[{"data":1,"prerenderedAt":71},["ShallowReactive",2],{"blog-post-what-is-a-dirty-ip":3},{"id":4,"meta":5,"title":21,"author":22,"body":26,"introduction":64,"date":65,"tags":66,"category":69,"blog_image":70,"intro":64,"featured":10},1345,{"type":6,"detail_url":7,"html_url":8,"slug":9,"show_in_menus":10,"seo_title":11,"search_description":11,"first_published_at":12,"alias_of":13,"parent":14},"blog.BlogPage","https:\u002F\u002Fwww.staging.doprax.rocks\u002Fd\u002Fapi\u002Fv2\u002Fpages\u002F1345\u002F","https:\u002F\u002Fwww.staging.doprax.rocks\u002Fd\u002Fdoprax-blogs\u002Fwhat-is-a-dirty-ip\u002F","what-is-a-dirty-ip",false,"","2026-09-28T12:06:13.271510Z",null,{"id":15,"meta":16,"title":20},109,{"type":17,"detail_url":18,"html_url":19},"blog.BlogIndexPage","https:\u002F\u002Fwww.staging.doprax.rocks\u002Fd\u002Fapi\u002Fv2\u002Fpages\u002F109\u002F","https:\u002F\u002Fwww.staging.doprax.rocks\u002Fd\u002Fdoprax-blogs\u002F","Doprax Blogs","What Is a Dirty IP?",{"id":23,"username":24,"full_name":25},5,"Swetlana","Swetlana A",[27,34,40,46,52,58],{"type":28,"value":29,"id":33},"section",{"title":30,"content":31,"subsections":32},"What \"dirty\" means","\u003Cp data-block-key=\"amfx0\">Every server on the internet has an IP address. There are only about 4.3 billion IPv4 addresses in total, so providers reuse them. When someone deletes a server, its IP goes back into a pool, and later a new customer receives it.\u003C\u002Fp>\u003Cp data-block-key=\"7d1by\">Security companies and email providers keep records of IP addresses that behave badly. If an address sent spam, attacked other servers, or hosted malware, it gets a low reputation score or is added to a blocklist. That record belongs to the address, not to the person who caused the problem. So when the IP moves to a new owner, the bad reputation often moves with it.\u003C\u002Fp>\u003Cp data-block-key=\"m7w6z\">A dirty IP is an address with a bad reputation from past use.\u003C\u002Fp>",[],"5e5304cb-9e03-42e5-beb4-23fe206a2db1",{"type":28,"value":35,"id":39},{"title":36,"content":37,"subsections":38},"How an IP gets a bad reputation","\u003Cul>\u003Cli data-block-key=\"uvpo4\">\u003Cb>Spam.\u003C\u002Fb> Sending bulk or unwanted email is the fastest way to get an IP listed.\u003C\u002Fli>\u003Cli data-block-key=\"37rrb\">\u003Cb>Attacks and scanning.\u003C\u002Fb> Brute-force login attempts and port scans get reported, and the reports are tied to the source IP.\u003C\u002Fli>\u003Cli data-block-key=\"weqod\">\u003Cb>Hacked servers.\u003C\u002Fb> Many dirty IPs belong to owners who never knew their server was compromised. A weak SSH password is often enough for an attacker to take control and use the server for spam or attacks.\u003C\u002Fli>\u003Cli data-block-key=\"103qv\">\u003Cb>Open proxies.\u003C\u002Fb> A proxy or mail relay without authentication lets anyone send traffic through it, and all of that traffic looks like it comes from you.\u003C\u002Fli>\u003Cli data-block-key=\"uy66j\">\u003Cb>Bad neighbors in the same range.\u003C\u002Fb> Some services block a whole range of addresses (for example, a \u002F24 range of 256 IPs) when enough addresses in it misbehave. Your IP can be affected even if it has a clean history of its own.\u003C\u002Fli>\u003C\u002Ful>\u003Cp data-block-key=\"x54l9\">Some services also treat all datacenter IP ranges with more suspicion than home internet connections. That is not a \"dirty IP\" in the strict sense, but the result looks the same to you.\u003C\u002Fp>",[],"a5c7dd08-0f8b-41dd-8723-a78bd051bf6b",{"type":28,"value":41,"id":45},{"title":42,"content":43,"subsections":44},"What a dirty IP can break","\u003Cp data-block-key=\"na2i9\">\u003Cb>Email.\u003C\u002Fb> Mail servers check the sending IP against blocklists like Spamhaus before they accept a message. If your IP is listed, your mail is rejected or sent to spam, even when SPF, DKIM, and DMARC are set up correctly.\u003C\u002Fp>\u003Cp data-block-key=\"zruys\">\u003Cb>Outgoing requests.\u003C\u002Fb> Services behind Cloudflare and similar protection systems may challenge or block requests from low-reputation IPs. This affects anything your server does on the web: API calls, webhooks, scraping, and package downloads from protected mirrors.\u003C\u002Fp>\u003Cp data-block-key=\"9bjkk\">\u003Cb>Access to your site.\u003C\u002Fb> Some corporate firewalls and security tools block connections to IPs on threat lists. Visitors on those networks may not reach your site at all.\u003C\u002Fp>\u003Cp data-block-key=\"bmpkx\">\u003Cb>Third-party platforms.\u003C\u002Fb> Payment providers, login systems, and some SaaS APIs rate-limit or block traffic from IPs with a bad record.