An IP address is rarely judged alone. When one address misbehaves, blocklists, reputation systems and site operators often extend the verdict to the addresses around it: the rest of its /24, sometimes its whole network. The address you are using can be blocked for something it never did, because of what its neighbours did.
This is subnet contagion. It explains a whole class of blocks that look inexplicable from the inside: clean requests, reasonable pacing, and a refusal anyway. It also has a mirror image that anyone sending automated traffic should take seriously, because your traffic is someone else’s neighbour too.
Key takeaways
- Range-level blocking works well enough to be tempting. In one study, extending a single-IP spam blocklist to whole /24s raised spam caught from 54.33% to 92.74%.
- It also misfires. In another, naively expanding blocklisted addresses to their /24 raised the share of legitimate addresses misclassified to as much as 6.6% in one network, and above 60% for one list.
- Shared addresses make it worse. On Facebook data, 72.9% of IPv4 addresses with abusive accounts also carried more than 10 benign users that day.
- Cloudflare reports that addresses behind carrier-grade NAT are rate limited three times more often than other addresses, although their median bot rate is nearly identical.
- The most widely deployed public blocklist in one study, Spamhaus DROP, lists nothing smaller than a /24. Our count of the live file on 22 September 2026: 1,712 prefixes covering 14,958,336 IPv4 addresses.
Why operators block neighbourhoods
Bad addresses cluster. Networks that are poorly managed, or rented to abusers, tend to produce abuse from many addresses at once. The data backs this up.
A study of 157 blacklists over eleven months, published at NDSS 2020, found that “about 57.5% of /24 prefixes have at least two blacklisted IP addresses in the same /24.” Earlier work at the University of Twente measured what that clustering is worth to a defender. Filtering mail with a standard single-IP blocklist caught on average 54.33% of spam. Treating every listed address as marking its entire /24 as malicious caught 92.74%. A control list with the same number of randomly chosen addresses caught only 56.64%, so the gain came from the neighbourhood, not from simply blocking more.
That result is the whole argument for range-level blocking, and it is a strong one. It is also where the trouble starts.
Who blocks by range
Range-level judgement is not a fringe practice. It is built into some of the most widely used lists.
| System | What it lists | Range behaviour |
|---|---|---|
| Spamhaus DROP | Netblocks leased or stolen by spam or cyber-crime operations | Prefixes only; the smallest entry is a /24 |
| Spamhaus ASN-DROP | Whole autonomous systems | 436 ASNs in the live file on 23 September 2026 |
| Spamhaus SBL | Spam sources and their infrastructure | May escalate “to extended ranges of that network, or even to that entire network or networks related by ASN or RIR assignment” |
| UCEPROTECT Level 3 | Every IP in an ASN once its spam score and impact count cross set thresholds | Warns it “can, and probably will cause collateral damage to innocent users” |
| Gmail sender reputation | Shared sending addresses | ”The activity of any senders using a shared IP address affects the reputation of all senders for that shared IP address.” |
Deployment matters as much as design. A PAM 2021 study that inferred which of nine public blocklists real hosts were enforcing found that “Spamhaus DROP is by far the most popular blocklist in our collection, followed by Spamhaus EDROP.” The most enforced list is the one that only knows ranges.
Web services describe the same effect from the receiving end. Google’s own help page for its “unusual traffic” message says you could see it “if others that use the same network you use, like at a school or business, are sending automated searches,” and the same for a shared VPN or internet provider.
The collateral damage, measured
The cost of judging by neighbourhood falls on the legitimate addresses inside it.
The NDSS 2020 blacklist study quantified it directly. Aggregating blacklists naively misclassified on average 0.14% to 0.17% of legitimate addresses in the networks studied. Expanding each listed address to its /24 raised that to “0.66%, 6.6% and 1.03%,” and two individual lists reached 67.2% and 22.6%.
Address sharing compounds it. When one IPv4 address carries many users, blocking it blocks all of them.
| Finding | Source |
|---|---|
| 53% to 60% of 151 public blocklists contained reused (NATed or dynamic) addresses, 30.6K to 45.1K such listings, able to affect as many as 78 legitimate users for as many as 44 days | Ramanathan et al., IMC 2020 |
| 72.9% of IPv4 addresses with abusive accounts had more than 10 benign users that day; only a third of IPv4 addresses had a single user, against 95% of IPv6 | Li and Freeman, IMC 2020, Facebook data |
| Acting next day on every IPv4 address that had an abusive account gave a 65.8% true positive rate and a 27.1% false positive rate | Li and Freeman, IMC 2020 |
| Addresses behind carrier-grade NAT are rate limited three times more often than others; median bot rate 4.8% against 4.7% | Cloudflare, October 2025 |
| 41.1% of IPv4 CDN client traffic came from massively shared addresses, which were only 1.6% of active IPv4 addresses | Hsu et al., arXiv, August 2026 |
The last row explains why this keeps getting more important. A small slice of the address space now carries a large share of real human traffic, and those are exactly the addresses where one bad actor’s verdict lands on everyone else. Spamhaus makes the same point about its own exploits list: because it contains dynamic addresses, “the user you would be blocking is probably not going to be the user with the exploited device,” and it asks users to “avoid blocking innocent users.”
