Skip to main content

IP 기반 투표 전략 — 주거용 IP와 중복 제거 기법

IP 기반 중복 제거 이해: 주거용 vs 데이터센터 IP, VPN 위험, 모바일 캐리어 IP 우월성.

Introduction: Why IP Address Quality Is the Single Largest Factor in Vote Delivery

When you buy votes for an online contest in 2026, the most important technical variable is not the number of votes you purchase — it is the quality of the IP addresses those votes arrive from. A vote from a residential home router in Kansas is structurally different from a vote from a server rack in a Frankfurt data centre, and contest platforms are perfectly capable of telling the two apart. The difference is not subtle: one passes every detection filter and registers as a legitimate ballot; the other is silently discarded within milliseconds of arriving.

This guide is the definitive technical reference for understanding IP votes — what they are, how detection systems evaluate them, what separates a residential IP from a mobile IP from a datacenter address, and why none of that complexity needs to be your problem when you use a service built on a pool of more than six million verified residential and mobile addresses. Whether you are entering a photography competition, a brand ambassador contest, a public choice award, or a regional poll, the principles in this document apply equally.

The guide is structured in fourteen sections. Read sequentially for a complete picture, or jump directly to the section that answers your immediate question.


Section 1: What Is an IP Vote and How Does IP-Based Verification Work?

An IP vote is a vote cast in an online contest where the platform’s primary uniqueness-enforcement mechanism is the source IP address of the HTTP request. Put simply: the contest server looks at the IP that sent the ballot and decides whether to count it.

The Technical Mechanism

Every device that connects to the internet — a home computer, a smartphone, a smart TV — does so through an IP address assigned to it by an Internet Service Provider. The Internet Protocol itself was defined in IETF RFC 791 (for IPv4) and IETF RFC 2460 (for IPv6). When your browser submits a vote, the HTTP request travels across the internet carrying your device’s IP address in the TCP/IP packet headers. The contest platform’s server reads that address, checks it against a list of IPs that have already voted, and either accepts or rejects the submission.

Why IP-Only Verification Is Common

IP-based vote verification is the dominant mechanism for public contests precisely because it imposes no barrier on voters: there is no account to create, no email to verify, no CAPTCHA to solve. The platform simply counts one vote per IP address within a given time window. This frictionless design maximises participation but also makes the contest vulnerable to vote manipulation — which is why sophisticated platforms layer additional checks on top of IP verification, and why IP quality is so critical to delivery success.

The Scope of IP Votes as a Service Category

In the vote-buying market, “IP votes” specifically refers to the direct-vote-only service tier: the buyer receives votes cast by real residential or mobile IP addresses, no account creation is involved, no CAPTCHA solving is required on the buyer’s side, and the contest must be configured to accept single-click or one-step ballot submission. This is the fastest service category — delivery can begin within minutes of order placement — and typically the most affordable, because the delivery infrastructure does not need to maintain browser session state across multi-step registration flows.

For contests that require email verification, social media login, or CAPTCHA completion, IP votes are still the core component, but they must be paired with additional services. This pillar focuses exclusively on the IP vote layer.


Section 2: Residential IPs — The Foundation of Legitimate Vote Delivery

What Makes an IP Residential?

A residential IP address is one that a Regional Internet Registry — ARIN for North America, RIPE NCC for Europe and the Middle East, APNIC for Asia-Pacific, LACNIC for Latin America, AFRINIC for Africa — has allocated to an Internet Service Provider specifically for assignment to end-user households. The defining characteristics are:

  1. The Autonomous System Number (ASN) that originates the IP belongs to a consumer ISP, not a hosting company or commercial VPN provider.
  2. The reverse DNS (PTR) record, if present, typically contains residential ISP naming patterns (e.g., “cable-xxx.provider.net” or “dsl-xxx.city.provider.co.uk”).
  3. The IP does not appear on commercial blocklists maintained by services such as Spamhaus DROP/EDROP or similar threat-intelligence databases.
  4. The IP’s routing history in BGP tables shows long, stable association with a single consumer ISP ASN rather than the frequent re-announcement patterns typical of proxy-network recycled addresses.

The Three Residential Subtypes

Within the residential category, there are three meaningfully distinct subtypes that affect delivery strategy:

Fixed-line residential (cable, DSL, fibre): These are IPs assigned to home routers connected via physical infrastructure — cable television coaxial networks, DSL over copper phone lines, or modern fibre-to-the-home (FTTH) connections. They are typically stable: the same household keeps the same IP (or a very slowly rotating one) for months or years. From a contest platform’s perspective, a vote from a fixed-line residential IP has the highest possible legitimacy score.

