192.42.116.101

Country / region

The Netherlands · North Holland · Amsterdam

IP type

Hosting / data center

Native / broadcast

Native IP

Network

AS215125 TOR Exit and More

Reverse DNS

none

Devices seen in subnet

661

• −90

  Tor exit node

  Most risk systems reject Tor exit IPs outright

  What it means

  This address is a Tor exit node; any Tor user in the world may come out of it.

  Which uses care

  Cares most: AI services, Social sign-up, Streaming / short video, Gaming platforms, Cross-border e-commerce

  Why it is weighted this way

  Tor exit lists are public and nearly every risk system rejects them outright, so this is a hard cap: nothing else can pull the score back up.

  Can it be fixed

  An inherent attribute of the IP or its range; nothing a user can change short of a different IP.

• −50

  Abuse reports (abuseipdb)

  Confidence 100%, 649 reports in the last 90 days

  What it means

  Someone reported this IP to an abuse database (AbuseIPDB), typically for SSH brute force, port scanning or comment spam. The reporter may have seen a program on this machine, or a previous tenant.

  Which uses care

  Cares most: Social sign-up, Email sending

  Why it is weighted this way

  Counted at half the database's confidence. Sign-up scenarios care most: IPs with bulk-registration or credential-stuffing history are their first priority to block.

  Can it be fixed

  Reports age out; with no new reports for 90 days the score drops. If your machine is the one scanning, check for implanted software first.

• −45

  Blocklist hit: Spamhaus ZEN

  PBL — range judged dynamic by Spamhaus; XBL — compromised host / open proxy; SBL CSS — automatically detected spam source

  What it means

  A Spamhaus listing means this IP was confirmed sending spam, or the machine is compromised and being used as a relay.

  Which uses care

  Cares most: Email sending; Barely looks at it: AI services, Social sign-up, Streaming / short video, Gaming platforms

  Why it is weighted this way

  This is behavioural evidence, not a profile guess, so it is a hard cap and fatal for email. It carries little weight for scenarios that ignore mail reputation, such as AI services.

  Can it be fixed

  Fix the cause first (shut down the compromised service, remove malware), then request removal from Spamhaus; usually resolved within days.

• −30

  Proxy IP

  2 data sources flag it as a proxy exit, without identifying the type

  What it means

  A source marks this address as a proxy exit without saying whether it is a VPN, a datacenter proxy or something else.

  Which uses care

  Cares most: AI services, Social sign-up, Streaming / short video, Gaming platforms, Cross-border e-commerce

  Why it is weighted this way

  Two or more sources agree, so it counts in full, slightly lighter than a confirmed VPN because the type is unknown.

  Can it be fixed

  These labels are usually applied to whole ranges and are hard to clear by behaviour; moving to an unlabeled range is the practical fix.

• −25

  IP type: Hosting / data center

  Hosting / data center IPs are the main source of automated traffic

  What it means

  This IP sits in a hosting / datacenter range. Platforms assume real people browse from home or a phone, and machines live in datacenters.

  Which uses care

  Cares most: AI services, Social sign-up, Gaming platforms, Cross-border e-commerce; Barely looks at it: Email sending

  Why it is weighted this way

  The most basic signal there is: scrapers, bulk sign-ups and fake traffic overwhelmingly come from datacenters, so risk systems discount the whole range. It says nothing about what you did, only that you share the range.

  Can it be fixed

  The range type cannot be changed. What helps is not stacking other issues on top: stay off blocklists, close unneeded ports, avoid crowded exits.

• −12

  Blocklist hit: SpamCop

  Listed by SpamCop

  What it means

  This IP is on a public blocklist. Most lists record addresses that sent spam or took part in scanning or attacks.

  Which uses care

  Cares most: Email sending; Barely looks at it: AI services, Social sign-up, Streaming / short video, Gaming platforms

  Why it is weighted this way

  A single aggregate list is moderate evidence, so about a dozen points; the email scenario more than doubles it because receiving servers query these lists directly.

  Can it be fixed

  Every list has a removal process, provided the cause is gone; some delist automatically after a quiet period.

• −12

  Blocklist hit: UCEPROTECT L1

  Listed by UCEPROTECT L1

  What it means

  This IP is on a public blocklist. Most lists record addresses that sent spam or took part in scanning or attacks.

  Which uses care

  Cares most: Email sending; Barely looks at it: AI services, Social sign-up, Streaming / short video, Gaming platforms

  Why it is weighted this way

  A single aggregate list is moderate evidence, so about a dozen points; the email scenario more than doubles it because receiving servers query these lists directly.

  Can it be fixed

  Every list has a removal process, provided the cause is gone; some delist automatically after a quiet period.

