Understanding IP Quality: Reputation, Freshness, and Subnet Diversity

Not all proxy IPs are created equal. Two residential proxies from the same provider, same country, same ISP can produce radically different results -- one delivers a clean 200 response while the other triggers a CAPTCHA wall. The difference is IP quality.

IP quality is determined by three measurable dimensions: reputation (how clean the IP's history is), freshness (how recently it was assigned to the proxy pool), and subnet diversity (how the IP's /24 or /16 block relates to other IPs in your request pattern). Understanding these dimensions -- and how to assess them -- is the difference between choosing a proxy provider based on marketing claims versus data.

---

Quick Answer

**IP quality measures how likely a proxy IP is to succeed on a given target.** The three key dimensions are: (1) reputation -- whether the IP appears on blacklists and has a history of abuse, (2) freshness -- how recently the IP was added to the proxy pool, with newer IPs having cleaner histories, and (3) subnet diversity -- whether your requests come from many different IP subnets or are concentrated in a few, which anti-bot systems detect via CIDR block analysis. A high-quality proxy pool combines clean reputation, regular IP refresh, and broad subnet distribution.

---

IP Reputation: The History That Follows an IP

Every IP address accumulates a history over time. Websites, email providers, and anti-bot systems maintain databases that track IP behavior. When your request arrives from a proxy IP, the target site can check that IP's history in milliseconds.

What Reputation Databases Track

| Factor | What It Measures | Impact on Proxy Success | |---|---|---| | Blacklist presence | IP listed on Spamhaus, Barracuda, SORBS, Project Honeypot | Immediate block or CAPTCHA on many sites | | Abuse reports | Number of abuse complaints filed against the IP | Heightened scrutiny, lower trust score | | ASN classification | Whether the IP's ASN is registered as residential, business, or hosting | Hosting ASNs trigger automatic proxy detection | | Traffic patterns | Historical volume, request frequency, access patterns | Unusual patterns flag the IP for review | | Geographic consistency | Whether the IP's geolocation matches expected patterns | Mismatch between claimed and actual location triggers alerts |

Reputation Scoring in Practice

Anti-bot services like Cloudflare, Akamai, and PerimeterX assign each incoming IP a risk score based on these factors. The score determines whether the request is:

• **Passed through** (low risk, trusted IP): The request proceeds normally.
• **Challenged** (medium risk): The user receives a CAPTCHA or JavaScript challenge.
• **Blocked** (high risk): The request receives a 403 or is redirected to a block page.

The threshold varies by site. A banking site might challenge any IP with a risk score above 20/100, while a content blog might only block IPs scoring above 80/100.

How IPs Get Contaminated

An IP's reputation degrades through several mechanisms:

**Direct abuse:** A previous user of the IP sent spam, ran credential-stuffing attacks, or performed aggressive scraping that triggered abuse reports. Even after the abuser moves to a different IP, the reports remain in blacklist databases for weeks to months.

**Guilt by association:** The IP shares a /24 subnet with IPs that have been abused. If 50 IPs in a /24 block have been blacklisted, anti-bot systems may penalize the entire block. This is why subnet diversity matters (covered in the next section).

**Proxy detection lists:** Commercial databases (IPQualityScore, MaxMind minFraud, IP2Location) maintain lists of IPs known to be used by proxy services. Once an IP is identified as a proxy, it is flagged across all subscribers.

**Stale registrations:** An IP that was recently reassigned from a hosting provider to an ISP may still appear in databases as a hosting IP for days or weeks until the databases update.

How to Check IP Reputation Yourself

You can audit any IP's reputation using free tools:

1. **MXToolbox Blacklist Check** (mxtoolbox.com/blacklists.aspx): Checks the IP against 100+ blacklist databases simultaneously.
2. **AbuseIPDB** (abuseipdb.com): Shows the number of abuse reports filed against the IP in the last 30 days.
3. **IPQualityScore** (ipqualityscore.com): Provides a fraud score, proxy detection result, and VPN/Tor detection.
4. **Scamalytics** (scamalytics.com/ip): Shows a fraud risk score and proxy/VPN classification.

