Why Sites Block Your VPS IP Address

Why sites block VPS IP addresses

Sites block VPS IP addresses because a VPS address is easy to classify before it sends a single request. Public routing data says which network owns every address. Commercial IP-intelligence databases add a flag that marks hosting and datacenter networks. A service that reads that flag can refuse the request or ask for a CAPTCHA, based only on where the traffic comes from.

Most refusals come from one of three causes. The address belongs to a datacenter network. The address, or the range around it, has a history of abuse. Or the product is only open to people in certain places. This guide explains each cause from the operator's side. It shows how to check how your own VPS address is classified, and it ends with the routes that are actually open to you.

A real example: Muse launched in some countries only

Meta's launch announcement for Muse, its personal AI agent, says Muse "is rolling out in the US on iOS, Android, and muse.ai". A later Meta post, about Muse for Small Business, describes Muse as available in the US and Canada. Meta's help center says Muse and Muse subscriptions are in limited testing and are not available in all locations yet. It also says a subscriber must be located in a country where Muse is available. The help page does not publish a country list.

Meta has not said how it decides where a person is located, and this guide does not guess. The example matters for a different reason. A new product often starts with an eligibility rule, and that rule is about the person. It is not about the server they happen to connect through. A VPS in another country does not change where you are. Keep that in mind for the last section.

How do sites know an address belongs to a datacenter?

Every public IP address sits inside a block that a regional internet registry (RIR) assigned to some organisation. ARIN, RIPE NCC and APNIC are examples. That organisation announces the block to the rest of the internet from an autonomous system (AS). An AS is a network with its own routing policy and its own number, the ASN (autonomous system number). BGP (border gateway protocol) is the protocol that carries those announcements between networks.

This data is public, so anyone can map an address to its ASN and to the name of the organisation behind it. A hosting company's ASN usually carries the hosting company's name. A home broadband address maps to a consumer internet provider instead. The mapping alone tells a service a lot. An address in a hosting provider's AS is very likely a server, a VPN exit or a proxy. It is very unlikely to be a person on a phone.

What the "hosting" flag in IP databases means

Few services build that mapping themselves. They buy it from an IP-intelligence vendor, and each of the vendors below has a field for exactly this question.

• MaxMind's Anonymous IP database has an is_hosting_provider flag. MaxMind documents it as true if the address belongs to a hosting provider, and the key is only present when the value is true.
• IPinfo's Core data has an is_hosting flag for addresses that belong to a hosting provider, cloud service or data center. It is separate from is_anonymous, which covers VPN, proxy, Tor and relay addresses. Other IPinfo products name the same idea differently, for example hosting in the privacy API.
• ip-api.com returns a hosting field, described as "Hosting, colocated or data center". Next to it is a proxy field for proxy, VPN or Tor exit addresses.

The flag classifies the network. It is not a judgement of you. Your VPS can have a clean history and still carry the flag, because the flag describes who owns the range. That is why a fresh VPS can get a CAPTCHA on its very first request.

Why does someone else's abuse count against my address?

Reputation is often kept per range, not only per address. Spamhaus says its SBL (Spamhaus Block List) contains both individual IPs and IP ranges. Spamhaus also says it may escalate listings to a network's extended ranges, and to networks linked by ASN or registry assignment. One example it gives is listings that are ignored for a long time. So the network your address lives in has a reputation of its own, and the behaviour of other customers in that network feeds into it.

Do not read more into this than it says. Abuse on a neighbouring address does not automatically list yours. What it does is make range-level and network-level listings possible. A service that blocks by range will catch your address along with the abusive one.

Spamhaus also runs the PBL (Policy Block List). It is a policy list of end-user address ranges that should not send email directly to the receiving mail server. It is not an abuse list. Spamhaus says a single address is only removed from it when it is a static address running an outbound mail server with matching A and reverse DNS records. Removals are handled at check.spamhaus.org.

How an address's abuse history follows it

Addresses are recycled. When a customer cancels a VPS, the provider can give the address to the next customer. Any reports filed against it stay attached to the address, not to the person.

