Security

What is Blacklist?

A blacklist is a list of IP addresses, domains or ranges that a service refuses or restricts. Public DNS blacklists such as Spamhaus target mail abuse, while anti-bot vendors, CDNs and individual sites keep private ones. An address lands on a list after abuse reports, spam or automated traffic, and removal ranges from automatic expiry to a manual delisting request.

Public mail blacklists run over DNS. A resolver reverses the octets of the address, appends the list's zone so that 198.51.100.5 becomes 5.100.51.198 followed by the zone name, then reads the answer. A 127.0.0.x record means listed and NXDOMAIN means clean, with a TXT record carrying the reason and a link. Spamhaus splits its data by cause, keeping separate zones for known spam sources, compromised machines and end-user ranges that should never speak SMTP directly, plus a combined zone that queries all of them at once.

Web blocking works nothing like that. Cloudflare, Akamai and the commercial anti-bot vendors keep their scoring private, with no zone to query and no delisting form, so the first evidence of a listing is a 403, an endless challenge loop or a 200 with no content in it. Individual sites stack their own layer on top, whether that is a firewall rule or a fraud tool that flags the address quietly at checkout. Each decides independently, which is why one address can be dead on a marketplace and perfectly fine everywhere else.

CGNAT changes the arithmetic for carrier addresses. When a single mobile IP fronts a large pool of paying subscribers, a site that blocks it also blocks those people, so blanket bans on carrier ranges tend to be rare and short-lived. Mail is the exception. Providers routinely list dynamic and mobile ranges as ineligible to send SMTP directly, which is a policy decision rather than a punishment. The same address stays usable for browsing and is useless for delivering mail from your own server.

Delisting depends on which list holds you. Many entries expire on their own once the traffic that created them stops, and several public lists accept a self-service removal request, worth submitting only after the source is fixed, since a repeat listing is harder to clear than the first. Proxy work calls for a different response. Stop pointing that address at the target and change whatever produced the listing, because a fresh IP running the same pattern arrives in the same place.

Where you meet it

The word covers two situations that behave nothing alike. A mail blacklist publishes a lookup and a reason, and often a removal form as well. An anti-bot listing you can only infer from behaviour, and nobody will confirm it exists. When a target starts refusing an address, query the public lists first because it costs one DNS lookup. Then treat the rest as private scoring, and repeat the request from a second IP to confirm the block is about the address at all.

Common questions

How do I know if my proxy IP is blacklisted?

For mail-oriented lists, run the address through a DNSBL lookup that queries the major zones at once. For websites there is no lookup, so compare behaviour instead. Send the same request with the same client and headers through the suspect IP and through a known-good one, and a difference in response isolates the address as the cause.

Do mobile proxy IPs get blacklisted?

Less often by websites, because CGNAT means a block also hits genuine subscribers on the same address. Mail is different, since carrier and dynamic ranges are commonly listed as ineligible to send SMTP directly. Any individual site can still flag a mobile address after seeing automated traffic from it.

How long does a blacklisting last?

It depends entirely on the list. Automated listings frequently expire once the abusive traffic stops and nothing new is reported, while manual or policy entries can persist until you ask for removal or the address is reassigned. Private anti-bot scoring publishes no duration at all, so treat those as indefinite and rotate.

Related terms

IP Reputation
IP reputation is the trust score a website, mail server or anti-bot system assigns to an IP address based on the traffic it has produced before. Spam complaints, request patterns, past abuse reports, hosting type and ASN ownership all feed that score. A poor one earns CAPTCHAs where a good one passes, or a refusal with no explanation.
Anonymity
Anonymity, in proxy terms, is how much a destination server can learn about the client behind a connection. Proxy listings grade it by whether the proxy forwards your real IP or announces itself in request headers, though DNS, WebRTC and TLS details can give away the same information a header would.
Anonymous Proxy
An anonymous proxy hides the client's real IP address from the destination server but still identifies itself as a proxy, typically through a Via or Proxy-Connection header. The site learns that an intermediary is in the path and can act on that, without ever learning where the request originated.
Elite Proxy
An elite proxy, also called a high-anonymity or level 1 proxy, forwards requests without adding Via, X-Forwarded-For or any other header that reveals an intermediary. To the destination server the traffic reads as an ordinary direct connection from the proxy's own IP address. That address can still be classified.
Transparent Proxy
A transparent proxy intercepts traffic without any client configuration and passes the client's real IP to the destination, usually in an X-Forwarded-For header alongside Via. ISPs, schools and corporate networks deploy them for caching and content filtering. They give the user no privacy and are visible to any server that reads headers.
Whitelist
A whitelist is an explicit list of IP addresses, ranges or identities that a system allows, with everything else denied by default. Firewalls, admin panels, API gateways, database hosts and proxy providers all use them. On the proxy side, whitelisting your server's public IP lets it connect without sending a username and password.
IP Authentication
IP authentication authorizes a proxy client by the source address of its connection instead of a credential. You register the public IP of the machine that will connect, and the provider's gateway accepts sessions from it while refusing the rest. There is no Proxy-Authorization header to send and no password sitting in a config file.

Real 4G/5G mobile and residential IPs

PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.

View pricing Browse the glossary