if your users log in, pay or stream.
Read the routing history. Who announced the block, and is anyone still announcing it? A block that another network still announces must be withdrawn before you can use it cleanly.
Confirm the seller's clean-up. ARIN's checklist for sellers: remove the prefixes from their ROAs, review maxLength values, update or delete IRR route objects, and agree how reverse DNS is handed over (ARIN). Ask for this to be done before the transfer completes.
Check geolocation. Note where the major databases place the block today, so you know what needs correcting after the transfer.
Agree in writing what happens if something turns up. For example, whether a listing found before closing lets you choose another block, and who handles delisting.

If a block you own is listed

Spamhaus

Look the address up in Spamhaus's IP and Domain Reputation Checker, which shows which list it is on and why. For the main SBL list, Spamhaus says removal requests must be sent by the internet service provider in charge of the addresses, and that it is the network owner's responsibility to tell Spamhaus about changes that affect a listing (Spamhaus). If you run your own network, that is you; if not, ask your upstream provider. DROP entries are tied to an SBL record and leave DROP when that record is removed (Spamhaus).

Barracuda and SpamCop

Barracuda has a removal request form. SpamCop listings are temporary and expire on their own once reports stop; there is no form to fill in (SpamCop).

Tell people the block has changed hands

Let your upstream providers know the block is newly yours, and point blocklist and proxy-database operators to the registry record showing the change. ARIN takes the same approach with the space it reissues: its distribution announcements say earlier blocklist entries against those blocks are most likely no longer valid (ARIN).

Fix geolocation and routing records

Ask the main geolocation providers to update the location, and publish a geofeed: a CSV file of your prefixes and their locations, linked from your registry record as RFC 9632 describes (RFC 9632). Create ROAs for your own network, register route objects, and set up reverse DNS.

Leased space and reputation

A study presented at the 2025 Network Traffic Measurement and Analysis Conference (TMA), by researchers at the University of Twente and CAIDA, looked at abuse in the IPv4 leasing market (Degen et al., TMA 2025):

About 6.1% of routed prefixes were inferred to be leased in January–February 2025.
Leased prefixes were 2.89 times more likely to appear on a set of attack, malware and reputation blocklists than prefixes that were not leased.
Leased prefixes showed up more often in every abuse category the researchers measured except spam, where they were less likely to be flagged.
The organization using leased addresses can use them without being recorded in Whois, which makes abuse complaints harder to act on.

None of this makes a particular leased block bad, but it is a reason to check a block's lease and routing history as carefully as its blocklist status. More on the trade-offs in lease vs buy IPv4.

How IPv4 Depot screens blocks

IPv4 Depot screens blocks against Spamhaus, Barracuda and SpamCop, plus proxy-detection databases. Screening shows a block's status at the time it is checked; it is not a guarantee that an address will never be listed in the future.

IPv4 Depot is an ARIN Qualified Facilitator and an APNIC registered broker, and handles transfers in ARIN, RIPE NCC and APNIC.

Blacklist screening FAQ

Does a blacklist listing stay with an IP block after it is transferred?

It can. Blocklists track addresses, not owners, so a listing made while a previous holder or its customers used the block can still be there after the registry records the new holder. ARIN, for example, publishes the blocks it reissues from its waiting list and asks blocklist operators to use that list to remove stale reputation data based on the previous registrant's activity.

Which blacklists should I check before buying IPv4 addresses?

At a minimum, the widely used email blocklists (the Spamhaus lists, the Barracuda Reputation Block List and the SpamCop Blocking List), Spamhaus's DROP list, and proxy and VPN detection databases. If the addresses will serve consumers, also check how geolocation databases place them. Check every address in the block, not just one, since many lists record individual addresses.

What is the Spamhaus DROP list?

DROP (Don't Route Or Peer) is Spamhaus's advisory 'drop all traffic' list. Spamhaus says it contains netblocks that are hijacked or leased by professional spam or cybercrime operations, and that it does not include space allocated to a legitimate network and reassigned. Since April 10, 2024 it also includes the data that used to be published as the separate EDROP list. A DROP listing is tied to a Spamhaus SBL record and leaves DROP when that record is removed.

Can a blacklisted IPv4 block be cleaned up?

Usually, yes, once the activity behind the listing has stopped. How depends on the list. SpamCop listings expire on their own once reports stop. Barracuda has a removal request form. Spamhaus's checker shows which of its lists an address is on and what to do; for its main SBL list, removal requests must come from the internet service provider responsible for the addresses. Geolocation is fixed separately, with each provider.

Are leased IPv4 addresses more likely to be blacklisted?

On average, yes. A peer-reviewed 2025 study by researchers at the University of Twente and CAIDA found that leased prefixes were 2.89 times more likely to appear on a set of attack, malware and reputation blocklists than prefixes that were not leased, in data from February 2025. They were less likely than other prefixes to be flagged for spam. That is an average across the market, not a verdict on any one block, so check the block itself.

Does IPv4 Depot guarantee a clean block?

No. IPv4 Depot screens blocks against Spamhaus, Barracuda and SpamCop, plus proxy-detection databases. Screening shows a block's status when it is checked; no one can guarantee that an address will never be listed in the future.

How do I fix wrong geolocation after buying IPv4 addresses?

Tell the geolocation providers that matter to your users where the addresses are now used, using their correction processes, and publish a geofeed: a small CSV file listing your prefixes and their locations, linked from your registry record as described in RFC 9632. Providers that use geofeeds can then pick up the change.

Sources

Facts on this page come from the registries' and blocklist operators' own documents and from the peer-reviewed study cited, checked on November 9, 2026. Blocklist policies change; where this page and the operator differ, the operator is right.

Want a block screened before you commit?

Tell us the size and registry you need. We screen blocks against Spamhaus, Barracuda and SpamCop, plus proxy-detection databases.

Talk to IPv4 Depot 1.800.856.5960