A team running 60 marketplace seller accounts wakes up to 41 suspensions logged within the same 90 minute window. The accounts had different device fingerprints, different browser profiles, different behavioural patterns, different registration dates. What they shared was a proxy list purchased as a single block of static IPs. Pull the addresses into a spreadsheet, sort them, and the pattern is obvious: 41 of the 60 sat inside three adjacent /24 ranges.
This is the failure mode almost nobody plans for. Operators obsess over fingerprint isolation and rotation timing while treating IP addresses as independent, interchangeable units. They are not. Platforms treat IPs as members of a hierarchy, and enforcement decisions propagate up and down that hierarchy far more aggressively than most buyers assume. Understanding why is the difference between losing one account and losing an entire portfolio in an afternoon.
Platforms Do Not Score IP Addresses. They Score Ranges
The intuitive model of IP reputation is a lookup table: one row per address, one score per row. Real anti-abuse systems do not work that way, for two practical reasons.
The first is data sparsity. There are billions of routable IPv4 addresses and effectively unlimited IPv6 space. Any single platform observes a tiny fraction of them, and most of those only once or twice. A single observation tells you almost nothing. To make a confident decision you need to borrow evidence from neighbouring addresses, which means aggregating observations into ranges and smoothing scores across them. This is standard practice in fraud modelling: when the host-level signal is weak, fall back on the prefix-level prior.
The second is that ranges genuinely are meaningful. IP space is allocated in contiguous blocks to a single organisation, routed as a single prefix, and usually put to a single purpose. If 200 addresses in a /24 all present as headless automation hitting the same endpoint, the remaining 56 are not innocent bystanders in any statistical sense. They are the same infrastructure with different last octets.
The Four Levels of Aggregation That Matter
Host level (/32). The individual address. Bans here are the cheapest and most reversible, and they are what most people picture when they say "my IP got blocked". In practice, host-level action is often the smallest part of the enforcement response.
Neighbourhood level (/24 and /25 through /29). The classic unit of collateral blocking. A /24 is 256 addresses, historically the smallest block routable on the public internet, and it remains the default granularity for abuse lists, rate limit buckets, and "related account" heuristics. When people describe bans that arrive in clusters, this is almost always the level responsible.
Allocation level (/22 through /16). Larger assignments held by a single hosting company or a single proxy operator. Enforcement at this level is less common but far more damaging, and it is typically what happens after sustained abuse from multiple subnets inside the same allocation.
ASN level. The autonomous system that announces the prefix. ASN reputation is coarse, slow to change, and effectively permanent from the buyer's point of view. An entire ASN classified as hosting or as commercial proxy infrastructure means every address it announces starts from a deficit no matter how clean its individual history is.
The key insight is that these levels interact. Repeated host-level violations raise the /24 score. Multiple degraded /24s raise the allocation score. Persistent allocation problems damage the ASN. Reputation flows upward through the hierarchy, and once it settles at a higher level, it rains back down on every address underneath.
Why Proxy Pools Cluster by Subnet in the First Place
Subnet clustering is not usually deliberate. It falls out of how IP space is acquired.
Datacenter pools are sold in CIDR blocks. Nobody leases 256 individually sourced addresses. They lease a /24 because that is the unit brokers and hosts sell. A cheap datacenter package is very often one or two contiguous ranges dressed up as a list of unrelated IPs.
ISP proxy inventory is bought in batches. ISP addresses carry residential ASN registration with datacenter routing, which is exactly why they perform well. But they are acquired in bulk from a limited number of carriers, which means a large ISP order frequently arrives concentrated in a handful of prefixes.
Residential pools concentrate at the gateway and at the ISP. Peer nodes are genuinely diverse in aggregate, but a narrow targeting filter collapses that diversity fast. Ask for residential IPs in one mid-sized city on one carrier and you may be cycling through a few hundred addresses inside a small number of prefixes, hitting the same neighbourhoods repeatedly.
Mobile pools trade address diversity for shared trust. Carrier grade NAT puts thousands of real subscribers behind each public address, which is precisely why mobile IPs resist hard bans. But a 4G pool may present very few distinct /24s. That is acceptable because the platform cannot ban the range without hitting paying customers, but it means mobile diversity is a different property, not a superior version of the same one.
The practical consequence: pool size in raw IP count tells you almost nothing about resilience. A pool advertising 10,000 addresses spread across 40 subnets is structurally more fragile than a pool of 2,000 addresses spread across 900.
Measuring Subnet Diversity Before It Costs You Accounts
This is measurable in an afternoon, and it should be part of every provider evaluation.
Export a representative sample of your pool, ideally several thousand addresses collected across different rotation cycles and geographies. Then compute three things.
