---
title: "Check IP reputation: how often free blocklists agree"
url: https://proxy.wiki/research/ip-reputation-agreement-measured/
type: Research Report
author: "proxy.wiki editorial"
published: 2026-10-21
updated: 2026-10-21
site: proxy.wiki
topics: ["Anti-bot systems"]
data_status: measured
sample: "4,025 draws (4,016 distinct IPv4 addresses): up to 500 from each of 8 free lists plus 1,000 random public addresses; full-list check of 42,830 individually listed addresses"
method: https://proxy.wiki/research/ip-reputation-agreement-measured/#method
key_figure: "40,133 of 42,830 individually listed addresses were on only one of six free blocklists"
license: CC BY 4.0; quote freely with attribution to https://proxy.wiki/
---

# Check IP reputation: how often free blocklists agree

> We checked eight free IP blocklists against each other. 93.7% of individually listed addresses were on only one of the six primary lists.

## Key takeaways

- Of 42,830 addresses named individually by the Tor exit list, Feodo Tracker, CINS Army and blocklist.de on 21 October 2026, 40,133 (93.7%) were on exactly one of six primary lists, and none was on more than three.
- CINS Army and blocklist.de, the two attack feeds, shared 351 addresses out of 41,658, a Jaccard similarity of 0.0084.
- 97.0% of FireHOL level1's 611,044,545 addresses are special-purpose, multicast or reserved space. For a real public address, a level1 hit is usually a Spamhaus DROP hit.
- IPsum held 1,195 of 1,222 Tor exits because one of its upstream feeds labels every running Tor relay as bad reputation. Only 90 exits (7.4%) were on another primary list.
- A control group of 1,000 random public addresses drew 6 hits, all from Spamhaus DROP, which covers 0.40% of public IPv4.

Free IP reputation lists rarely agree with each other. On 21 October 2026 we downloaded eight openly published blocklists in the same second and checked them against one another. Of the 42,830 addresses that the Tor exit list, Feodo Tracker, CINS Army and blocklist.de name one by one, 40,133 (93.7%) appeared on exactly one of the six primary lists in this study. None appeared on more than three.

That matters to anyone who runs a lookup to check IP reputation for a proxy exit, a server or a scraper address. A clean result from one list says little about the next one. A hit on one list is, more than nine times in ten, that list’s opinion alone. Below is how we measured it, what surprised us, and a short script that runs the same check on your own addresses.

## The eight lists and what a listing means

Each list answers a different question, and the overlap figures only make sense once that is clear. Six are primary sources that make their own listing decisions. Two are aggregators built from other lists, so they overlap with their inputs by construction and are kept out of the agreement counts.

| List | Type | What gets an address listed | IPv4 entries | Addresses covered | File date (UTC) |
| --- | --- | --- | --- | --- | --- |
| Spamhaus DROP | Primary | Netblocks Spamhaus says are leased or stolen by spam or cyber-crime operations | 1,687 netblocks | 14,810,880 | 21 Oct 2026, 14:04 |
| Tor exit list | Primary | Exit addresses that TorDNSEL observed when exiting through Tor relays | 1,222 | 1,222 | 21 Oct 2026, 19:47 |
| Feodo Tracker | Primary | Active botnet command-and-control servers | 5 | 5 | 4 Mar 2026 (file header) |
| DShield top 20 | Primary | The 20 /24 networks reported scanning the most targets over three days | 20 networks | 5,120 | 21 Oct 2026, 18:45 |
| CINS Army | Primary | A poor Rogue Packet score or trusted alerts across Sentinel IPS devices, capped at 15,000 | 15,000 | 15,000 | 21 Oct 2026, 19:04 |
| blocklist.de | Primary | Addresses that attacked its users’ servers in the last 48 hours | 27,009 | 27,009 | 21 Oct 2026, 19:42 |
| FireHOL level1 | Aggregator | Union of the dshield, feodo, fullbogons and spamhaus_drop sets | 4,627 | 611,044,545 | 21 Oct 2026, 06:22 |
| IPsum | Aggregator | Any address on its 30-plus source lists, with a count of how many | 120,591 | 120,591 | 21 Oct 2026, 01:01 |

The file dates matter. We fetched all eight at 19:49:09 UTC, but the FireHOL file on GitHub had been built at 06:22 and IPsum’s at 01:01. The two aggregators were roughly 13 and 19 hours older than the lists they include, and that gap shows up in several numbers below.

