Four lookups run in parallel
When you submit an address the server starts four jobs at once: an ownership query to ip-api.com, the full set of IP blocklists, a reverse DNS lookup, and an AbuseIPDB query that only runs when the operator has set an API key. Private and reserved addresses are refused before any of this, because they have no public reputation to measure.
ip-api.com supplies the ASN, the AS name, the ISP and organisation strings, the city and country, and three booleans: hosting, proxy and mobile. If that service fails or times out the Network card shows Unknown for those rows and no network deduction is applied. The tool never fills the gaps with placeholder data.
Reading the risk level and the signals
A score of 80 or more is LOW risk, 50 to 79 is MEDIUM and anything below 50 is HIGH. The thresholds are deliberately simple. The Signals list is where the information is. Each line is marked pass, warn, fail or info and states the exact reason, for example which lists returned a hit or which PTR name failed to resolve back.
Two signals deserve care. The proxy label comes from a third party and is known to misfire on shared infrastructure such as public DNS resolvers and large CDNs. And a note that some blocklists could not be queried means the score was computed from fewer inputs, so a LOW result in that case is weaker evidence than usual.
Hosting, mobile and residential flags
Belonging to a data-centre network is not misconduct, which is why it costs only 5 points. It is context: servers, crawlers and APIs live there, individual customers mostly do not. A login from a hosting range therefore deserves a second look where a login from a residential ISP would not.
Mobile carrier addresses carry no deduction at all. Carrier-grade NAT puts thousands of subscribers behind one public address, so any blocklist hit or abuse report on it says little about the person in front of you. When all three flags are false the tool shows the ISP / residential pill.
Reverse DNS and what receivers expect
A sending mail server needs a PTR record, and the name in that record should resolve back to the same address. Missing PTR is a 10-point deduction and a warning, because many receivers reject such connections outright. A PTR that does not resolve back is a 5-point deduction. The result page prints the names it found so you can fix the mismatch.
- No PTR: ask the address owner (usually your host or ISP) to add one
- PTR present but not confirmed: add an A or AAAA record for that name pointing to the IP
- Several PTR names: keep one; the first three are tested
- Banner, PTR and HELO name should agree; the SMTP test shows the banner
AbuseIPDB and the limits of a heuristic
When an API key is configured the Network card gains two rows, the abuse confidence percentage and the number of reports in the last 90 days, and a signal that fails at 50 percent confidence or above. Without a key those rows simply do not appear. The score is computed from the remaining inputs.
The score is for triage, not for automatic blocking. Blocklist data lags behind both abuse and clean-up, third-party labels can be wrong, and results are cached briefly, so confirm with the per-list evidence before acting. For ownership, geolocation and routing detail on the same address, open the IP lookup. For a sending domain's own posture, check its blacklist status.