\u003C\u002Fp>",[],"a6826794-7b4e-4a3d-a8d3-ad9f96cc9528",{"type":28,"value":47,"id":51},{"title":48,"content":49,"subsections":50},"How to check your IP","\u003Cp data-block-key=\"bagky\">First, find your server's public IPv4 address:\u003C\u002Fp>\u003Cp data-block-key=\"eh9f9\">curl -4 ifconfig.me\u003C\u002Fp>\u003Cp data-block-key=\"iocle\">Then check it with a few reputation services. Each one uses different data, so check more than one:\u003C\u002Fp>\u003Cul>\u003Cli data-block-key=\"rd1le\">\u003Ca href=\"https:\u002F\u002Fcheck.spamhaus.org\u002F\">Spamhaus IP and Domain Reputation Checker\u003C\u002Fa>\u003C\u002Fli>\u003Cli data-block-key=\"dqx69\">\u003Ca href=\"https:\u002F\u002Fwww.abuseipdb.com\u002F\">AbuseIPDB\u003C\u002Fa>\u003C\u002Fli>\u003Cli data-block-key=\"pf8tq\">\u003Ca href=\"https:\u002F\u002Fmxtoolbox.com\u002Fblacklists.aspx\">MXToolbox Blacklist Check\u003C\u002Fa>\u003C\u002Fli>\u003Cli data-block-key=\"dwhty\">\u003Ca href=\"https:\u002F\u002Ftalosintelligence.com\u002Freputation_center\">Cisco Talos Reputation Center\u003C\u002Fa>\u003C\u002Fli>\u003C\u002Ful>\u003Cp data-block-key=\"2kq1h\">The best time to do this is right after you create a server, before you deploy anything or point a domain at it.\u003C\u002Fp>",[],"b5643504-a021-4360-a529-9262d410d89a",{"type":28,"value":53,"id":57},{"title":54,"content":55,"subsections":56},"What to do if you have one","\u003Cp data-block-key=\"adu37\">\u003Cb>1. Confirm the IP is the cause.\u003C\u002Fb> Try the same request or email from a different server or network. If it works there and fails from your server, the IP is the likely cause. If it fails everywhere, the problem is somewhere else (your configuration, DNS, or the service itself).\u003C\u002Fp>\u003Cp data-block-key=\"ju00x\">\u003Cb>2. Make sure the problem is not coming from you.\u003C\u002Fb> If the IP was clean when you started and became dirty later, your server may be compromised. Check for unknown network connections and failed login attempts:\u003C\u002Fp>\u003Cp data-block-key=\"yuevg\">sudo ss -tunp\u003C\u002Fp>\u003Cp data-block-key=\"hcbvf\">sudo grep \"Failed password\" \u002Fvar\u002Flog\u002Fauth.log | tail -n 20\u003C\u002Fp>\u003Cp data-block-key=\"d6d30\">(The second command works on Ubuntu. Other distributions store login logs in different places.) If you find something you did not start, fix the server first. A new IP will get dirty again if the cause is still running.\u003C\u002Fp>\u003Cp data-block-key=\"a1r8z\">\u003Cb>3. Request removal.\u003C\u002Fb> Most blocklists have a removal form. Spamhaus, for example, lets you request delisting after you confirm the problem has stopped. Many lists also remove entries on their own after a period without new reports.\u003C\u002Fp>\u003Cp data-block-key=\"j4egq\">\u003Cb>4. Get a different IP.\u003C\u002Fb> When removal is slow or the IP has a long record, replacing it is often faster. On Doprax you can create a new VM, check its IP with the tools above, and delete the old one. Per-hour billing on ProVM means a test VM costs very little.\u003C\u002Fp>\u003Cp data-block-key=\"sprf0\">\u003Cb>5. For email, fix the rest too.\u003C\u002Fb> A clean IP is only one part of email delivery. Set up reverse DNS, SPF, DKIM, and DMARC for your domain. Also note that outbound port 25 is blocked by default on ProVM to prevent spam. If you run a legitimate mail server, you can request to have it opened.\u003C\u002Fp>",[],"153b2317-4f63-4327-b0de-4b30faea6ac0",{"type":28,"value":59,"id":63},{"title":60,"content":61,"subsections":62},"Keep a clean IP clean","\u003Cul>\u003Cli data-block-key=\"t8mc3\">Use SSH keys and disable password login.\u003C\u002Fli>\u003Cli data-block-key=\"u9xe5\">Install security updates regularly.\u003C\u002Fli>\u003Cli data-block-key=\"ei48c\">Never run a proxy or mail relay without authentication.\u003C\u002Fli>\u003Cli data-block-key=\"68lby\">Watch your outgoing traffic. A sudden jump often means something on the server is sending traffic you did not plan.\u003C\u002Fli>\u003C\u002Ful>\u003Cp data-block-key=\"wztli\">Your IP is part of your server's identity, so treat its reputation like any other part of your setup: check it early and protect it.\u003C\u002Fp>\u003Cp data-block-key=\"6phty\">\u003Ca href=\"https:\u002F\u002Fwww.doprax.com\u002Fproducts\u002Fvirtual-machines\">Create a VM on Doprax\u003C\u002Fa>\u003C\u002Fp>",[],"7ba713e1-52ec-4e80-ba2f-4dec152f9160","\u003Cp data-block-key=\"2mhyq\">You create a new server, deploy your app, and send your first email. It goes straight to spam. An API you depend on returns 403. A site you want to reach shows you a CAPTCHA every time. You did nothing wrong. Your server's IP address has a history, and that history started before you ever used it.\u003C\u002Fp>\u003Cp data-block-key=\"ab85s\">This is a dirty IP.\u003C\u002Fp>","2026-09-28",[67,68],"IP","dirty IP","updates","\u002Fd\u002Fmedia\u002Foriginal_images\u002Fdirty_IP_what_is_it_Doprax.jpeg",1792480239301]