How to Check IP Purity: A Complete Guide

IP purity refers to the cleanliness of an IP address's reputation — the absence of negative history such as spam sending, abuse reports, blacklist listings, botnet participation, or association with fraudulent activity. A pure IP is one that has no strikes against it across the major threat intelligence and reputation databases. Checking IP purity is a critical step for anyone setting up a new server, troubleshooting email deliverability problems, or assessing the risk profile of incoming traffic.

Step 1: Check Major Email Blacklists

Email blacklists (also called Real-time Blackhole Lists or RBLs) are the most well-known form of IP reputation data, and for good reason — being listed can cause your email to be rejected by millions of mail servers worldwide. The most important lists to check:

• Spamhaus SBL (Spam Block List) — Direct spam sources and spam infrastructure
• Spamhaus XBL (Exploits Block List) — IPs running malware, open proxies, or botnet code
• Spamhaus PBL (Policy Block List) — IPs that shouldn't be sending email directly (residential connections, dynamic IPs)
• Spamhaus CSS — Snowshoe spam operations
• Barracuda BRBL — Spam sources reported to Barracuda's network
• SURBL — IPs associated with spam URIs
• UCEProtect — Spam senders (three levels of increasing breadth)

You can check all of these simultaneously using tools like MXToolbox's blacklist checker, which queries dozens of lists in a single request and shows your listing status on each.

Step 2: Check General Abuse Databases

Beyond email-specific blacklists, general abuse databases track a broader range of malicious behaviour:

AbuseIPDB is the most comprehensive community-powered abuse database. Go to abuseipdb.com, enter the IP, and look at the confidence score, total reports, and report categories. A confidence score above 50% with recent reports is a significant red flag. Even a score of 1–20% with multiple distinct reporters across different categories is worth investigating.

Pay attention to report recency. Reports from three years ago have minimal weight on current trust decisions; reports from the last 24 hours are urgent.

Step 3: Run an IPQS Fraud Score Check

Services like IPQS aggregate signals from multiple sources into a composite fraud score that reflects current risk, not just historical abuse. A fraud score check returns:

• Overall fraud score (0–100)
• Proxy, VPN, and Tor detection status
• Abuse velocity (how recently the IP has been active in abuse)
• Connection type (residential, mobile, datacenter, corporate)
• Country, ISP, and ASN information
• Specific threat categories if any are flagged

A fraud score below 25 with no proxy/VPN flags and clean abuse history is a good purity indicator. Scores above 50 warrant investigation before using the IP for sensitive purposes.

Step 4: Check ASN Reputation

The IP's Autonomous System Number tells you about the broader network context. Some ASNs are known for hosting high proportions of abusive traffic — bulletproof hosting providers, for instance, are sometimes as significant a risk signal as the individual IP's history.

Look up the ASN in WHOIS to confirm the registered organisation matches your expectations. If you provisioned an IP from a reputable cloud provider but the ASN lookup returns an unknown organisation, something may be misrouted or the allocation may not be what it appears.

Step 5: Verify Reverse DNS

A PTR (pointer) record maps an IP address to a hostname. For email sending, the absence of a PTR record or a PTR record that doesn't match the forward DNS is a significant deliverability problem — most mail servers check this and will reject or junk email from IPs with missing or mismatched PTR records.

For web traffic, the PTR record can reveal useful context: cloud provider IPs often have recognisable PTR patterns, and malicious infrastructure sometimes has distinctive hostnames. Check PTR records with dig -x [IP] or nslookup.

Step 6: Check Threat Intelligence Feeds

For IPs you're particularly concerned about, check additional threat intelligence sources:

• VirusTotal — Aggregates dozens of security vendor verdicts for IPs, including malware hosting and phishing history
• Shodan — Shows what services are publicly exposed on the IP and any known vulnerabilities
• URLScan.io — Shows recent web activity associated with the IP, including any malicious or suspicious pages
• AlienVault OTX — Shows threat indicator data contributed by the security research community

Interpreting the Combined Results

A single clean report doesn't mean an IP is pure; a single red flag doesn't always mean it's dangerous. Look at the totality:

• Multiple independent sources flagging the same IP is a strong signal
• Time-recency matters — recent flags are more significant than old ones
• The nature of the flags matters — spam history is less alarming for web traffic than malware hosting history
• Context matters — a datacenter IP with some flags carries different risk than a residential IP with the same flags

For critical uses (sending important email campaigns, allocating IPs for production services), run this full check before deploying. For assessing incoming traffic, automate the check via API so it happens in real time without manual intervention.