Due Diligence Checklist for Buying an IPv4 /24 Block
A /24 block is 256 IPv4 addresses. At current market rates of $30-50 per IP, that's a $7,500-$12,800 purchase. Most buyers check ARIN transfer eligibility and blacklist status. Almost nobody checks the neighborhood — and that's where the hidden risk is.
The 8-Point Checklist
- Spamhaus SBL check — every IP, not just a sample. A single SBL listing means the block has been used for spam. Delisting takes days and requires proving the abuse has stopped. If the seller can't delist before transfer, negotiate accordingly. This is the single most impactful check.
- Full RBL scan across 10+ blacklists. Spamhaus isn't the only one. SpamCop, Barracuda, and DroneRBL all matter for enterprise email. Check all 254 IPs, not a sample — sampling misses isolated listings that can still cause delivery problems.
- PTR record audit. Reverse DNS tells you who's been using each IP. A block full of custom PTR records (e.g.,
mail.brandname.com) means legitimate senders were here — good sign. All generic PTRs (e.g., static.1.2.3.provider.com) means the block was used for hosting, not email. No PTRs at all means a ghost block with zero reputation history.
- Occupancy rate. What percentage of the 254 IPs have any PTR record? High occupancy (90%+) means active use. Low occupancy (<50%) means the block has been sitting idle — no reputation to inherit.
- Adjacent /24 blocks. Check the /24 immediately above and below yours. Spamhaus sometimes lists at /23 granularity. If your adjacent block has 5 SBL listings, you're at risk of collateral damage even if your block is clean.
- WHOIS/RDAP registration history. When was the block registered? Who owns it? A block that's changed hands 3 times in 2 years is suspicious. A block held by a known ESP or hosting provider for 10 years is safer.
- Spamhaus PBL status. If any IPs are on the Policy Block List, it means the block was previously allocated as dynamic/residential space. This is not a spam listing — PBL removal is free and instant. But it tells you the block's history isn't enterprise email.
- XBL/CBL status. These indicate compromised hosts — malware, open proxies, botnets. If present, someone was running insecure infrastructure on these IPs. The listings auto-expire, but the root cause (compromised server) may recur if the new owner doesn't secure the infrastructure.
Pricing Guidance Based on Block Quality
| Block quality | Characteristics | Fair price range |
|---|
| Premium (A grade) | 90%+ occupancy, 20+ identified senders, zero SBL, clean adjacent blocks | $40-50/IP |
| Standard (B grade) | 70%+ occupancy, some senders identified, no SBL, minor RBL hits | $30-40/IP |
| Discount (C grade) | Mixed occupancy, few senders, 1-2 SBL (delisted), some RBL hits | $20-30/IP |
| Distressed (D/F grade) | Ghost block, active SBL listings, dirty adjacent blocks | $10-20/IP or pass |
These ranges assume ARIN region, clean transfer eligibility, and no LOA issues. Adjust for RIPE/APNIC availability premiums.
Red Flags That Should Kill the Deal
Active SBL listings the seller won't delist. If they can't or won't clean up before transfer, the block is damaged goods. Walk away or demand a 50%+ discount.
Spamhaus DROP listing. This means the IP space has been flagged as hijacked. Do not buy. Verify allocation with the RIR directly.
Both adjacent /24 blocks are dirty. Collateral damage risk is too high. Even if your block is clean today, a /23-level listing from a neighbor will impact you.
Block registered less than 6 months ago to current seller. Could be a flip — seller bought cheap, did nothing to clean it, selling at markup. Check what the block looked like 6 months ago.