Why Your IP Address Gets Flagged
“IP purity” is the informal name for IP reputation: the judgement that mail servers, websites and fraud systems make about an IP address before they decide what to let it do. There is no single purity score and no central authority that issues one. Instead, dozens of independent lists and databases each keep their own record — which addresses sent spam, which ones belong to datacentres, which ones exit the Tor network — and every service you visit consults the combination it trusts. This article explains who keeps those records, why a perfectly ordinary user can inherit a flagged address, what the common flags actually measure, and what you can and cannot do about a bad reputation you did not earn. You can see your own address the way those systems see it with the IP Purity Check.
There is no single purity score
The phrase “IP purity” suggests a laboratory measurement: one number, objectively true, the same everywhere. Reality is messier. Reputation is fragmented across systems built for different jobs. DNS-based blocklists (DNSBLs) exist to help mail servers decide whether to accept a connection. Geolocation and IP-intelligence databases classify what kind of network an address belongs to — residential, mobile, datacentre, proxy. Abuse feeds track addresses seen in attacks. The Tor Project publishes its own list of exit relays. Each source answers a different question, updates on its own schedule, and disagrees with the others whenever their data differs.
Any “score” a checker shows you is therefore a summary of a chosen subset of sources at one moment in time — including the score on this site. Two checkers can give the same address different verdicts without either being wrong, because they consulted different lists. The honest way to read any purity result is as a set of separate signals, each with its own source and its own limits, not as a single grade. That is the shape of the evidence this article walks through, signal by signal.
Why an innocent IP gets flagged
The most common reason has nothing to do with you: addresses are shared and recycled. Many ISPs put hundreds or thousands of homes behind a single public IPv4 address with carrier-grade NAT (CGNAT), so one abusive neighbour poisons the shared address for everyone behind it. Dynamic addresses are reassigned constantly, and reputation follows the address, not the person — the IP you received this morning may have belonged to a spam operation last week. Datacentre ranges are recycled between tenants the same way, and a range once rented to an abusive customer keeps the stain long after that customer is gone. The neighbours problem is common enough to deserve its own story: when your neighbours get your IP blacklisted.
Shared exits spread the same effect further. A VPN or proxy service funnels thousands of users through a handful of exit addresses, so abuse by a few users gets the exit flagged and every user behind it inherits the CAPTCHAs, the blocks and the suspicion. Automated behaviour from a range — aggressive scraping, credential stuffing, vulnerability scanning — earns the same treatment. And some listings are not about abuse at all: policy lists deliberately flag residential and dynamic ranges that should not be sending mail directly to the internet, whatever their behaviour. A flag records what an address looks like from the outside, not what its current user did.
What proxy, hosting and mobile flags actually measure
These three flags come from IP-intelligence databases, and they classify the type of connection, not your behaviour. “Hosting” means the address sits in a range registered to a datacentre or hosting provider. “Proxy” means the database believes the address is a proxy, VPN or Tor exit. “Mobile” means the address belongs to a cellular carrier range. The classification is assembled from allocation records, the owning network, reverse-DNS naming patterns, observed traffic and user reports — a patchwork of heuristics, and one that goes stale as addresses are reassigned.
False positives are routine, and the clearest example is a famous address: Google’s public DNS resolver at 8.8.8.8 returns proxy and hosting flags, because it is an anycast service running on datacentre infrastructure — exactly what the heuristics key on — even though it is not a VPN and nobody “uses” it to hide. Corporate egress points, university networks, iCloud Private Relay and carrier-grade NAT trip the same flags for the same reason. A flag is a database hint, never a verdict, which is why the IP Purity Check shows each signal separately, with its source, instead of hiding them behind one number.
DNSBLs: what a listing means, and how removal works
A DNS-based blocklist publishes its listings as DNS records, which makes checking them fast and universal: reverse the octets of the IP, append the zone name, and query. No answer (NXDOMAIN) means not listed; an answer in the 127.0.0.x range means listed, and the exact code says why — a spam source, a compromised host, or a policy listing for a range that should not send mail. Mail servers run this check when a connection arrives and decide for themselves what to do: reject, defer, or accept and filter harder. Lists carry very different weight: a Spamhaus ZEN listing can get mail refused at thousands of receiving networks at once, while a listing on a defunct or obscure list may matter to nobody.
Removal starts with the cause, not the form. Fix the compromised device, close the open relay, stop the spam run — then ask that list’s operator for delisting, through that operator’s own process. Some listings expire automatically; some need manual review; policy listings for dynamic residential ranges usually stay, because the range genuinely should not be sending mail directly — those users should send through their ISP’s relay or a mail service instead. The step-by-step version, list by list, is in how to get off a DNS blacklist. One warning: no reputable operator charges for delisting, so anyone selling “guaranteed removal” is selling something the operator gives away.
A Tor exit is not a Tor user
Tor traffic reaches the open internet through volunteer exit relays, and every site the traffic visits sees the exit relay’s address, not the user’s. The Tor Project publishes the bulk exit list — the addresses of relays currently allowed to exit — precisely so that services can recognise them. An address on that list says nothing about the person behind any single connection: thousands of users share each exit, for every purpose from journalism and research to abuse, and the exit address cannot tell them apart.
That indistinguishability is why many sites treat exit addresses with extra friction rather than trust: more CAPTCHAs, read-only access, sometimes outright blocks. The site is not accusing any individual user; it is rating the exit as a whole, because it has no way to rate the users behind it. The list itself is a snapshot that changes constantly as relays join, leave and change policy — an address can appear on it and leave it within hours — and the bulk export covers IPv4 only. If your own address appears there and you run no relay, the usual explanation is recycling: the address was an exit under a previous holder.
What you can — and cannot — do about a flagged IP
Start with the cheap moves. Restarting a router usually rotates a dynamic address, giving you a new address with a different history — though the new one may carry its own. Ask your ISP for a fresh address, or for a static IP if you run a server: static addresses are easier to delist and easier to keep clean, because their reputation is yours alone. If a specific list has you, fix the cause and request removal from that operator. Stop sending mail directly from a residential connection — use your ISP’s relay or a mail provider. And if a service blocks you while you are on a VPN, switching exit servers, or disconnecting for that service, usually clears it.
What you cannot do is buy a clean reputation, or force a private platform to unflag you — its appeal channel is the only route, and its internal score is unpublished. Nor does “clean” guarantee trust: a clean result only means no known bad signal fired, and services judge behaviour separately — your account history, your request patterns, and everything your browser reveals, which is why what websites know about you looks beyond the address. Reputation is rented, not owned: it follows the address, it changes as lists update, and the best long-term defence is an address whose history is short, quiet and yours.