Here is a real address our free checker processed this week. Every commercial IP database says the same thing about it: residential connection, major European carrier, no proxy, no VPN, no datacenter. Threat score zero. Clean.
Then we looked at its street.
Why single-IP reputation has a blind spot
IP reputation databases classify addresses by what they can observe from the outside: registration records, hosting allocations, known proxy exit lists, historical abuse reports. That works well for datacenter ranges and known VPN infrastructure. It works poorly for the traffic that actually hurts media buyers in 2026: bots riding residential connections — hijacked devices, residential proxy pools, SDK-monetized apps. The IP really is a home connection. The database really is telling the truth. The visitor still is not human.
We wrote about this problem in depth in our residential proxy analysis: when the address itself checks out, you need evidence from somewhere else.
The somewhere else: the neighborhood
Bot infrastructure is rarely one address. Residential pools cycle through adjacent addresses on the same carrier segment; infected routers cluster on the same street; an abused CGNAT range lights up together. Which means a signal exists one level up from the IP: the /24 subnet’s behavior.
Because our detection engine processes live ad traffic across 60+ networks, we see how addresses behave, not just how they are registered. So our free IP checker now reports, for any IPv4 address:
- Neighbor IPs seen — how many addresses from the same /24 have appeared in live traffic;
- Bad neighbors — how many of those were majority-blocked by the detection engine;
- Subnet block rate — the overall blocked share of everything the /24 has sent.
The address above is the textbook case: clean on paper, resident of a street where every measured visitor was a bot. An IP that lives among bad neighbors does not deserve an automatic block — but it has earned less benefit of the doubt, a closer look at its browser evidence, and a lower bid.
Also new: bulk checking
If you have a list — a click log, a suspicious zone’s visitors, a lead export — registered users can now paste up to 50 IPs into the dashboard IP Lookup and get instant verdicts for the whole batch: threat score, severity, proxy type, hosting flag, country and network for each. Free account is enough.
Try it
The checker is free and needs no signup: check a zone, check an IP — and now, check its street. If you want the same verdicts inside your own stack, the developer API returns them in under 15 ms per visitor.
FAQ
Is a "bad neighborhood" proof that an IP is a bot?
No — and we are careful about this. Subnet reputation is context, not a verdict: it tells you how much benefit of the doubt an address deserves. Blocking on neighborhood alone would punish innocent users on shared carrier ranges. Our engine treats it as one signal among many.
Why /24 and not something bigger or smaller?
A /24 (256 addresses) is the finest-grained slice that is still commonly allocated and routed as a unit — small enough to be a real "street", large enough to show a pattern. Larger blocks blur together too many unrelated users.
Does subnet analysis work for IPv6?
Not yet. IPv6 address compression makes reliable prefix grouping harder, and honest tools say so instead of guessing. IPv4 covers the overwhelming majority of pop and push traffic today.