The vocabulary of the IP Blacklist Lookup API

A database of IP addresses identified as sources of spam, malware, or other malicious activity.

IP blacklists (also called blocklists) are maintained by security organizations, ISPs, and anti-spam services. They're queried by email servers, security tools, and applications to identify potentially malicious traffic. Being listed can affect email deliverability and access to services.

ExampleSpamhaus SBL lists IPs that have been verified sources of spam, used by most major email providers.

DNS-based Blackhole List—a blacklist queried via DNS lookups, commonly used for email filtering.

DNSBLs work by reversing the IP address and querying it as a subdomain of the blacklist. For example, checking 1.2.3.4 on Spamhaus queries 4.3.2.1.zen.spamhaus.org. A response indicates the IP is listed. This DNS-based approach allows fast, distributed lookups.

ExampleTo check if 192.0.2.1 is on Spamhaus ZEN, query 1.2.0.192.zen.spamhaus.org—an A record response means it's listed.

A major anti-spam organization that maintains several influential IP and domain blacklists.

Spamhaus operates multiple lists: SBL (Spamhaus Block List) for verified spam sources, XBL (Exploits Block List) for compromised hosts, PBL (Policy Block List) for dynamic IPs, and CSS for snowshoe spam. Their lists are used by most major email providers and ISPs worldwide.

ExampleIf your mail server IP is listed on Spamhaus SBL, Gmail and Microsoft 365 will likely reject your emails.

A numerical rating indicating an IP address's trustworthiness based on its history and associations.

Reputation scores typically range 0-100, calculated from blacklist presence, abuse reports, traffic patterns, and historical behavior. Higher scores indicate trusted IPs; lower scores suggest potential malicious activity. Scores inform decisions about email delivery, access control, and fraud risk.

ExampleA mail server IP with a reputation score of 95/100 will have excellent deliverability, while 25/100 suggests significant problems.

The process of removing an IP address from a blacklist after the associated issue is resolved.

Delisting requires identifying and stopping the offending behavior, then requesting removal through the blacklist's process. Some blacklists auto-delist after a period; others require manual requests. Repeated listings may result in longer wait times or permanent listing.

ExampleAfter securing a compromised email account, submit a delisting request at Spamhaus's removal form and wait for review.

An email address designed to catch spammers, used by blacklist operators to identify spam sources.

Spam traps are email addresses that should never receive legitimate mail. They're either published in hidden locations (harvested by scrapers) or are abandoned addresses repurposed as traps. Sending to a spam trap strongly indicates the sender is using purchased lists or doesn't practice list hygiene.

ExampleA blacklist operator publishes an email address hidden in website HTML. Spammers who scrape and send to it get their IP blacklisted.

Information about current and potential cyber threats, including malicious IP addresses.

Threat intelligence aggregates data from multiple sources—honeypots, malware analysis, abuse reports, security researchers—to identify malicious actors. IP threat intelligence helps organizations block known-bad IPs, detect compromise indicators, and prioritize security responses.

ExampleA threat intelligence feed provides daily updates of IPs involved in brute force attacks, which the firewall automatically blocks.

A mail server that allows anyone to send email through it, commonly exploited by spammers.

Open relays don't require authentication to forward email, making them attractive to spammers who want to hide their identity. Modern mail servers are configured to require authentication, but misconfigured servers become open relays. Operating an open relay almost guarantees blacklisting.

ExampleA misconfigured mail server allows anyone to send email without a password, gets abused by spammers, and ends up on multiple blacklists within hours.

A network of compromised computers controlled by attackers, often used for spam, DDoS, or fraud.

Botnets consist of thousands or millions of infected devices (bots) that follow commands from a control server. They're used to send spam, launch DDoS attacks, mine cryptocurrency, or commit click fraud. IPs of infected machines appear on blacklists when detected.

ExampleA botnet of 100,000 infected home computers sends millions of spam emails. Recipients' mail servers detect the spam and blacklist the source IPs.

The ability of sent emails to reach recipients' inboxes rather than spam folders or being rejected.

Deliverability depends on multiple factors: sender IP reputation (blacklist status), domain reputation, authentication (SPF/DKIM/DMARC), content quality, and recipient engagement. Poor deliverability means emails go to spam or bounce, impacting business communications.

ExampleAfter getting blacklisted, a company's email deliverability dropped from 98% to 40%, with most emails landing in spam.