What Is an IPv4 Subnet?
An IPv4 subnet is a logically segmented portion of an IP address space defined by two values: a network address and a prefix length, expressed together in CIDR (Classless Inter-Domain Routing) notation as defined in IETF RFC 4632. The prefix length — a number from 0 to 32 written after a forward slash — determines how many addresses share the same network block. A /24 subnet contains 256 addresses (e.g., 203.0.113.0 through 203.0.113.255); a /16 contains 65,536; a /28 contains 16.
Regional Internet Registries such as RIPE NCC and ARIN allocate IP space to ISPs in these structured blocks. An ISP might receive a /16 allocation and then subdivide it into thousands of /24 blocks assigned to individual neighbourhoods, office parks, or mobile tower clusters. This hierarchical allocation means that addresses within the same subnet almost always share a common physical or organisational context — the same neighbourhood, the same last-mile infrastructure, or the same carrier cell site.
Cloudflare’s networking documentation describes subnets as the foundational unit of IP routing: every router along a packet’s path uses the destination address and routing table entries — each expressed as a CIDR prefix — to decide where to forward traffic. This routing visibility makes subnet-level information publicly queryable via BGP looking-glass tools, which is precisely what contest platforms exploit for deduplication.
Why It Matters in Vote Services
Contest platforms do not merely log individual IP addresses — they group them by subnet and count how many votes arrive from the same network block. A /24 block (256 addresses) originating from a single datacentre or VPN operator will produce multiple votes that all share the same routing prefix. Even if each address is technically distinct, the platform’s subnet-level deduplication logic sees them as originating from the same network segment and can apply a per-subnet vote cap.
The practical consequence for vote campaigns is significant. A provider drawing addresses from a small number of allocated blocks — even if those blocks are residential in name — may deliver hundreds of votes that all fall within two or three /24 subnets. The platform’s analytics layer identifies the concentration within seconds. A per-subnet cap of, say, five votes per /24 per 24 hours then silently discards the majority of those deliveries, making the order appear to perform far below its nominal count.
This is why subnet diversity — not just IP uniqueness — is a structural requirement for sustainable vote delivery. An order of 1,000 votes drawn from 1,000 genuinely unique IPs across 100 distinct /24 subnets behaves very differently, from a platform’s perspective, than 1,000 addresses clustered within five subnets.
How Detection Systems Use This Signal
Subnet-level analysis is one of the fastest and cheapest signals available to fraud detection pipelines because it requires only a bitwise AND operation on the incoming IP address to resolve the network prefix. No external database lookup is needed:
- Per-subnet vote counting — the platform maintains a counter keyed on the /24 (or /20, or /16) prefix. When the counter exceeds a threshold within a rolling window, subsequent votes from any address in that prefix are rejected or quarantined pending manual review.
- Allocation-block reputation — RIPE NCC and ARIN publish whois records that show when a subnet was allocated, to which organisation, and whether ownership has changed recently. Newly allocated subnets, or blocks that have changed hands multiple times, carry elevated fraud probability scores in commercial threat intelligence databases.
- Spatial clustering detection — if a set of subnets cluster within a narrow address range (e.g., 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24), the platform can infer that they belong to a single organisational allocation even if the ASN appears residential. Clustering analysis exposes providers who rotate through sequential subnets from the same parent block.
- Cross-contest correlation — fraud databases shared between contest operators record which subnets appeared in prior fraud events. A subnet flagged for abuse on one platform carries that reputation into future lookups on entirely different platforms.
How to Verify Quality
Before placing a vote order, ask your provider specific questions about subnet distribution:
- How many distinct /24 subnets does a 1,000-vote order span?
- What is the maximum number of votes delivered from any single /24 block in one campaign?
- Are your IP allocations spread across many parent ASN blocks, or concentrated within a few ISP allocations?
- How do you screen for subnets that have recently migrated from residential to hosting-provider ownership?
- Can you provide a sample report showing the subnet spread of a completed order?
A provider with genuine subnet diversity will have concrete, quantitative answers. Evasive or qualitative responses typically indicate a concentrated pool.
How Our Service Uses This Technique
Our delivery infrastructure enforces strict subnet-level caps on every order. Before any address enters our active pool, it is cross-referenced against RIPE, ARIN, and APNIC allocation records to confirm that its parent /24 is assigned to a consumer ISP or mobile carrier — not to a hosting provider or commercial VPN operator. Subnet rotation logic ensures that each order is spread across the widest possible range of /24 blocks relative to the order size, so that per-subnet counters on the destination platform remain well below any reasonable detection threshold. Our 6M+ residential address pool spans thousands of distinct subnets across 200+ countries, including subnets allocated to cable, DSL, fibre, and 4G/5G mobile operators — ensuring that the subnet-level fingerprint of every delivered campaign mirrors the natural geographic and organisational spread of real internet users.
Summary. An IPv4 subnet is a CIDR-defined block of addresses that contest platforms treat as a single routing unit for deduplication and fraud scoring. Detection systems apply per-subnet vote caps, evaluate allocation-block reputation via RIPE/ARIN whois data, and use spatial clustering analysis to identify concentrated deliveries. Our pool of 6M+ residential addresses spread across thousands of distinct /24 subnets across 200+ countries ensures that every campaign produces a subnet distribution consistent with genuine organic traffic.