The Feodo Tracker date is not a typo. Its blocklist held five addresses under a header reading “Last updated: 2026-03-04 14:28:39 UTC”, while the server’s Last-Modified header said 30 June 2026. The project’s blocklist page says its datasets are currently empty. Five addresses cannot carry an agreement statistic, so Feodo appears in the tables for completeness and nowhere in the conclusions.

## Method

Each list was downloaded once with curl at 19:49:09 UTC on 21 October 2026, from the URLs given in the dataset. We kept the response headers and recorded a SHA-256 hash of every file. Spamhaus asks that automated DROP downloads be at least an hour apart and says once a day is enough for most users. We applied one download per list to every source.

Only IPv4 was compared. blocklist.de contained 513 IPv6 lines, which were skipped; no other list had any. Exact duplicates were dropped: the DROP file carried 1,688 records, one of them a repeat.

The sample used Python’s `random.Random` with the seed 20261021. For each list in a fixed order, up to 500 entries were drawn without replacement, and one address was then picked uniformly inside each drawn entry. For a list of single addresses that is simply the entry. Feodo Tracker (5 entries) and DShield (20) were used in full. A control group followed: random 32-bit values, rejecting IANA special-purpose and multicast space, until 1,000 public addresses were kept. 153 of 1,153 draws were rejected, or 13.3%, close to the 13.8% of the IPv4 space those ranges occupy.

That gives 4,025 draws and 4,016 distinct addresses. Every one was checked against all eight lists: an exact match for single addresses, containment for netblocks. “Agreement” on this page means that another _primary_ list also names the address or covers it with a listed netblock.

```
# The sampling step, exactly as run (Python 3.15.0, standard library only)
rng = random.Random(20261021)
for name in ["spamhaus_drop", "firehol_level1", "tor_exits", "feodo",
             "dshield_block", "cins_army", "blocklist_de", "ipsum"]:
    entries = parsed[name]   # IPv4 (start, end) pairs in file order, duplicates removed
    for i in rng.sample(range(len(entries)), min(500, len(entries))):
        start, end = entries[i]
        draws.append((name, rng.randint(start, end)))
while len(control) < 1000:
    x = rng.getrandbits(32)
    if x not in special_purpose:   # IANA special-purpose registry plus 224.0.0.0/4
        control.append(x)
```

Two controls guard the result. The positive control: every sampled address must be found on the list it came from, and all 3,025 list draws were (500 of 500 for each list sampled at 500). The second is a full-list check. For the four primary lists that name single addresses we also compared the entire lists, with no sampling, and every full-list figure fell inside the sample’s 95% interval. The comparison is further down.

## Finding 1: most listed addresses are on one list only

_Share of each list's sampled addresses that at least one other primary list also flags, 21 October 2026_

| List | Addresses sampled | Also on another primary list (%) | 95% interval |
| --- | --- | --- | --- |
| Spamhaus DROP | 500 | 0.2 | 0.0-1.1 |
| blocklist.de | 500 | 3.4 | 2.1-5.4 |
| Tor exit list | 500 | 5.8 | 4.1-8.2 |
| CINS Army | 500 | 13.2 | 10.5-16.4 |
| DShield top 20 | 20 | 35.0 | 18.1-56.7 |
| Feodo Tracker | 5 | 0.0 | 0.0-43.4 |
| Control: random public addresses | 1,000 | 0.6 | 0.3-1.3 |

Read the bottom row first. Six of 1,000 random public addresses were flagged by a primary list, all six by DROP. Spamhaus DROP on its own covers 14,810,880 of the 3,702,258,688 public IPv4 addresses, which is 0.40%, so a rate near half a percent is what chance alone produces. Any list’s hit rate on your own addresses should be judged against that floor.

Against it, the attack feeds agree with each other only a little. CINS Army had the highest rate, 13.2%, and most of that came from DShield’s networks rather than from a second attack feed. blocklist.de, the largest primary list here, had 3.4%. Spamhaus DROP agreed with nobody: one of its 500 sampled addresses was on another primary list.

