A /24 block is 256 IPv4 addresses. At current market rates of $35-55 per IP, that's a $9,000-$14,000 purchase. Most buyers check ARIN transfer eligibility, verify the seller's LOA, and run a quick blacklist check on a sample of IPs. Almost nobody audits the neighborhood — and that's where the hidden risk is.
"An IPv4 block's history and reputation significantly impact its value. IP addresses previously used for spam, phishing, or malicious activities may be blacklisted or considered 'tainted,' reducing their market value. Conversely, clean IP blocks — those with positive reputations and clear histories — command higher premiums."
— IPTrading [1]
"The prices for IP addresses vary depending on the regional internet registry, size of block and how clean it is. As of 2022, a /24 IP block cost around $10,000-$12,000."
— Brander Group [2]
"The truth is, 50-60% of IP addresses often appear on IP blacklists."
— IPv4Connect [4]
Academic research funded by the RIPE NCC found:
"Transferred /24 sub-prefixes are six times more likely to be blacklisted compared to non-transferred prefixes."
— Lancaster University, Simula Metropolitan, UCL [5]
ARIN summarized the same research:
"IP addresses are 4 to 25 times more likely to be blacklisted after the transfer."
— ARIN [6]
A block can have 8 blacklisted IPs out of 254 and a random 10-IP sample will miss them. Full-block scanning — checking all 254 IPs — is the only way to know.
Spamhaus CSS listings auto-expire days after spam stops. A block that was heavily blacklisted six months ago can look clean today. Transferred blocks are statistically more likely to be re-listed because the underlying pattern wasn't addressed.[5]
Two blocks can both be clean on blacklists but have very different value:
Block A — clean, but 180 of 254 IPs have no PTR records. Ghost block. No reputation signal. ISPs see nothing.
Block B — clean, and 230 of 254 IPs have active PTR records with 40+ custom records indicating real businesses. ISPs see a healthy, active neighborhood.
A blacklist check says these blocks are equivalent. PTR analysis says they are not.
Blacklist audit — all 254 IPs. Check every IP against Spamhaus SBL, XBL, CBL, PBL, CSS; SpamCop; Barracuda; ivmSIP/24; UCEPROTECT Level 1 and 2; DroneRBL.
PTR record audit. Resolve reverse DNS for all 254 IPs. High occupancy (80%+) with custom PTR records is gold. Ghost block (<30%) is a warning.
Adjacent block scan. Check the /24 above and below. Spamhaus sometimes lists at /23 granularity.
WHOIS history. How many times has the block changed hands? Three transfers in four years is a yellow flag.
| Quality | Characteristics | Adjustment |
|---|---|---|
| Premium (A) | 90%+ occupancy, 20+ custom PTR, zero SBL, clean adjacent | Full market rate or premium |
| Standard (B) | 70%+ occupancy, some custom PTR, no SBL, minor hits | Market rate |
| Discount (C) | Mixed occupancy, few PTR, 1-3 expired SBL, minor RBL | 20-35% discount |
| Distressed (D/F) | Ghost block or active SBL, dirty adjacent, abuse history | 50%+ discount or pass |
All 254 IPs checked. Blacklists, PTR, adjacent blocks, neighborhood score, price recommendation. Free.