VPS Tutorials
How to Check VPS IP Blacklists and Reputation (2026): Don't Rush to Build a Site or Log In to Accounts After Getting a Dirty IP
After buying a new VPS, don't rush to deploy a website, set up email, or log in to cross-border accounts. First check whether the IP has been blacklisted, has an abuse history, whether its geolocation is consistent, and whether the ASN looks normal. Otherwise, when emails land in spam, accounts trigger verification, or streaming services act up later, it will be hard to pinpoint the cause.
A friend once bought a very cheap US VPS. The specs looked good and it booted fast. On the first day, he moved WordPress, email notifications, and several cross-border admin panels onto it.
Problems showed up quickly: the website itself loaded fine, but registration emails went to spam, admin logins kept triggering two-factor verification, and some services flagged the network as "abnormal." At first he assumed the system wasn't configured properly and spent ages fiddling with SPF, DKIM, and DNS. In the end he discovered that the machine's IP had been abused before: there were records on AbuseIPDB, and it was listed on several email RBLs.
So when a new VPS arrives, I generally don't build a site or log in to accounts right away. Spending ten minutes checking IP reputation first is far more comfortable than spending days troubleshooting later.
Many people conflate these terms:
- IP blacklist: a security, email, or anti-spam system has put this IP in a risk database
- IP reputation: a platform's overall judgment based on historical behavior, abuse records, ASN, and traffic characteristics
- Geolocation: which country, city, and carrier the databases believe this IP belongs to
- ASN type: whether this IP belongs to a cloud provider, data center, ISP, home broadband, or another kind of network
An IP can be absent from blacklists but still have mediocre reputation; it can geolocate to the US while its ASN is obviously a data center; and IPinfo might show Los Angeles, MaxMind might show Dallas, while some platforms think it's in Canada.
For an ordinary small website, these differences aren't necessarily fatal. But if you're doing email, cross-border admin panels, TikTok, ad accounts, or payment systems, IP reputation matters a lot.
Once the new machine is provisioned, check a few public tools first:
- AbuseIPDB: see whether there are abuse reports
- Spamhaus: see whether it's on common anti-spam lists
- VirusTotal: see whether security vendors have flagged anything abnormal
- Talos Intelligence: check email and network reputation
- MXToolbox: see whether email RBLs are hit
Don't put blind faith in any single tool. Focus on the trend: if multiple tools flag risk, the IP isn't very clean.
If it's just a false positive on an obscure list, you can keep watching; but if Spamhaus, AbuseIPDB, and Talos all look bad, don't rush to use it to log in to important accounts.
Inconsistent geolocation is the source of many account environment problems.
For the same IP, you can check separately:
- IPinfo
- MaxMind demo
- DB-IP
- ip-api
- ip2location
If they're all roughly in the same country, it's not a big deal. Slight city differences are very common, such as Los Angeles vs. San Jose, or New York vs. New Jersey, so don't worry too much.
But if the differences are absurd, be careful:
- The vendor says the US, but databases show Germany
- IPinfo says Singapore, MaxMind says Hong Kong
- IPv4 is the US, IPv6 is another country
- The DNS exit runs off to a third region
Using this kind of IP for cross-border account environments easily creates inconsistent signals.
With ASN, it's not "the more residential the better"; it needs to match your use case.
If you're just building a site, running APIs, or hosting a monitoring panel, a data center ASN is completely normal. IPs from cloud providers like Vultr, Linode, Hetzner, and DigitalOcean are data center IPs by nature.
But if you bought a "residential IP VPS," then you need to look carefully at the ASN. If the page says residential but the ASN is a typical cloud provider, that's not right.
You can check:
curl ipinfo.io
whois 你的IP
Look at a few fields:
- org / ASN name
- country / region
- whether it's marked as hosting / datacenter
- whether it looks like an ISP or home broadband carrier
Don't just look at the vendor's headline. Labels like "native," "residential," or "ISP" are less informative than the actual ASN.
If you plan to run a mail server on the VPS, IP reputation matters even more.
Many cheap VPS IP ranges have been abused before, and the mess left by others sending spam may fall to you. No matter how carefully you configure things and set up SPF, DKIM, and DMARC, if the IP itself is on an RBL, your emails will still land in spam.
