Look Up Suspicious IP Addresses on DNS Blacklists

A DNS blacklist (DNSBL) is a database that contains the IP addresses of malicious hosts on the Internet. These hosts are typically email servers that generate large volumes of unsolicited mail messages (spam) or other Internet servers used for network attacks. A DNSBL tracks servers by IP address and also within the Internet Domain Name System (DNS).

DNS blacklists help you to determine whether message senders may be spammers or hackers. You can also report spam and suspicious addresses to a DNSBL for the benefit of others on the Internet. The larger blacklists contain millions of entries.

To use the DNSBL services listed below, type an IP address into the form they provide to look it up in the database. If researching the origin of a spam email, you can obtain its IP address from the mail headers (see: How To Find the IP Address of an Email Sender)

• SORBS database
• Spamhaus block list
• SpamCop blocking list
• SpamCannibal lookup

Finally, note that a DNSBL contains only public addresses, not private IP addresses used on local networks.