The exact full-list picture is the same. Of 42,830 distinct addresses named individually by the Tor exit list, Feodo Tracker, CINS Army and blocklist.de, 40,133 were on one primary list, 2,624 (6.1%) were on two, and 73 (0.17%) were on three.

## Finding 2: the two attack feeds barely overlap

CINS Army and blocklist.de both list addresses seen attacking something. They are the closest pair in this study by purpose, and they shared 351 addresses out of 41,658 between them.

| Pair (full lists, no sampling) | List A | List B | Shared | Jaccard similarity |
| --- | --- | --- | --- | --- |
| CINS Army and blocklist.de | 15,000 | 27,009 | 351 | 0.0084 |
| Tor exit list and blocklist.de | 1,222 | 27,009 | 55 | 0.0020 |
| Tor exit list and CINS Army | 1,222 | 15,000 | 0 | 0 |
| Feodo Tracker and each of the three above | 5 | 1,222 to 27,009 | 0 | 0 |
| CINS Army and IPsum (aggregator) | 15,000 | 120,591 | 12,819 | 0.1044 |
| blocklist.de and IPsum (aggregator) | 27,009 | 120,591 | 22,239 | 0.1774 |
| Tor exit list and IPsum (aggregator) | 1,222 | 120,591 | 1,195 | 0.0099 |

351 shared addresses is 2.3% of CINS Army and 1.3% of blocklist.de. The likeliest reason is that the two run different sensors: CINS scores traffic seen by Sentinel IPS devices, while blocklist.de collects reports from its users’ servers. Each sees the attackers that happen to touch its own sensors.

CINS overlapped far more with DShield. 1,522 CINS addresses, 10.1% of the list, sat inside DShield’s 20 networks, which hold 5,120 addresses between them. CINS therefore named 29.7% of all the addresses in DShield’s top 20. The file’s network-name column shows hosting and measurement operators among them rather than consumer ISPs: HURRICANE three times, GOOGLE-CLOUD-PLATFORM once and INTERNET-MEASUREMENT once.

The surprise ran the other way with DROP. Not one of CINS Army’s 15,000 addresses fell inside a DROP netblock, while 600 of blocklist.de’s did.

The IPsum rows look higher only because IPsum imports both feeds. IPsum’s count includes the source list itself. So when 13,002 of blocklist.de’s 27,009 addresses (48.1%) had a count of 1, blocklist.de was usually the only one of IPsum’s 30-plus sources to list them. A further 4,770 blocklist.de addresses (17.7%) were not in IPsum at all, which is what a 19-hour-old snapshot of a 48-hour list looks like.

_How many of IPsum's source lists carried each CINS Army and blocklist.de address (0 = not in IPsum)_

| IPsum count | CINS Army | blocklist.de |
| --- | --- | --- |
| 0 | 2181 | 4770 |
| 1 | 2785 | 13002 |
| 2 | 3340 | 2369 |
| 3 | 3312 | 2066 |
| 4 | 2214 | 1751 |
| 5 | 826 | 1802 |
| 6 | 268 | 931 |
| 7 | 56 | 265 |
| 8 | 14 | 42 |
| 9 | 2 | 8 |
| 10 | 2 | 2 |
| 11 | 0 | 1 |

## Finding 3: 97% of FireHOL level1 never routes on the public internet

FireHOL describes level1 as suitable for basic protection on all internet-facing servers, and its header gives the size: 611,044,545 addresses. Almost all of that is space no public host can use.

_Where the 611,044,545 addresses in FireHOL level1 come from, file built 06:22 UTC 21 October 2026_

| Part of FireHOL level1 | Addresses | Share (%) |
| --- | --- | --- |
| IANA special-purpose and multicast space | 592,708,608 | 97.00 |
| Spamhaus DROP netblocks | 14,806,784 | 2.42 |
| Other public space (fullbogons and feodo inputs) | 3,526,337 | 0.58 |
| DShield top 20 networks | 3,328 | 0.0005 |

The first row is 224.0.0.0/4 multicast, 240.0.0.0/4 reserved space, the private ranges, loopback and the documentation blocks. The third row can only come from the fullbogons and feodo inputs, and Feodo lists single addresses, so it is effectively unallocated public space. Traffic should not arrive from any of it, and none of it says anything about reputation.