What does not exist is a direct measurement of what happens to the neighbours once one address in a /24 is blocked on the web. The figures above come from mail filtering, blocklist analysis and platform abuse data. The mechanism is well documented; its exact size for web scraping is not.
What this means if you collect web data
If your requests exit through addresses you do not control, and with residential or mobile networks that is always the case, some of your blocks will be about the neighbourhood rather than about you. That changes how you should read a block rate.
Diagnose before you tune. Group your results by the exit’s /24 and ASN. If one prefix is refused far more often than your baseline while the rest are fine, the problem is that prefix’s reputation, not your request pattern. Changing headers or slowing down will not fix it.
import ipaddress
from collections import defaultdict
def prefix_block_rates(rows, min_requests=30):
"""rows: (exit_ip, asn, blocked) per request. Returns prefixes blocked far above the norm."""
by_prefix = defaultdict(lambda: [0, 0])
total, blocked_total = 0, 0
for ip, asn, blocked in rows:
net = ipaddress.ip_network(f"{ip}/24", strict=False)
stats = by_prefix[(str(net), asn)]
stats[0] += 1
stats[1] += int(blocked)
total += 1
blocked_total += int(blocked)
baseline = blocked_total / max(1, total)
flagged = []
for (net, asn), (n, b) in by_prefix.items():
if n >= min_requests and b / n > max(3 * baseline, 0.2):
flagged.append((net, asn, n, round(b / n, 3)))
return baseline, sorted(flagged, key=lambda r: -r[3])Spread across networks. Range-level judgement punishes concentration. A pool that draws from many networks limits how much any single blocked range can affect you. Shifter’s residential gateway rotates to a new IP per request by default across a pool of more than 205 million addresses, which is the natural defence here. When a target genuinely needs one network, ASN targeting narrows it deliberately; do it only when you need to, because narrowing also concentrates exposure.
Don’t pin everything to one session. A sticky session keeps you on one address, which is right for a multi-step flow and wrong for bulk collection. If that address sits in a bad neighbourhood, everything on the session inherits it.
Keep the neighbourhood clean. This is the part the research makes hard to ignore. Aggressive, badly paced automation is exactly what gets ranges listed, and the people who pay are the households and offices sharing those networks. Pacing to what a site can take, covered in rate limiting and request throttling, is not only politeness. It keeps the addresses you depend on usable, for you and for everyone else on them.
How reputation is built and scored in the first place is covered in what IP reputation is and why it matters. Telling a bad route from a target that has turned against you is covered in monitoring residential proxy health and building a target health score.
What this means if you run a website
The same research is a caution for anyone writing block rules.
- Score before you block. UCEPROTECT itself warns that blocking with its ASN-level list “can, and probably will cause collateral damage to innocent users.” Treat any range-level signal as one input to a score, not a verdict.
- Know which addresses are shared. Cloudflare built a carrier-grade NAT classifier specifically to reduce the collateral effects of blocking shared addresses.
- Let range blocks expire. Reused addresses change hands quickly. The IMC 2020 study found reused addresses could stay listed for as many as 44 days.
- Say why you blocked. A clear block page with a way to appeal costs little and saves real users from a problem they cannot diagnose.
The bottom line
Judging an address by its neighbours works, which is why so much of the internet’s defensive infrastructure does it. The most enforced public blocklist lists only ranges, some lists escalate to entire networks by design, and shared addresses mean one bad actor’s verdict can fall on dozens of people. The collateral damage is documented, sometimes large, and still unmeasured for the web in any direct way.
For anyone collecting data, the practical lesson is to read blocks by prefix before assuming they are about you, to spread traffic across networks rather than concentrating it, and to remember that the ranges you use are shared. The cleanest way to avoid inheriting a bad neighbourhood’s reputation is not to become one.
Sources and references
- Ramanathan, Mirkovic and Yu, BLAG: Improving the Accuracy of Blacklists, NDSS 2020. Blacklist monitoring over 11 months in 2016.
- Moura, Sadre and Pras, Taking on Internet Bad Neighborhoods. Spam data from November 2011.
- Ramanathan, Hossain, Mirkovic, Yu and Afroz, Quantifying the Impact of Blocklisting in the Age of Address Reuse, ACM IMC 2020.
- Li and Freeman, Towards A User-Level Understanding of IPv6 Behavior, ACM IMC 2020.
- Li, Akiwate, Levchenko, Voelker and Savage, Clairvoyance: Inferring Blocklist Use on the Internet, PAM 2021. Measured December 2019.
- Hsu, Pearce, Li, Berger and Richter, Detecting and Characterizing Massively Shared IP Addresses, arXiv, 6 August 2026. CDN logs, July 2025.
- Giotsas and Fayed, Cloudflare, One IP address, many users: Detecting CGNAT to reduce collateral effects, 29 October 2025.
- Spamhaus, Spamhaus Blocklist (SBL) and Do Not Route Or Peer (DROP). DROP counts are our own tally of the public DROP and ASN-DROP files, 22 and 23 September 2026.
- UCEPROTECT, Level 3 policy.
- Google, Unusual traffic from your computer network, and Gmail email sender guidelines.
- Shifter, Residential Proxies geo-targeting and sessions documentation.