AbuseIPDB is one place where those reports collect. Sysadmins report addresses they saw doing something malicious, and AbuseIPDB turns the reports into a confidence rating from 0 to 100. Its FAQ says the rating is determined by reports and their age, and that the weight of a report decays over time. So an address with old reports slowly recovers. An address with recent reports from a previous tenant can look bad on your first day. Check your address on the AbuseIPDB site. Its FAQ does not describe a dispute process for the owner of an address, so read the site itself before you assume one exists.

If your provider forwards abuse reports to you, how VPS abuse complaints work and how to answer one covers what the provider expects from you. It also explains why ignoring a report hurts the range you share with other customers.

How to check how your own VPS IP is classified

Every lookup below needs outbound internet access from wherever you run it. The output depends on the vendor and changes over time, so treat each answer as one vendor's view on one day.

Install the tools on Ubuntu 24.04 and find your public IPv4 address. On most VPS plans it is the address on the main network interface.

sudo apt update && sudo apt install -y whois bind9-dnsutils curl
ip -4 -br addr show

The examples use 203.0.113.45, which is a documentation address. Replace it with your own.

Map the address to its ASN

Team Cymru runs a free IP-to-ASN mapping service over whois and over DNS.

whois -h whois.cymru.com " -v 203.0.113.45"

The leading space inside the quotes is deliberate. Team Cymru says it keeps your local whois client from reading the flags as its own. The output has one header line and one data line. The header looks like this:

AS  | IP            | BGP Prefix       | CC | Registry | Allocated  | AS Name

Read the AS Name column. If it names your hosting provider, every service that buys an IP database already knows your address is in a datacenter. The BGP Prefix column is the range your address is announced in. That is the range that range-level reputation applies to.

The DNS form returns most of the same data in one line. Reverse the four octets of the address and append the zone:

IP=203.0.113.45
dig +short "$(echo "$IP" | awk -F. '{print $4"."$3"."$2"."$1}')".origin.asn.cymru.com TXT

For anything recurring, Team Cymru asks you to use the DNS form, not many single whois queries. It says addresses that send large numbers of individual whois queries are null routed.

Read the registry record

The plain whois client tries to guess the right server to ask, so you can usually run it with no -h option. See man whois on your system for the options your version supports.

whois 203.0.113.45

RDAP (registration data access protocol) is the structured alternative to whois, and it returns JSON. In ARIN's documentation, you query an address as /ip/<address>:

curl -s https://rdap.arin.net/registry/ip/203.0.113.45

In the JSON, the entity whose roles include abuse is the abuse contact for the range. That entity is usually your provider, which means outside complaints about your address go to them first. If your address is in another registry's region, the whois output names the registry. Use that registry's RDAP service instead.

Ask an IP-intelligence vendor

ip-api.com has a free JSON endpoint with no API key. It is plain HTTP only, because the page says SSL is not available on the free API. It is limited to 45 requests per minute from one address. The fields parameter selects which fields come back:

curl -s "http://ip-api.com/json/203.0.113.45?fields=status,country,isp,org,as,proxy,hosting"

"hosting":true means ip-api classes your address as hosting, colocated or data center. "proxy":true means it also lists the address as a proxy, VPN or Tor exit. Other vendors may disagree with ip-api about the same address, and paid plans often return more fields than free ones. If you have an IPinfo or MaxMind account, check the exact field names in your own plan's response.

How reverse DNS shapes an address's reputation

Reverse DNS maps an address back to a name. It uses a PTR (pointer) record under in-addr.arpa for IPv4 and ip6.arpa for IPv6. dig -x does the lookup for you. See man dig on your system for the details.

dig -x 203.0.113.45 +short

A PTR record is public, so the name is one more thing a service can read about your address. A default name that contains the provider's domain says "hosting network" as clearly as the ASN does. A name that matches a domain you control says that someone runs this server on purpose.