For a real public address, then, a level1 hit is mostly a DROP hit. DROP is 80.75% of level1’s 18,335,937 public addresses, and in the control group 6 of the 7 random addresses that level1 flagged were DROP addresses. The sample drawn from level1’s 4,627 entries told the same story from the other side. 159 of 500 landed in DROP space and 339 in public bogon blocks on no primary list. One landed on a Feodo address and one in a DShield network.

Because DROP and DShield are inputs to level1, they also work as a freshness check. DROP should sit inside level1 completely, and 14,806,784 of its 14,810,880 addresses did. The 4,096-address gap fits DROP’s update at 14:04 landing after FireHOL’s 06:22 build. DShield was further off: only 13 of the 20 networks in our 18:45 copy were in FireHOL’s copy, whose source file was dated 05:44. Seven of the top 20 were replaced in about 13 hours.

## Finding 4: Tor exits and proxies are listed for what they are

This is the result that matters most for [proxy users](/guides/residential-vs-datacenter-proxies/). IPsum held 1,195 of the 1,222 Tor exits, 97.8%. Only 90 exits (7.4%) were on any of the five other primary lists: 55 on blocklist.de, 37 inside DROP netblocks, one inside a DShield network, none on CINS Army.

The reason is in IPsum’s upstream. IPsum is compiled from the feeds of the Maltrail project, and Maltrail’s feed modules, read at commit d88331d, include two for Tor. One labels every running relay `bad reputation (tor node)`; the other labels exits `tor exit node (suspicious)`. Two more import public open-proxy lists under the label `proxy (suspicious)`. An address can therefore score on an aggregated reputation list purely for being a Tor relay or for once appearing on a public proxy list.

_IPsum list count for each of the 1,222 Tor exit addresses (0 = not in IPsum)_

| IPsum count | Tor exits |
| --- | --- |
| 0 | 27 |
| 1 | 711 |
| 2 | 301 |
| 3 | 136 |
| 4 | 39 |
| 5 | 8 |

183 exits had a count of 3 or more, a level that IPsum’s own documentation uses as its example of a stricter threshold. A score built by counting lists rewards being listed for many reasons, and some of those reasons describe what an address is rather than what it did.

The 37 exits inside DROP were the other surprise. DROP is meant for networks that should not be routed at all, yet on 21 October 37 Tor exits were running from 17 distinct DROP netblocks.

Shared exits work the same way outside Tor. An address in a [proxy pool](/glossary/proxy-pool/) carries what its other users did, plus any label attached to the kind of address it is. Rotating through more addresses spreads that history around rather than removing it; our guide to [rotating and sticky sessions](/guides/rotating-vs-sticky-sessions/) covers the trade-off. Reputation is also only one reason a target refuses a request, and the response code usually tells you which; see [403 vs 407 vs 429](/guides/403-vs-407-vs-429/). A clean address with a library’s default [TLS handshake](/research/tls-clienthello-fingerprints/) can be blocked before reputation is ever consulted.

## The control group in full

| List | Random public addresses flagged (of 1,000) |
| --- | --- |
| Spamhaus DROP | 6 |
| FireHOL level1 | 7 |
| Tor exit list | 0 |
| Feodo Tracker | 0 |
| DShield top 20 | 0 |
| CINS Army | 0 |
| blocklist.de | 0 |
| IPsum | 0 |

None of the address-level lists flagged a random public address, which is expected: together they name well under 200,000 addresses out of 3.7 billion. Only the two large netblock lists cover enough space to be hit by chance, and they were hit at about the rate their size predicts.