For email use, at minimum check:
- Spamhaus
- Barracuda
- SORBS
- SpamCop
- MXToolbox aggregate lookup
- Talos Email Reputation
If it hits multiple mainstream RBLs, I suggest going straight to the vendor for an IP change. Don't spend time appealing right away unless this IP is very important and the vendor clearly won't change it.
One more thing: many vendors block port 25 by default. Ask before buying, so you don't discover you can't send mail only after the mail system is set up.
If this VPS will be used to log in to TikTok, e-commerce admin panels, ad admin panels, or payment admin panels, I suggest not logging in to your main account directly at first.
Do these checks first:
- No obvious issues on IP blacklists
- Geolocation matches the account's region
- DNS isn't resolving through another country
- IPv6 doesn't sneak out through a different exit
- WebRTC doesn't leak other addresses
- System time zone matches browser language
- No pile of random plugins installed
- No shared cookies or browser profiles from previous accounts
This step isn't a guarantee against risk controls; it's about eliminating obvious risks first. Otherwise, once an account triggers verification, it's hard to tell whether it's a dirty IP, a messy environment, or a problem with the account itself.
I generally judge by this standard:
Change the IP:
- It hits mainstream lists like Spamhaus
- AbuseIPDB has many recent records
- Talos email reputation is very poor
- The vendor's promised region clearly doesn't match the databases
- You bought a residential/ISP IP, but the ASN clearly doesn't match the description
- Multiple common platforms are inaccessible right after provisioning
- Searching the same IP range turns up lots of abuse discussions
You can observe first:
- Only one obscure blacklist is hit
- AbuseIPDB has a small number of very old records
- City databases disagree, but the country is consistent
- Ordinary website access works fine, and you're not doing email or account environments
Before changing the IP, send screenshots and query links to customer service. Don't just say "this IP is bad"; support can't do much with that. Give direct evidence: which tool, what result, and why it doesn't match the product description.
Don't blame everything on the IP.
For example:
- Emails landing in spam may be due to SPF/DKIM/DMARC not being configured properly
- A website not loading may be a firewall or Nginx configuration issue
- TikTok asking for verification may be due to inconsistent browser environment and time zone
- An e-commerce admin panel acting up may be because you just changed devices, regions, or login habits
- Streaming not working may be because the platform blocked this range specifically
The best troubleshooting order is: check the IP first, then DNS/IPv6/WebRTC, then the system and browser environment, and finally the platform account itself.
Before ordering, you can ask the vendor directly:
- If the IP is on mainstream blacklists after provisioning, can it be replaced for free?
- If the geolocation doesn't match the page description, is a refund or IP change supported?
- Do residential IP / native IP products have special no-refund terms?
- Is email use allowed? Is port 25 open?
- Do you provide a test IP or looking glass?
- Is an IP change free, paid, or only possible by repurchasing?
The more specific the support answer, the better. If they only reply "it all works normally" or "generally no problem," treat it as no commitment.
My own process is roughly like this:
- Check AbuseIPDB for recent abuse records
- Check Spamhaus / MXToolbox for mainstream RBL hits
- Check Talos / VirusTotal for obvious risk
- Check whether IPinfo, MaxMind, and DB-IP agree on the country
- Check whether the ASN matches the purchase description
- Check whether IPv4 and IPv6 are in the same expected region
- Check whether DNS exits are running wild
- If doing email, confirm port 25 and PTR/rDNS conditions
- If doing account environments, create an independent browser profile before logging in
- Keep query screenshots for easy IP changes with support
This check isn't complicated, but it filters out a lot of pitfalls in advance.
If you're just building a small website, a bit of IP history isn't necessarily a big deal. The key is that the site is stably accessible, search engines can crawl it, and HTTPS and DNS are configured.
If you're building a mail server, IP reputation is critical. For machines that hit mainstream RBLs, unless you have the patience to appeal, changing the IP directly is easier.
If you're logging in to TikTok, e-commerce, ad, or payment admin panels, the first thing to do with a new VPS isn't installing software; it's checking the IP, geolocation, and DNS/IPv6/WebRTC. Until the environment is confirmed clean, don't test with your main account.
A cheap VPS doesn't mean a cheap IP. Often what you're buying isn't a configuration problem, but the IP history left behind by others. Check it clearly first, then decide whether to keep using it.