Run any IP blacklist checker on a server or a VPN address and there is a good chance something comes back red. The question nobody answers is whether that red means anything.
So we tested it. We took 1,000 real IP addresses from four very different places on the internet, checked every one against the same 15 blocklists our blacklist check tool uses, and looked at what each listing actually said.
How we ran the test
The 1,000 addresses:
- 300 Tor exit nodes, picked at random from the Tor Project's public exit list on 23 October 2026.
- 300 AWS EC2 addresses, picked at random from Amazon's published EC2 ranges, weighted by range size.
- 200 Google Cloud addresses, picked the same way from Google's published cloud ranges.
- 200 DigitalOcean addresses, picked the same way from DigitalOcean's published ranges.
The 15 blocklists: Spamhaus ZEN, Barracuda, SpamCop, UCEPROTECT Level 1, UCEPROTECT Level 2, PSBL, Spam Eating Monkey, NordSpam, Mailspike, 0spam, s5h, SPFBL, blocklist.de, JustSpam and GBUdb Truncate.
Before counting anything, every list had to pass the standard self test from RFC 5782: the test address 127.0.0.2 must come back as listed and 127.0.0.1 must come back clean. All 15 passed. That step matters more than it sounds. Some lists answer "listed" for every address when they refuse a query, and a checker that does not test for that will tell you that Google's own DNS server is blacklisted. Ours used to do exactly that, which is why we rebuilt it.
Of 15,000 lookups, 5 timed out and were left out. Everything else is below.
The results by the numbers
| Group | IPs tested | On at least one list | On 3 or more lists | Average lists per IP | On Spamhaus (any code) |
|---|---|---|---|---|---|
| Tor exit nodes | 300 | 98.7% | 57.3% | 3.77 | 88.0% |
| AWS EC2 | 300 | 2.0% | 0.0% | 0.02 | 1.0% |
| Google Cloud | 200 | 78.0% | 0.0% | 0.85 | 22.0% |
| DigitalOcean | 200 | 30.5% | 0.5% | 0.36 | 20.0% |
At first glance Google Cloud looks almost as dirty as Tor. It is not, and the reason is the most useful thing we found.
A listing is not always about you
Blocklists do not all mean the same thing. Two kinds of listing are common and are not accusations against your specific address.
Policy listings. Spamhaus ZEN answers with different codes depending on why an address is listed. Codes 127.0.0.10 and 127.0.0.11 mean the address is on the Policy Block List (PBL): a range that is not supposed to send email straight to other mail servers. Home broadband sits there by design. So do large parts of the big clouds. It says nothing about spam.
Network level listings. UCEPROTECT Level 2 does not list single addresses. It lists a provider's whole block when enough addresses inside it misbehave. If you rent one clean server in that block, you are listed with everyone else.
Here is what happens to the numbers when you set those two aside:
| Group | Flagged by any list | Real listing of the address itself | Spamhaus policy only (PBL) | UCEPROTECT L2 was the only list |
|---|---|---|---|---|
| Tor exit nodes | 98.7% | 98.7% | 2.7% | 0.0% |
| AWS EC2 | 2.0% | 1.0% | 1.0% | 0.0% |
| Google Cloud | 78.0% | 4.0% | 22.0% | 52.5% |
| DigitalOcean | 30.5% | 8.5% | 18.5% | 5.5% |
Google Cloud drops from 78% to 4%. More than half of its sampled addresses were flagged by UCEPROTECT Level 2 and nothing else, and every Spamhaus hit on Google Cloud was a policy code. DigitalOcean drops from 30.5% to 8.5%, and only 1.5% of its addresses had a Spamhaus listing that was not policy.
Tor does not drop at all. Its listings are real: 85% of the exit nodes we sampled were in Spamhaus's exploits list (XBL), the part of ZEN that tracks infected or abused machines.
List by list
Not every list flags the same things. This is the share of each group each list flagged:
| Blocklist | Tor exit nodes | AWS EC2 | Google Cloud | DigitalOcean |
|---|---|---|---|---|
| Spamhaus ZEN | 88.0% | 1.0% | 22.0% | 20.0% |
| s5h | 95.7% | 0.0% | 3.0% | 5.0% |
| SpamCop | 41.0% | 0.0% | 0.0% | 0.0% |
| UCEPROTECT L2 | 31.3% | 0.0% | 59.0% | 6.5% |
| JustSpam | 25.0% | 0.0% | 0.0% | 0.5% |
| Mailspike | 19.7% | 0.0% | 0.0% | 0.5% |
| SPFBL | 19.7% | 0.0% | 0.5% | 3.0% |
| Barracuda | 14.7% | 1.0% | 0.5% | 0.5% |
| GBUdb Truncate | 13.3% | 0.0% | 0.0% | 0.5% |
| UCEPROTECT L1 | 12.7% | 0.0% | 0.0% | 0.0% |
| Spam Eating Monkey | 8.7% | 0.0% | 0.0% | 0.0% |
| blocklist.de | 7.3% | 0.0% | 0.0% | 0.0% |
| NordSpam | 0.0% | 0.0% | 0.0% | 0.0% |
| PSBL | 0.0% | 0.0% | 0.0% | 0.0% |
| 0spam | 0.0% | 0.0% | 0.0% | 0.0% |
A few things stand out. s5h listed almost every Tor exit and very little else, so it is effectively a Tor detector. SpamCop listed 41% of Tor exits but no cloud addresses at all. Three lists flagged nothing in our sample, which tells you they focus on mail servers caught sending spam, not on general address reputation.
What this means if your IP shows up
You are on a home connection. If the only hit is Spamhaus with a PBL note, that is normal and not a problem for anything except running your own mail server. Ignore it. If you see an XBL note, a device on your network may be infected. Check routers, cameras and old computers first.
You run a server in the cloud. Expect the Spamhaus PBL and possibly UCEPROTECT Level 2. Neither is about your server. If you need to send email, send through a mail provider or a relay service rather than straight from the server, and set up SPF, DKIM and DMARC for your domain. Our email header and DMARC study explains those records.
You are on a VPN or Tor. Listings come with the territory. Sites that check reputation may show you extra captchas or block sign ups. That is the address, not you.
You run a mail server and delivery dropped. This is when a listing really matters. Look at which list flagged you, fix the cause first, then request removal.
How to get removed from the main lists
Fix the cause before you ask. Most lists relist quickly if the problem is still there.
- Spamhaus. Look up the address at check.spamhaus.org. PBL entries for addresses that really do run a mail server can be removed through the PBL form. XBL entries clear once the infection is gone and you submit the removal. SBL listings usually go through your hosting provider.
- Barracuda. Submit the removal request form on barracudacentral.org.
- SpamCop. Listings expire on their own about 24 hours after spam reports stop.
- UCEPROTECT. Level 1 entries expire on their own after a period with no new hits. Level 2 is about your provider's network and cannot be removed by one customer.
- Everything else. Our blacklist check shows a "Get removed" link next to every list that flags your address.
For more background on how listings start, see Is my IP blacklisted?.
The bottom line
A red result on a blacklist check is not a verdict. In our test, Tor exit nodes were listed almost everywhere, and those listings were real. Cloud servers looked bad mainly because of policy lists and listings that cover a provider's whole network, which have little to do with the specific address. Google Cloud went from 78% flagged to 4% once those were set aside. Before you panic about a listing, check which list it is and what code it returned. Our blacklist check now shows that for you, including a separate "policy list" label for Spamhaus PBL entries.