## Sample against full list

Where a list names single addresses we could compare it in full as well as by sample. All of these full-list values fall inside the sample’s 95% interval, which is the evidence that 500 draws per list were enough.

| Measure | Sample estimate | 95% interval | Full list |
| --- | --- | --- | --- |
| Tor exits on another primary list | 5.8% | 4.1-8.2% | 7.36% |
| CINS Army on another primary list | 13.2% | 10.5-16.4% | 12.43% |
| blocklist.de on another primary list | 3.4% | 2.1-5.4% | 4.25% |
| CINS Army inside DShield networks | 11.2% | 8.7-14.3% | 10.15% |
| CINS Army on blocklist.de | 2.0% | 1.1-3.6% | 2.34% |
| blocklist.de inside DROP netblocks | 2.0% | 1.1-3.6% | 2.22% |
| Tor exits inside DROP netblocks | 2.6% | 1.5-4.4% | 3.03% |
| Tor exits on IPsum | 97.6% | 95.9-98.6% | 97.79% |

## How to check an IP’s reputation against these lists

The quickest honest check is to look an address up in several lists of different kinds and read each hit for what that list measures. Download the files once, then query them locally as often as you like. That keeps you inside each project’s download guidance and gives every lookup the same snapshot.

```
# fetch.sh: one download per list into an empty directory
D=${1:?empty dir}; mkdir -p "$D"; cd "$D"
fetch() { curl -sS -L --max-time 60 -D "$1.headers" -o "$1.body" "$2"; }
fetch spamhaus_drop_v4 https://www.spamhaus.org/drop/drop_v4.json &
fetch firehol_level1  https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level1.netset &
fetch tor_exits       https://check.torproject.org/torbulkexitlist &
fetch feodo           https://feodotracker.abuse.ch/downloads/ipblocklist.txt &
fetch dshield_block   https://feeds.dshield.org/block.txt &
fetch cins_army       https://cinsscore.com/list/ci-badguys.txt &
fetch blocklist_de    https://lists.blocklist.de/lists/all.txt &
fetch ipsum           https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt &
wait
```

```
#!/usr/bin/env python3
"""check_ip.py: look IPv4 addresses up in the files fetch.sh downloaded.
Usage: python3 -I check_ip.py <raw_dir> <ip> [<ip> ...]   (tested on Python 3.15.0)"""
import bisect, ipaddress, json, os, sys

FILES = {
    "Spamhaus DROP": "spamhaus_drop_v4.body", "FireHOL level1": "firehol_level1.body",
    "Tor exits": "tor_exits.body", "Feodo Tracker": "feodo.body",
    "DShield top 20": "dshield_block.body", "CINS Army": "cins_army.body",
    "blocklist.de": "blocklist_de.body", "IPsum": "ipsum.body",
}

def ranges(path):
    out = []
    for line in open(path, encoding="utf-8", errors="replace"):
        line = line.strip()
        if not line or line.startswith("#"):
            continue
        if line.startswith("{"):                       # Spamhaus JSON lines
            line = json.loads(line).get("cidr", "")
        if not line:
            continue
        tok = line.split()
        try:
            if len(tok) > 2 and path.endswith("dshield_block.body"):
                lo, hi = (int(ipaddress.IPv4Address(t)) for t in tok[:2])
            else:
                n = ipaddress.ip_network(tok[0], strict=False)
                if n.version != 4:
                    continue
                lo, hi = int(n.network_address), int(n.broadcast_address)
        except ValueError:
            continue
        out.append((lo, hi))
    merged = []                       # merge overlaps: lists can nest a block inside another
    for lo, hi in sorted(out):
        if merged and lo <= merged[-1][1] + 1:
            merged[-1][1] = max(merged[-1][1], hi)
        else:
            merged.append([lo, hi])
    return merged, [lo for lo, _ in merged]

def listed(x, table):
    iv, starts = table
    i = bisect.bisect_right(starts, x) - 1
    return i >= 0 and iv[i][1] >= x

raw = sys.argv[1]
tables = {name: ranges(os.path.join(raw, f)) for name, f in FILES.items()}
for ip in sys.argv[2:]:
    x = int(ipaddress.IPv4Address(ip))
    hits = [name for name, t in tables.items() if listed(x, t)]
    print(f"{ip:<16} {len(hits)}/{len(FILES)}  {', '.join(hits) or 'on none of these lists'}")
```

Output against the 21 October files, for a Tor exit, an address from the RFC 5737 documentation block and a public DNS resolver:

```
$ python3 -I check_ip.py raw-20261021 171.25.193.25 192.0.2.1 8.8.8.8
171.25.193.25    2/8  Tor exits, IPsum
192.0.2.1        1/8  FireHOL level1
8.8.8.8          0/8  on none of these lists
```

The first line is the Tor result from Finding 4 in miniature: the IPsum hit is the Tor label, not a second opinion. The second shows FireHOL level1 flagging a block that exists only for documentation.

