The short answer
An IP range blacklist check looks up every address in a subnet on DNS blacklists such as Spamhaus ZEN, Barracuda, SpamCop and UCEPROTECT, instead of one IP at a time. On our Scale plan you add a range like 198.51.100.0/24 once, every public address in it becomes a monitored IP, and all of them are re-checked on 109 lists every 5 minutes.
Scale costs $1,499 a month, or $749 a month billed yearly, and holds 5,000 monitored domains and IPs. Each address of a range uses one slot, so a /24 takes up to 256 slots and a /22 up to 1,024. Hosting providers, VPS companies, MSPs and email service providers use it to catch the one abusive tenant before the whole block gets a reputation problem.
Why a single IP lookup is not enough for a hosting company
Hosts reuse addresses constantly. A customer cancels, the IP goes back into the pool, and the next customer inherits whatever that address did last month. If nobody checks before handing it out, the new tenant opens a ticket saying their mail bounces on day one, and your support team spends an hour on something a check would have caught in seconds.
Lists also escalate. Several blacklists, UCEPROTECT Level 2 and Level 3 being the best known, list a whole allocation or ASN after enough single addresses in it are reported. One compromised WordPress box sending spam from 203.0.113.47 can end up hurting every customer in the /24. Watching the range as a unit, with alerts per address, is how you find that box while it is still one listing.
Free range scanners exist and are fine for a one-off look at a /24. What they do not do is run again in five minutes, remember yesterday's result, tell you what changed, or post it into your ticketing. That is the job you pay for.
How subnet blacklist monitoring works here
| Detail | How it works |
|---|---|
| Accepted ranges | IPv4 CIDR from /22 (1,024 addresses) to /32. IPv6 addresses are monitored one by one |
| What gets added | Every public address in the range. Private, reserved and bogon space is skipped |
| Plan slots | One slot per address. 5,000 slots on Scale, shared with your domains |
| Check interval | Every 5 minutes per address, first checks spread over a few minutes so lists are not hit in one burst |
| Lists checked | 109 IP and domain blacklists, including Spamhaus ZEN, Barracuda, SpamCop, UCEPROTECT and PSBL |
| Grouping | Each address is tagged with its range, so you filter the dashboard or the API by range:198.51.100.0/24 |
| Duplicates | Addresses already monitored are skipped, so adding an overlapping range never double counts |
| Alerts | Email, Slack, Microsoft Teams and HMAC signed webhooks, one alert per listed address |
| API | Add ranges and read open listings over the blacklist check API |
Can I check a whole IP range for blacklisting at once?
Yes. On the Scale plan you paste the range in CIDR form, for example 198.51.100.0/24, into the add box or send it to POST /api/v1/assets, and every public address in it is added and checked on 109 blacklists within a few minutes. After that the whole range is re-checked every 5 minutes without anything else to do.
On Business and Agency you can still watch a small block by pasting the single addresses into the bulk add box, one per line. That works well for a few dozen dedicated sending IPs. Range notation itself, the automatic range tag and the API are Scale features.
How do I check if my IP subnet is blacklisted?
For a quick look at one address, type it into the checker at the top of this page; it runs the same 109 lists and shows each result with its removal link. To check a whole subnet, add the range to a Scale workspace, or paste the addresses into the bulk add box on a lower plan, and read the listed count per address on the dashboard.
Check the addresses that actually send mail first: outbound relays, customer VPS IPs with port 25 open, and the IPs behind your shared hosting mail servers. Web-only addresses rarely land on mail blacklists and mostly add noise.
What to do when an address in your range gets listed
- 1 Open the alert. It names the IP, the list, the DNS return code and what that code means on that list, for example a Spamhaus CSS listing for a snowshoe pattern versus an XBL listing for an infected host.
- 2 Find the tenant. Filter by the range tag and the listed address, then match it to the customer in your billing or provisioning system. With a webhook this lookup can open the abuse ticket for you.
- 3 Stop the cause before you ask for removal. Block outbound port 25, suspend the compromised account or fix the open relay. Lists such as Spamhaus relist quickly if the traffic keeps flowing.
- 4 Request delisting through the removal link in the alert. Many lists, including Barracuda and SpamCop, also expire listings on their own once the spam stops.
- 5 Watch the next checks. When the address clears, you get a delisted alert, and the history stays on the asset for the audit trail your abuse team needs.
IP range blacklist check options compared
HetrixTools figures come from its public pricing page and can change. Where it wins is price per address: for a host with tens of thousands of IPs and no need for minute-level alerts, it is the cheaper tool, and we say so on our HetrixTools alternative page. Our prices are on the pricing page.
| Option | Range input | How often | Cost | Best for |
|---|---|---|---|---|
| One-off range scanners | A /24 per scan on some sites | When you click | No charge | A quick look before buying or assigning a block |
| RIPEstat blacklist widget | Any prefix | Historical view, not alerts | No charge | Researching a block's past listings |
| HetrixTools | Each IP counts as a monitor | Every 2 to 24 hours on Business and Enterprise | $39.95/mo for 2,048, $99.95/mo for 8,192 monitors | Large pools where a twice a day check is enough |
| BlacklistMonitoring Scale | CIDR /22 to /32, one slot per address | Every 5 minutes | $1,499/mo or $749/mo yearly, 5,000 slots | Hosts, MSPs and ESPs whose customers send mail that has to arrive today |
Who buys range monitoring
- Web hosts and VPS providers. Check addresses before you assign them, and catch the compromised customer server before it drags the neighbors onto a range listing.
- Managed service providers. Watch the public IPs of every client office and mail gateway, and route each listing to the right client ticket with a tag and a webhook.
- Email service providers. Watch shared and dedicated sending pools, and see within minutes which pool address a customer's campaign pushed onto a list.
- Companies with their own allocation. If your business owns a /23 or /24 for its mail and VPN gateways, monitor the whole block instead of the three addresses someone remembered to add.
Frequently asked questions
What is the largest IP range I can monitor?
A single range can be as large as a /22, which is 1,024 addresses. Larger allocations are added as several /22, /23 or /24 ranges. Every address uses one of the 5,000 slots on Scale, and addresses already in the workspace are skipped, so overlapping ranges are never counted twice.
Does a blacklisted IP affect the whole subnet?
It can. Most lists, including Spamhaus SBL and XBL and Barracuda, list single addresses, but UCEPROTECT Level 2 and Level 3 and some others list whole ranges or ASNs once enough addresses in them are reported. That is why hosts monitor every address, so one listing gets fixed before it spreads.
How often are the addresses in a range checked?
Every 5 minutes on Scale, the same as single domains and IPs. When you first add a range the checks are spread over a few minutes, about 50 addresses per minute, so the blacklists are not queried in one burst and nothing gets rate limited.
Can I monitor IPv6 ranges?
Not as a range. IPv6 prefixes hold far more addresses than any plan could check, and mail blacklists for IPv6 mostly work per address or per /64. Add the IPv6 addresses your mail servers actually send from as single IPs, which works on every plan.
Is there an API to add ranges and read listings?
Yes. The Scale plan includes the REST API. POST /api/v1/assets accepts a CIDR range with a label and tags, and GET /api/v1/listings returns open listings with the list, return code and removal URL. The API reference has request examples.
How much does IP range blacklist monitoring cost?
Range monitoring is part of Scale at $1,499 a month, or $749 a month billed yearly, with 5,000 slots, 5 minute checks, the API, SSO and webhooks. If you watch a few dozen addresses, Business at $149 a month covers 100 domains and IPs entered one by one.