• −12

  Blocklist hit: SpamRats

  Listed by SpamRats

  What it means

  This IP is on a public blocklist. Most lists record addresses that sent spam or took part in scanning or attacks.

  Which uses care

  Cares most: Email sending; Barely looks at it: AI services, Social sign-up, Streaming / short video, Gaming platforms

  Why it is weighted this way

  A single aggregate list is moderate evidence, so about a dozen points; the email scenario more than doubles it because receiving servers query these lists directly.

  Can it be fixed

  Every list has a removal process, provided the cause is gone; some delist automatically after a quiet period.

• −6

  Attack activity on record

  11 events recorded: Login Attempt ×11

  What it means

  A commercial risk database recorded attacks from this IP: credential stuffing, bulk registration, comment spam and the like.

  Which uses care

  Cares most: Social sign-up, Email sending

  Why it is weighted this way

  Tiered by count rather than linear: 1 and 8 are about the same (someone used it), hundreds are a different story. The cap is kept low because the same record already feeds that vendor's overall score.

  Can it be fixed

  Same as abuse reports: stop the source and the record fades with time.

• −6

  3 open ports

  Open ports: 9001, 9003, 9004

  What it means

  Scanners see ports open on this IP. With admin ports such as 22 or 3389 it is almost certainly a server, not a home router.

  Which uses care

  Barely looks at it: AI services

  Why it is weighted this way

  Mainly corroboration that "this is a server", which the datacenter item already charged for, so only a few points here; AI-type scenarios weight it at 0.3 to avoid charging the same fact three times.

  Can it be fixed

  Close or restrict ports that do not need public access (firewall, non-default port, fail2ban); scanners update within days, then re-check. One of the few items you can change yourself.

• −6

  Heavily shared exit

  661 devices observed in the same subnet; higher risk of guilt by association

  What it means

  Many devices share this exit. Whatever others do on it gets attributed to you as well.

  Which uses care

  Cares most: Social sign-up, Streaming / short video, Cross-border e-commerce

  Why it is weighted this way

  Cross-border e-commerce and social sign-up care most: shared IPs are the leading cause of linked-account bans.

  Can it be fixed

  Move to a dedicated or low-share exit; sharing levels vary widely between plans from the same vendor.

• −5

  No rDNS record

  No PTR record; IPs allocated by established carriers usually have one

  What it means

  This IP has no reverse hostname (PTR record). Addresses allocated by established carriers usually have one.

  Which uses care

  Cares most: Email sending

  Why it is weighted this way

  A few points only: a missing PTR is a weak "unknown origin" signal, not a stain. Email cares more, since receiving servers check it.

  Can it be fixed

  Most hosts let you set a PTR in the control panel; set it to a sensible hostname.

• +5

  Native IP

  Registered and used in the same country, allocated directly by a local carrier

  What it means

  Registered and used in the same country, allocated directly by a local carrier: a "native IP".

  Which uses care

  Cares most: Streaming / short video, Gaming platforms; Barely looks at it: Email sending

  Why it is weighted this way

  A bonus: region-based checks will not trip.

  Can it be fixed

  An inherent attribute of the IP or its range; nothing a user can change short of a different IP.

Listed on 4 of 8 blocklists checked: Spamhaus ZEN, SpamCop, UCEPROTECT L1, SpamRats.

• proxycheck.io 11 attack events recorded
• abuseipdb abuse confidence 100%, 649 reports in 90 days

Open ports observed: 9001, 9003, 9004

Each platform's internal risk labels

Platforms keep their own IP reputation data and ban records and do not publish them. No hit in public sources does not mean a platform has nothing on this IP.

Whether the IP is truly exclusive

Sharing is only the number of devices observed in the same subnet. It cannot show who else is using this exit right now, or what they are doing.

Which accounts this IP has been tied to

Account-to-IP links exist only inside each platform. Accounts previously banned on this IP are invisible to us.

Device, browser and behaviour

Risk systems look at IP + device fingerprint + behavioural rhythm together. A clean IP with an odd fingerprint or behaviour still gets blocked.

Whether the account profile matches the IP

When sign-up country, phone number, payment method, language or time zone disagree with the IP's location, platforms verify further. That is unrelated to IP purity.

• rdap
  542ms
• team-cymru
  68ms
• ip-api.com
  68ms
• proxycheck.io
  93ms
• abuseipdb
  138ms
• cloud-ranges
  8ms
• tor-exits
  8ms
• rdns
  810ms
• shodan-internetdb
  204ms
• dnsbl
  205ms

Machine-readable versions of this report: JSON · plain text · 中文报告