Merge overlapping ranges before you search them. 40 of DROP’s 1,687 netblocks sit inside another DROP netblock. A lookup that sorts blocks and checks only the nearest start misses an address that falls in the outer block. Our first version of this script did exactly that, and disagreed with the main measurement on one address out of 4,025 until the merge step was added.

When you read a result, three questions do most of the work. What does this list measure: a network judged criminal, a host seen attacking, or simply a Tor relay? How old is the file? And is it an aggregator, whose count may include the same evidence twice? If you need the network an address belongs to before deciding, its [ASN](/glossary/asn/) is usually the next lookup.

## Reproducing this

Run `sh fetch.sh raw/`, then `python3 -I measure.py raw/ out/`. The measurement script uses the standard library only and is included in full in the JSON download, as is fetch.sh. The lists change constantly, so a fresh download will give different numbers. With the same eight files (their SHA-256 hashes are in the JSON) the seed reproduces the same 4,025 draws exactly. We ran it twice and both runs wrote a CSV with the hash `c74e5d1b97949c80` (first 16 hex digits).

## Download the data

One row per draw: 4,025 rows, 14 columns. Each row says which list the address was drawn from, whether each of the eight lists flags it, its IPsum count, and how many other primary lists flag it. The JSON adds the method, the seed, every source’s URL, hash, entry count, file date and terms, the full summary figures and both scripts. Licensed [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) for this compilation: reuse it with a link to this page.

- [ip-reputation-agreement-measured.csv](/wp-content/uploads/pw-data/ip-reputation-agreement-measured.csv), 4,025 rows, 14 columns

- [ip-reputation-agreement-measured.json](/wp-content/uploads/pw-data/ip-reputation-agreement-measured.json), the same rows plus method, source metadata, summary and scripts

The source lists are not redistributed. Addresses drawn from the Tor exit list (Tor Metrics publishes exit lists under CC0), Feodo Tracker (CC0), CINS Army (published to use “in any way you see fit”), IPsum (The Unlicense) and the random control are included. Addresses drawn from Spamhaus DROP, DShield, blocklist.de and FireHOL level1 are withheld, 1,520 rows in all, because their terms grant no redistribution licence (DROP, blocklist.de, FireHOL level1) or carry a non-commercial share-alike licence (DShield). Their flags are kept, so every figure on this page can be recomputed from the file. Spamhaus DROP is (c) 2026 The Spamhaus Project SLU. DShield data is credited to the SANS Technology Institute, Internet Storm Center.

## Limits

This is one snapshot. blocklist.de covers 48 hours and is regenerated every 30 minutes, DShield’s top 20 covers three days, and Feodo Tracker regenerates every five minutes. The same study run tomorrow will produce different counts, though we would expect the shape to hold.

The snapshots were not simultaneous. All eight files were fetched in the same second, but their contents ranged from 01:01 (IPsum) to 19:47 (Tor) on the same day. Agreement with the aggregators is understated as a result.

Agreement is not accuracy. Two lists can agree and both be wrong, and a list nobody else agrees with can be right. There is no ground truth here, only the overlap between published opinions.

Only free, openly published lists were tested, and only IPv4. Commercial reputation scores and DNS-based blocklists queried per address were out of scope, and the 513 IPv6 entries in blocklist.de were skipped.

For the netblock lists the sample is weighted by entry, not by address: a /16 and a /24 had the same chance of being drawn. The address-weighted view is the FireHOL composition table. Feodo Tracker (5) and DShield (20) are too small for their percentages to mean much, as their intervals show.

Aggregators contain their inputs, so their overlap with those inputs is partly by construction. That is why they are excluded from the agreement counts.

## Data

- [ip-reputation-agreement-measured.csv](https://proxy.wiki/wp-content/uploads/pw-data/ip-reputation-agreement-measured.csv) (CSV, 200.3 KB, 4025 rows)
- [ip-reputation-agreement-measured.json](https://proxy.wiki/wp-content/uploads/pw-data/ip-reputation-agreement-measured.json) (JSON, 1.5 MB, 4025 records)

Licensed CC BY 4.0. Cite <https://proxy.wiki/research/ip-reputation-agreement-measured/>.