For bulk checking, use the APIs these services provide (most offer a free tier) and run your proxy IPs through all four services. An IP that is clean across all four databases has high reputation quality.

---

IP Freshness: The Lifecycle of a Proxy IP

Freshness refers to how recently an IP was added to a proxy pool. Freshly assigned IPs have minimal history and therefore minimal reputation baggage. Over time, as the IP is used by proxy customers, it accumulates activity that can degrade its effectiveness.

The IP Freshness Lifecycle

**Phase 1: Fresh (0--30 days)**

The IP was recently assigned to the proxy provider or recently entered the proxy pool (for residential IPs, when the home user's device first connects to the SDK). At this stage: - No proxy-specific blacklist entries - No abuse reports tied to proxy usage - Anti-bot databases may not yet classify it as a proxy - Highest success rates across all target sites

**Phase 2: Established (30--90 days)**

The IP has been in active use. Depending on usage patterns: - It may appear on proxy detection databases if heavily used - Some abuse reports may exist if other customers used it aggressively - Success rate begins to vary by target site difficulty - Still effective for most targets

**Phase 3: Mature (90--180 days)**

The IP has significant history: - Likely classified as a proxy in commercial databases - May appear on one or more blacklists - Success rate declines on heavily protected sites - Still usable for moderately protected targets

**Phase 4: Aged (180+ days)**

The IP carries extensive history: - Broadly classified as a proxy - Multiple blacklist appearances possible - Lower success rates on protected sites - Best suited for targets with minimal anti-bot protection

Why Fresh IPs Perform Better

The performance difference is measurable. In general industry testing against moderately protected e-commerce sites:

| IP Age | Avg Success Rate | CAPTCHA Rate | Block Rate | |---|---|---|---| | < 30 days | 94--98% | 1--3% | 0.5--1% | | 30--90 days | 88--94% | 3--7% | 2--4% | | 90--180 days | 78--88% | 7--12% | 5--8% | | 180+ days | 65--80% | 10--18% | 8--15% |

These numbers vary by provider, target site, and usage volume. The trend, however, is consistent: fresher IPs produce higher success rates.

What to Ask Your Provider About Freshness

• **What is your IP refresh rate?** A healthy residential pool adds 5--15% new IPs per week as new devices connect.
• **Do you retire aged IPs?** Good providers remove IPs that have accumulated too many blacklist entries.
• **Can I get fresh-only IPs?** Some providers offer a "fresh IPs" tier at a premium.
• **How do you manage ISP IP freshness?** For ISP/static proxies, freshness is managed differently -- the provider rotates which IPs are assigned to customers and rests IPs that have been heavily used.

---

Subnet Diversity: Why IP Count Alone Is Misleading

Subnet diversity measures how many distinct network blocks (subnets) your proxy IPs come from. It is arguably the most underappreciated aspect of IP quality.

What Subnets Are and Why They Matter

IP addresses are organized into subnets defined by CIDR (Classless Inter-Domain Routing) notation. A /24 subnet contains 256 IPs (e.g., 192.168.1.0 to 192.168.1.255). A /16 subnet contains 65,536 IPs.

Anti-bot systems do not just track individual IPs -- they track subnets. If they see 100 requests from 100 different IPs that all fall within the same /24 subnet, they know those requests are coming from a coordinated source. This is called CIDR block detection.

The CIDR Block Detection Problem

Here is how it works in practice:

1. Your proxy provider gives you 1,000 IPs.
2. All 1,000 IPs come from 4 subnets: 10 x /24 blocks owned by 2 ISPs.
3. You send 1,000 requests to a protected site.
4. The anti-bot system groups your requests by /24 subnet.
5. It sees 250 requests from each of 4 subnets -- a pattern that screams "proxy."
6. All IPs in those subnets get rate-limited or blocked.

Compare this to a provider with 1,000 IPs across 500 different /24 subnets:

1. The same 1,000 requests appear to come from 500 different networks.
2. Each network sends only 2 requests on average.
3. The anti-bot system sees a normal-looking traffic distribution.
4. Requests pass through without triggers.

