How to Check an IP Block Before You Rent It: WHOIS, Routing History, RPKI, Geolocation and Blacklists

An IP block is only as good as its history. A /24 that was used for spam, sits on a blacklist, geolocates to the wrong country or is announced without valid RPKI can cost you weeks of work after you have moved sites, mail or accounts onto it. This guide is a practical due-diligence checklist for anyone renting IPv4 space, whether a few addresses or several /24 blocks: how to read the registration data, check routing history and RPKI, compare geolocation databases, look up blacklists and reputation scores, and what to agree on in the lease.

Step 1: Read the Registration Data (whois)

# Registration record of the block (RIPE, APNIC, ARIN, AFRINIC or LACNIC answers automatically)
whois 203.0.113.0

# Fields to look at:
#   inetnum / NetRange  : the exact range and its size
#   netname, descr      : who it is assigned to
#   country             : the registered country (not necessarily the geolocation)
#   status              : ALLOCATED PA / ASSIGNED PA / LEGACY ...
#   org, mnt-by         : the holder and the maintainer that can change the record
#   abuse-c / abuse-mailbox : where abuse reports go

The lessor should be the holder of the block or have written authorisation from the holder. Ask for a Letter of Authorization (LOA) if you will announce the block from your own ASN (see announcing leased IP space from your own ASN).

Step 2: Check the Routing History

Who announced the block before, and when, tells you a lot. Frequent changes of origin ASN, long periods announced by networks known for abuse, or announcements in fragments can all mean trouble.

# Current origin ASN(s) and visibility (RIPEstat public API)
curl -s "https://stat.ripe.net/data/prefix-overview/data.json?resource=203.0.113.0/24" | python3 -m json.tool | head -40

# Routing history: which ASNs announced the block and when
curl -s "https://stat.ripe.net/data/routing-history/data.json?resource=203.0.113.0/24" | python3 -m json.tool | head -60

The same information is easy to browse on bgp.he.net (search the prefix) and in the RIPEstat web interface. Also note whether the block is currently announced at all: a block that has not been routed for a long time is often cleaner than one that changes hands every few months.

Step 3: Check RPKI

Many networks drop routes that are RPKI-invalid. Make sure a ROA exists, or will be created, for the ASN that will announce the block, with a correct maximum prefix length.

# Is 203.0.113.0/24 valid when announced by AS64500?
curl -s "https://stat.ripe.net/data/rpki-validation/data.json?resource=AS64500&prefix=203.0.113.0/24" | python3 -m json.tool

The status should be valid. invalid means a ROA exists for a different ASN or prefix length and must be fixed before announcing; unknown means no ROA covers the block yet. More detail: ROA and RPKI explained.

Step 4: Compare Geolocation Databases

Websites and platforms use several geolocation providers, and they do not always agree. Check a few addresses from the block in each of them.

curl -s ipinfo.io/203.0.113.10; echo
curl -s "http://ip-api.com/json/203.0.113.10?fields=country,regionName,city,isp,org,as,hosting"; echo

Also check MaxMind (GeoIP2 demo on maxmind.com), IP2Location and DB-IP on their websites. If the country is wrong in some databases, ask whether the lessor publishes a geofeed and submits corrections (see fixing IP geolocation with a geofeed). For use cases that depend on the IP type (residential, ISP or data center), see how to check whether an IP is native, residential, ISP or data center.

Step 5: Check Blacklists and Reputation

• Spamhaus: look up a few addresses on the Spamhaus IP and domain reputation checker, and make sure the block is not on the Spamhaus DROP list, which many networks block completely.
• Multi-RBL checks: MXToolbox or multirbl.valli.org check dozens of blacklists at once (see IP blacklist check and removal).
• Abuse reports: AbuseIPDB shows recent public reports of attacks from an address or range.
• Fraud and proxy scores: services such as Scamalytics or IPQualityScore rate IPs for fraud risk. These scores matter for e-commerce, payments and social media accounts.

Sample addresses across the whole block (for example .1, .64, .128, .200, .254), not just the first one: a single bad neighbour can say something about the whole range.

Step 6: Test Reachability Where Your Users Are

Run ping and TCP tests to the block from the countries you serve. For mainland China in particular, a range can be fully reachable from abroad and still unreachable locally; see testing site-cluster IP reachability from mainland China. For platform access, see streaming and platform access tests.

Step 7: Agree on the Terms

• Delivery: routed to your server, or announced from your own ASN with an LOA? Who creates the ROA and route objects?
• Reverse DNS: can you set PTR records yourself, or will the lessor set them on request (see setting up rDNS)?
• Geolocation: who maintains the geofeed and submits corrections?
• Abuse handling: where reports go, how fast you must respond, and what happens if you do not.
• Replacement: what happens if addresses turn out to be blacklisted or unreachable in your market shortly after delivery.
• Term and notice: the minimum period and how much notice either side must give before ending the lease.

FAQ

Is a "clean" block one that was never used?

Not necessarily. Unused blocks can still be missing from geolocation databases or have no ROA. A block with a long, quiet history under a reputable network is often the better choice.

The registered country differs from the geolocation. Is that a problem?

The whois country is the registration, not the location. What usually matters for websites and platforms is the geolocation databases. Make sure they show the country you need.

Where can I rent IP blocks from IMIDC?

See our IP rental page for the available locations, and contact sales with your intended use and the checks above that matter to you.

Still stuck after following these steps? Open a support ticket and the IMIDC 24/7 technical team will help. Include the IP block, your intended use and the results of the checks above so we can pinpoint the issue faster.