## Frequently asked questions

### How do I check an IP's reputation for free?

Download a few free lists of different kinds, such as Spamhaus DROP, the Tor exit list, CINS Army and blocklist.de, and look the address up locally with a script like the one above. Read each hit for what that list measures. On 21 October 2026, 93.7% of individually listed addresses were on only one of the six primary lists we tested, so one lookup is not enough.

### Why is my IP on one blocklist but not the others?

Because each list sees different traffic. CINS Army scores what Sentinel IPS devices observe and blocklist.de collects reports from its users' servers; in our comparison the two shared 351 addresses out of 41,658. Being on one list usually means one sensor network saw something from that address.

### Does being on the Tor exit list mean an IP is malicious?

No. It means the address relays Tor traffic. Only 90 of 1,222 Tor exits (7.4%) were on any other primary list we checked. Aggregated feeds can still count a Tor exit as bad: IPsum held 1,195 of them, because one of its upstream feeds labels every running relay as bad reputation.

### Is FireHOL level1 a reputation list?

Mostly not. 97.0% of its 611,044,545 addresses are special-purpose, multicast or reserved space that never routes on the public internet. For a real public address, a level1 hit is usually a Spamhaus DROP hit, since DROP makes up 80.75% of level1's public addresses.

### Do proxy IPs have a bad reputation?

Some do, for two reasons. A shared address carries whatever its other users did, and some aggregators add labels for the kind of address it is: Maltrail, which feeds IPsum, imports two public open-proxy lists under the label "proxy (suspicious)". Neither says anything certain about the person using the address now.

### How often do these lists change?

Often. blocklist.de regenerates every 30 minutes and Feodo Tracker every five, IPsum updates daily, and DShield's top 20 replaced 7 of its 20 networks in about 13 hours on the day we measured. Spamhaus asks for DROP downloads at least an hour apart and says once a day is usually enough. Always note the file date next to a lookup result.

## Sources

1. [Spamhaus: Do Not Route Or Peer (DROP) lists](https://www.spamhaus.org/blocklists/do-not-route-or-peer/)
2. [Spamhaus: DROP terms of use](https://www.spamhaus.org/drop/terms/)
3. [FireHOL blocklist-ipsets: firehol_level1 and dshield sets](https://github.com/firehol/blocklist-ipsets)
4. [Tor Metrics CollecTor: exit lists published by TorDNSEL](https://metrics.torproject.org/collector.html)
5. [Tor Metrics: about the data and its CC0 licence](https://metrics.torproject.org/about.html)
6. [Tor Project: bulk exit list](https://check.torproject.org/torbulkexitlist)
7. [abuse.ch Feodo Tracker: botnet C2 IP blocklist](https://feodotracker.abuse.ch/blocklist/)
8. [abuse.ch: terms of use](https://abuse.ch/terms-of-use/)
9. [SANS Internet Storm Center: DShield data feeds](https://www.dshield.org/feeds_doc.html)
10. [CINS Score: the CINS Army list](https://cinsscore.com/)
11. [blocklist.de: export lists](https://www.blocklist.de/en/export.html)
12. [IPsum threat intelligence feed](https://github.com/stamparm/ipsum)
13. [Maltrail feed module torprojectnodes.py at commit d88331d](https://github.com/stamparm/maltrail/blob/d88331d351cc989e336e54df60094df9d1313ffb/feeds/torprojectnodes.py)
14. [Maltrail feed module socksproxy.py at commit d88331d](https://github.com/stamparm/maltrail/blob/d88331d351cc989e336e54df60094df9d1313ffb/feeds/socksproxy.py)
15. [IANA IPv4 Special-Purpose Address Registry](https://www.iana.org/assignments/iana-ipv4-special-registry/)
16. [RFC 5771: IANA guidelines for IPv4 multicast address assignments](https://www.rfc-editor.org/rfc/rfc5771.html)
17. [RFC 5737: IPv4 address blocks reserved for documentation](https://www.rfc-editor.org/rfc/rfc5737.html)