Measuring Subnet Diversity

Calculate subnet diversity with this formula:

**Subnet diversity ratio = unique /24 subnets / total IPs**

| Ratio | Quality | Interpretation | |---|---|---| | > 0.5 | Excellent | Most IPs are in unique /24 blocks | | 0.2 -- 0.5 | Good | Reasonable distribution across subnets | | 0.05 -- 0.2 | Fair | Some concentration, may trigger detection on sensitive targets | | < 0.05 | Poor | Heavy concentration in few subnets, high detection risk |

**Example:** A pool of 10,000 IPs from 3,000 unique /24 subnets has a ratio of 0.3 (good). A pool of 10,000 IPs from 200 unique /24 subnets has a ratio of 0.02 (poor).

Subnet Diversity by Proxy Type

Different proxy types have inherently different subnet characteristics:

• **Residential:** Typically excellent subnet diversity because IPs come from millions of individual home connections across thousands of ISPs and subnets.
• **ISP/Static:** Moderate diversity that depends entirely on the provider's carrier relationships. A provider with 5 carrier partnerships has more diversity than one with 1.
• **Datacenter:** Often poor diversity because datacenter IPs come from a small number of purchased blocks. This is one reason datacenter proxies are easy to detect.

What to Look For

When evaluating a proxy provider's subnet diversity:

1. **Ask for the number of unique ASNs** (Autonomous System Numbers) their pool covers. More ASNs means more network diversity.
2. **Ask for /24 subnet count**, not just total IP count. "10 million IPs" means nothing without subnet distribution data.
3. **Test empirically:** Run 100 requests and log the IPs. Group them by /24 subnet. If you see more than 10 IPs per subnet, diversity is insufficient for sensitive targets.

---

Hex Proxies' IP Quality Approach

As a concrete example of how these principles work in practice, Hex Proxies manages IP quality across all three dimensions:

**Reputation management:** IPs are monitored against major blacklist databases continuously. IPs that accumulate blacklist entries are automatically rested (removed from active rotation) until their listings expire. ISP IPs are dedicated to individual customers, preventing cross-contamination.

**Freshness cycling:** The residential pool continuously onboards new IPs while retiring aged ones. ISP IPs are rested on rotation schedules based on usage intensity -- heavily used IPs are swapped with rested ones to prevent reputation degradation.

**Subnet diversity:** ISP IPs are sourced from multiple carrier partnerships across different ASNs and geographic regions. The residential pool inherits diversity from its global user base.

---

Practical IP Quality Audit Checklist

Before committing to a proxy provider, run this audit:

1. **Request 10 sample IPs** (or use a trial)
2. **Check reputation:** Run each IP through MXToolbox, AbuseIPDB, IPQualityScore, and Scamalytics
3. **Verify ASN classification:** Use a WHOIS lookup to confirm ISP IPs are registered under residential ASNs, not hosting ASNs
4. **Test subnet diversity:** Log 100 request IPs and calculate the /24 diversity ratio
5. **Measure success rate on your targets:** Send 500 requests to your actual target sites and calculate the success rate
6. **Compare freshness indicators:** Check if sample IPs appear in proxy detection databases (newer IPs are less likely to be listed)

An IP quality audit takes 2--3 hours and saves weeks of debugging poor proxy performance later.

---

Frequently Asked Questions

**How do I know if my proxy IPs are blacklisted?** Run them through MXToolbox Blacklist Check (free for individual lookups) or AbuseIPDB (free API for up to 1,000 checks/day). If an IP appears on more than 2 blacklists, its effectiveness on protected sites is significantly reduced.

**What is a good subnet diversity ratio for web scraping?** For moderately protected sites, a /24 diversity ratio of 0.2 or higher is sufficient. For heavily protected targets (Nike, Amazon, LinkedIn), aim for 0.4 or higher.

**Do ISP proxies have better IP quality than residential?** ISP proxies have more consistent quality because they are dedicated (one customer per IP) and provider-managed. Residential IPs vary more widely because the pool is shared and IP quality depends on the behavior of all customers using that IP.

**How often should I audit my proxy IP quality?** Monthly for production workloads. IP quality is not static -- blacklists update, new detection databases launch, and anti-bot systems evolve. A monthly audit catches quality degradation before it impacts your success rates.