Cloud IP reputation and your outbound calls

When you rent a cloud server, you get a public IP address that has had previous tenants. If one of them ran a high-volume spam operation or an abusive calling campaign, the IP may already appear on blocklists that carriers and analytics services consult before deciding how to label your calls. That history follows the IP to your new box.

Understanding this problem — and what you can realistically do about it — is worth doing before you start a production campaign. The general cloud hosting context is covered in running VICIdial in the cloud.

What spam-likely actually means for a SIP trunk

Spam-likely Spam Likely label is a label that terminating carriers and robocall analytics engines attach to a call when the originating number or IP has a poor reputation score. It does not necessarily block the call. Instead, the callee's handset displays "Spam Likely" or "Scam Risk" instead of your business name, and answer rates drop sharply. Some carriers silently divert spam-likely traffic to voicemail without even ringing the handset.

Two separate things can be tainted: the IP address your SIP traffic originates from, and the phone numbers (DIDs) you are calling from. A blacklisted originating IP can cause your carrier to assign your calls a lower trust score even before STIR/SHAKEN attestation is evaluated. A DID DID (direct inward dialing) that was previously used for robocalling will be flagged at the analytics engine level regardless of which server originates it.

STIR/SHAKEN and call attestation

sequenceDiagram
  participant D as VICIdial box
  participant C as Originating carrier
  participant T as Terminating carrier
  participant P as Callee phone
  D->>C: SIP INVITE with caller ID
  C->>C: check IP reputation
  C->>C: sign PASSporT token
  C->>T: SIP INVITE + Identity header
  T->>T: verify signature attestation level
  T->>P: ring with A or B or C label
  Note over C,T: A attestation = carrier verified you own the number

STIR/SHAKEN STIR/SHAKEN is the framework US carriers use to cryptographically sign calls. Your originating carrier assigns an attestation level: A means the carrier can confirm you are authorized to use that caller ID, B means the call originated from a known customer but the number ownership is not verified, and C means neither is confirmed. Call attestation Call attestation level A gives the best chance of passing through spam filters cleanly. To reach level A, your carrier needs to know you, trust your IP or SIP credentials, and confirm you own or are licensed to use the numbers you call from.

CNAM CNAM (caller ID name), short for Caller Name, is the database lookup that populates the name shown on the callee's handset. It is separate from STIR/SHAKEN. You can have a properly signed call still display no name or a stale name if your carrier has not provisioned CNAM for your DID. Registering your business name through your carrier or a CNAM provisioning service helps answer rates independently of attestation.

Checking your IP before you start calling

Before you register the SIP trunk, check your cloud server's public IP against common blocklists. Tools like MXToolbox, Spamhaus, and your carrier's own IP reputation lookup (if they offer one) will tell you quickly whether the IP is on any list. If it is, the fastest fix is to request a different IP from your cloud provider — most providers have a pool and will assign a fresh one on request. This is far quicker than trying to delist a flagged address.

# Check reverse DNS for your server IP
dig -x <your-server-ip> +short

# If the PTR record still belongs to a previous tenant, ask your provider to update it

Protecting your numbers over time

Even a clean IP and properly attested caller ID can accumulate a bad reputation if your campaign dials aggressively or calls people who did not consent. Analytics engines track complaint rates per number. Rotating caller IDs through a large pool of numbers does not reliably fix this — the pattern itself can be flagged. The more durable approach is dialing at a rate your answer rate supports, honoring opt-outs quickly, and working with your carrier to monitor complaint signals.

For more on how your public IP affects other aspects of cloud dialer setup, read the public IP requirement for cloud VICIdial. If you want a box that starts with a clean, unused IP and a known-good SIP configuration, VICIfast plans provision fresh single-tenant servers in under 40 seconds — no shared IP history.