For email, reverse DNS is a hard rule. Google's sender guidelines say the public IP address of a sending SMTP server must have a PTR record that resolves to a hostname. The sending address must also match the address of the hostname in that PTR record. Setting a reverse DNS PTR record on a VPS walks through the provider panel side and the forward record that has to match. If the record types are new to you, how DNS works explains A records and PTR records from the start.

A self-hosted VPN on a VPS exits from a datacenter IP

This surprises many people. A VPN you run on your own VPS sends your traffic to the internet from the VPS's address. Every site you visit through the tunnel sees a datacenter address. It has the same ASN and the same hosting flag as the VPS itself.

MaxMind says the same thing from the database side. Some VPN providers' subnets are not registered under the VPN provider's own name. MaxMind says it will likely flag those ranges only with is_hosting_provider. A personal VPN on a VPS is the extreme case of that. No VPN company name appears anywhere, only the hosting provider's.

So a self-hosted WireGuard VPN on your VPS is a good tool for encrypting traffic on an untrusted network. It is a poor tool for looking like a home user. If you are still deciding which of the two you need, the difference between a VPS and a VPN sets out what each one is for.

The same mechanism, from the operator's side

Now look at it from the other side, when you run the service. If bots flood your site from cloud networks, you will reach for the same tools: classify the source network, then rate-limit it or drop it.

Blocking AI crawlers on your own server uses a closely related idea. It blocks by user agent, and at the firewall it drops the address ranges that crawler operators publish. That is blocking by network range, which is the same idea a service applies when it refuses a datacenter ASN. The trade-off is also the same. That guide warns that ranges get reassigned and a stale deny rule eventually blocks somebody else. A service that blocks your VPS has made that trade knowingly, and your address is part of the cost.

On a small server, ufw firewall rules are enough to drop a range you have decided to refuse.

What to do when a service refuses your VPS

The house position is simple. A service's signup rules and region rules belong to the service. This site does not teach residential proxy networks, browser fingerprint spoofing or any other way around them. These routes work, and they keep your account safe:

• Use the service from your normal connection. A consumer product built for people on phones expects home and mobile networks. Use it from those, and keep the VPS for server work.
• Use the official API, if there is one. If you want a server to talk to a service, an API with keys is the route the service built for that job.
• Contact the service. If a legitimate server-side use is blocked, the operator can tell you whether an allow-list or a different product exists. Give them your address and ASN from the lookups above.
• Pick a location that fits the use. Host where your users are, or where your data has to live. Choosing between a Canada and a US VPS covers that decision. A server location does not change where you are. So it does not make you eligible for a product that requires you to be in a certain country.

If the problem is your address's history rather than its network, fix what you control. Set a matching PTR record and answer abuse reports. If a recent tenant left the address with a bad record, ask your provider for a different one.

FAQ

Why does every site show me a CAPTCHA on my new VPS?

Your address sits in a hosting provider's network, and IP-intelligence databases flag hosting and datacenter networks. A service that reads the flag can challenge every request from that network before you have done anything. Run whois -h whois.cymru.com " -v <your IP>" and read the AS Name column to see the network the service sees.

Can another customer's abuse get my VPS IP blocked?

It can affect you, but not automatically. Spamhaus's SBL lists individual addresses and whole ranges, and Spamhaus says it may escalate listings to a network's wider ranges. A service that blocks by range will catch your address with the abusive one. Addresses are also recycled, so reports filed against a previous tenant can stay attached to your address until they age out.

Does a self-hosted VPN hide that I am on a datacenter IP?

No. A VPN on your VPS sends traffic out from the VPS's own address. Sites see the hosting provider's ASN and the same hosting flag as the server. MaxMind says VPN ranges that are not registered under the VPN company's name will likely be flagged only as hosting.

How do I check if my VPS IP is flagged as hosting?

Query a free IP-intelligence endpoint such as curl -s "http://ip-api.com/json/<your IP>?fields=isp,org,as,proxy,hosting" and read the hosting field. Other vendors, such as MaxMind and IPinfo, keep their own flags and can disagree. Treat any single answer as one vendor's view on one day.