I have discovered that one of the IP addresses my company's domain names has been assigned to has blacklisted. It's a new domain and address for us. There's no website attached to it, but very often email using that address is getting filtered out.

Further investigation showed that the whole IP address block is blacklisted e.g. 123.456.789.x

Why would a whole block be blacklisted?


It's probably because of a couple of reasons:

  • The IP block was earlier assigned to someone who used it to spam or spread malware.

  • The IP Block belongs to a country that the site/company doesn't want connections from - generally done for countries that have a very high quantity of malicious traffic originating from them.


I have been involved with incidents where an attacker used a particular cloud service or VPS provider and their IP would rotate between an unpredictable range of IPs within a CIDR block. So, instead of blocking each IP as they appeared, we blocked the whole CIDR block until the attacker gave up.

It is easy to imagine that someone used the same technique and simply forgot to review the blocking rule.

  • 153.126.131.X is being blocked by Spamcannibal. – mycowan Dec 23 '16 at 3:54
  • @mycowan ok. But adding these specific details radically changes your question. Instead of a general question, you now are asking why this one entity would block that address range. – schroeder Dec 23 '16 at 7:07
  • Using SpamCannibal's own tools (spamcannibal.org/cannibal.cgi), it is because that entire range is classified as "generic/anonymous/un-named IP", which appears to be a misconfiguration on their end or the database is out-of-date. – schroeder Dec 23 '16 at 7:11

Do you have control over the whole block of IPs? Or is it shared with other sites?

Some filtering rules or services do automatically blacklist a whole class C block, based on a proactive assumption that bad hosts come from bad neighborhoods. A rather "guilty until proven innocent" form of vigilante internet justice in my opinion.

Yes, sometimes it makes sense to knock out the whole block, but I've seen more than one small business get knocked offline because a completely unrelated site with a similar IP address had a compromised forum script. :-/

  • The block addresses belongs to the company hosting our servers. – mycowan Dec 27 '16 at 1:34

This might be cause by anything from potential malware infection on your IP address block to someone sending spam from that IP address.

You can use tools like online blacklist checkers to see which blacklisting service has done it and why. One of them is: http://whatismyipaddress.com/blacklist-check

tl;dr It might be a case of malware or spam in your network or simply misuse by someone using the IP address before your purchased the block.


To be fair, it is not really a whole "block". This is a just 255 addresses in /24 subnet which is safer to block as almost all organizations own subnets larger than the 256 address block. Like @Adamlive suggests, one rogue IP address implies at least the /24 block is owned by an attacker. Therefore, better to be safe than sorry.

  • Definition of block: en.wikipedia.org/wiki/… Your assertion about who owns a CIDR block is completely false. – schroeder Dec 22 '16 at 8:01
  • @schroeder, why is that completely false? There might be organizations owning a single public IP, but most do not. Whole /24 or /16 blocks are owned by ISPs, CDNs, and regular companies. – sandyp Dec 22 '16 at 16:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.