Cactus

Check an IP address's reputation

Enter an IP address to see who owns it, its reverse DNS name, and whether it appears on public blocklists used to flag spam and abuse.

How this works
  • We only run public DNS lookups (reverse DNS, Team Cymru for the network owner, and a sample of DNS blocklists). We never connect to the IP itself.
  • The IP you enter is used to produce this result and isn't stored.

You're viewing a shared result.

Some flags

216.73.216.240

This IP appears on a public blocklist or two. Worth a closer look before you trust it.

Address type

What kind of address is this?

IP version
IPv4
Scope
Public
Legacy class
Class C

A routable, public internet address - the kind a website or mail server uses.

Network

Who owns this IP

Network owner
AMAZON-02 - Amazon.com, Inc., US (AS16509)
Registry country (where this block was allocated — not where the server is)
US
Routing prefix
216.73.216.0/22

Reputation

Blocklist checks

2 of 9 lists
  • SpamCop bl.spamcop.net Not listed

    Spam sources reported by the people who received it.

  • Barracuda b.barracudacentral.org Listed

    IPs recently seen sending spam or hosting malware. · return code 127.0.0.2

  • DroneBL dnsbl.dronebl.org Not listed

    Abusable infrastructure — open resolvers, proxies, compromised machines. Not necessarily a spam sender.

  • PSBL psbl.surriel.com Not listed

    IPs caught delivering spam to trap addresses.

  • blocklist.de all.bl.blocklist.de Not listed

    IPs reported for attacking servers (SSH, mail, web).

  • SpamRATS all.spamrats.com Not listed

    Dynamic-looking or misconfigured IPs seen sending spam.

  • GBUdb truncate.gbudb.net Not listed

    IPs whose recent traffic was overwhelmingly spam.

  • 0spam bl.0spam.org Not listed

    IPs observed sending spam to the 0spam trap network.

  • S5H all.s5h.net Listed

    IPs seen sending spam or probing the S5H trap network. · return code 127.0.0.2

Multi-engine reputation

VirusTotal

5 of 91 flagged

On VirusTotal, 2 vendor(s) flagged this IP as malicious and 3 as suspicious. A listing is a reason for caution, not proof — shared hosting can be flagged for one bad neighbour.

Source: VirusTotal aggregated vendor verdicts.

Important limitation

Blocklists can lag, can list an entire shared range, and don't cover everything. A listing is a strong reason for caution, not proof of malice; a clean result isn't a guarantee of safety.

Frequently asked questions

What does an IP address reputation tell me?

It shows who owns the IP (the network/ASN and country), its reverse DNS name, and whether it appears on public blocklists used to flag sources of spam and abuse. It's useful for checking a suspicious sender, server, or login-alert IP.

Does being on a blocklist mean an IP is dangerous?

Not always. Blocklists can lag or list a whole shared range, and a clean IP isn't a guarantee of safety. Treat a listing as a strong hint to be cautious, not proof - we check a sample of public lists, not every one.

How our checks work