Unique /24 count against total addresses. This is your headline diversity ratio. Compare unique prefixes to unique IPs. If 5,000 addresses resolve to 120 distinct /24s, you are averaging more than 40 accounts per range at full utilisation.
Concentration, not just count. Averages hide the problem. Sort your /24s by how many of your addresses fall inside each one. If the top five prefixes account for half your traffic, your effective diversity is a fraction of your nominal diversity. A Herfindahl style concentration index over prefix shares gives you one number you can track over time.
ASN spread. Group the same sample by autonomous system. Two hundred distinct /24s inside three ASNs is a thinner defence than it looks, because ASN-level classification collapses all of them at once.
Then apply the operational rule that follows from the maths: cap the number of related identities per prefix. For high value accounts, one identity per /24 is the conservative standard. For scraping workloads where identities do not persist, the equivalent control is capping request volume per prefix per hour rather than per IP, since the platform is bucketing you that way regardless. Running these checks against live endpoints with a proxy tester before deployment turns a theoretical audit into a measured one.
The Mistakes That Turn One Ban Into Forty
Treating a sequential IP list as a diverse pool. If sorting your list produces mostly consecutive addresses, you own one target, not many.
Rotating within a prefix. Swapping the last octet after a block changes nothing. The reputation lives at the range. Rotation has to cross prefixes and ideally cross ASNs to mean anything.
Registering a cohort of accounts in one session. Ten accounts created in an hour from three adjacent ranges is a graph a correlation engine draws for free. Spread creation across time and across prefixes.
Ignoring the neighbours. Your addresses inherit the behaviour of everyone else in the range. In a shared pool, that includes users you will never meet, which is why sourcing transparency and abuse enforcement on the provider side directly affect your success rate.
Reacting to bans with more of the same IPs. Replacing a suspended account with a new one from the same subnet is how a cluster becomes a full allocation-level blocklist.
Where Proxies Fit In: Turning Diversity Into Architecture
Subnet concentration is a supply-chain property, which means it is decided by how a provider sources and structures its inventory rather than by anything you can configure downstream. That makes provider architecture the real control surface.
The features that matter are specific. Pool diversity across genuinely different pool types (residential, ISP, datacenter, mobile) so that a range problem in one class does not touch the others. Broad geo-coverage, so narrowing to a country or city does not collapse you into a handful of prefixes. Ethical sourcing, because consent-based peer networks distribute across real subscriber lines rather than concentrating in a few hosting allocations. Session control precise enough to hold a sticky identity on one prefix while other identities are guaranteed to sit elsewhere.
EnigmaProxy is built along those lines, with multiple pool types under one interface, ethically sourced residential and premium options, and geo-coverage broad enough to keep prefix distribution meaningful when targeting narrows. The practical benefit for multi-account and high-volume scraping teams is that isolation can be designed rather than hoped for: assign separate pool segments to separate account cohorts and a subnet-level action stays contained to the cohort that triggered it.
Budgeting matters here too, because diversity is what you are actually paying for. When comparing pricing across pool types, the number worth reasoning about is cost per usable prefix for your target, not cost per gigabyte in isolation.
Where Subnet-Level Enforcement Is Heading
IPv6 changes the granularity, not the logic. With /64 assignments handed to single customers and /48s to single sites, platforms are already treating the /64 as the host and the /48 or /56 as the neighbourhood. Anyone assuming IPv6 abundance defeats range blocking is a generation behind.
Prefix reputation is becoming a shared commodity. Reputation data increasingly moves between platforms through vendors and threat feeds, which means a range degraded on one large site starts degraded on the next. Recovery windows lengthen accordingly.
Enforcement is shifting from ban to quiet degradation. Rather than blocking a range outright, platforms increasingly serve it slower responses, thinner data, and more challenges. Subnet problems now show up as declining success rates and drifting data quality long before anything looks like a block.
Buyers will be expected to audit structure, not size. Pool size claims are becoming meaningless as a differentiator. The questions that will separate serious infrastructure from resold blocks are how many distinct prefixes and ASNs a pool spans, how that distribution holds up under geo-targeting, and how the provider handles abuse inside its own ranges.
Key Takeaways
Mass bans cluster by subnet because platforms score ranges rather than addresses, and because most proxy inventory is acquired in contiguous blocks. The defence is structural: measure unique /24s and ASN spread rather than trusting headline pool counts, cap identities and request volume per prefix, and never rotate inside a range you have already burned.
Treat subnet diversity as a first-class requirement when you choose infrastructure. Providers such as EnigmaProxy that combine multiple pool types, wide geo-coverage, and transparent sourcing give you the raw material to build isolation that actually holds when a platform starts drawing CIDR boundaries around your accounts.