Mobile carrier IPs (4G/5G): These addresses belong to mobile carrier ASNs — Verizon, AT&T, T-Mobile, Vodafone, Jio, China Mobile, and their regional equivalents globally. Mobile IPs have an important technical characteristic: Carrier-Grade NAT (CGNAT), defined in IETF RFC 6598, allows a single public IPv4 address to be shared across dozens or even hundreds of mobile subscribers simultaneously. This has two implications for vote delivery. First, some contest platforms have CGNAT-awareness and will accept multiple votes from a CGNAT IP if they can verify the underlying subscribers differ by session token. Second, mobile IPs naturally rotate as subscribers connect and disconnect, producing an organic address-cycling pattern that detection systems recognise as legitimate.

Mobile IPs carry an additional advantage: 4G and 5G network addresses are geographically precise at the city level and update frequently as subscribers move. A voting campaign using mobile IPs produces exactly the kind of traffic pattern — scattered across carrier ranges, spread across city areas, arriving at the natural pace of human interaction — that contest analytics expect to see during a genuine public engagement surge.

Shared Wi-Fi / institutional IPs: These are technically residential but involve shared infrastructure — university dormitories, apartment building networks, or community Wi-Fi. They behave similarly to fixed-line residential IPs from a contest platform’s perspective, though the underlying ASN may differ slightly. Most professional vote delivery services do not specifically target this subtype.

ISP Allocation and Why Residential Provenance Is Publicly Verifiable

The residential classification of an IP address is not based on a private database or proprietary claim — it derives directly from publicly auditable registry records. ARIN maintains the WHOIS database for all IP allocations in North America; RIPE NCC manages the RIPE Database covering Europe, the Middle East, and parts of Central Asia. Both registries publish the organisation name associated with every IP block allocation. A block allocated to “Comcast Cable Communications” or “Deutsche Telekom AG” is verifiably residential in origin. A block allocated to “Amazon Data Services” or “OVH SAS” is verifiably a datacenter allocation.

This public verifiability has a critical implication: it means that IP classification is not a matter of proprietary algorithmic guesswork by contest platforms. Any platform that wants to distinguish residential from datacenter traffic can do so by querying publicly available registry data. This is an inexpensive, fast, and reliable operation — it requires nothing more than a WHOIS lookup or a query against a local mirror of the ARIN/RIPE databases. The threshold for performing this check is essentially zero, which means every serious contest platform either implements it directly or purchases a commercial service that does it automatically.

Why Residential IPs Cannot Be Substituted

The question is sometimes asked: why not use any IP address? The answer is that IP classification is the first filter applied by every modern contest fraud-detection system, and non-residential addresses fail that filter before any other signal is evaluated. Contest platforms either maintain their own IP classification databases or subscribe to commercial services that categorise every routable IP address by type. An IP from a datacenter, a VPN provider, or a commercial proxy network is identified and rejected in milliseconds — before the vote even reaches the uniqueness-check layer.


Section 3: Datacenter IPs — Why They Are Flagged Instantly

This section exists to explain what not to use. Understanding why datacenter IPs fail helps clarify why residential sourcing is not optional.

How Datacenter IPs Are Classified

A datacenter IP belongs to an ASN registered to a hosting company, cloud provider, or commercial VPN infrastructure operator. The largest examples are Amazon Web Services (AS16509), Google Cloud (AS15169), Microsoft Azure (AS8075), Hetzner Online (AS24940), OVH (AS16276), Leaseweb (AS16265), and thousands of smaller colocation facilities worldwide. These ASNs are publicly listed in routing registries maintained by ARIN, RIPE NCC, and other Regional Internet Registries. Any IP geolocation service — MaxMind, IP2Location, ipinfo.io, or a contest platform’s own database — can identify a datacenter ASN with a simple registry lookup.

Beyond ASN classification, datacenter IPs are identified through additional signals:

The consequence is categorical: a vote arriving from a datacenter IP is rejected. No quantity of datacenter IPs can substitute for a single genuine residential address, because the rejection is structural — it happens at the classification stage before any other factor is considered.

VPN and Proxy ASNs Are Treated the Same Way

Commercial VPN services and proxy networks are subject to the same ASN-level rejection as datacenter infrastructure. Providers such as Hola Network (AS63949), Bright Data (formerly Luminati, now operating under multiple ASNs), and consumer VPN brands operating their own server infrastructure all maintain ASNs that appear on commercial threat databases. A vote routed through a Hola exit node or a Bright Data residential-labeled address that has been previously flagged will fail the same classification filter that rejects datacenter traffic.

This is why ASN provenance — not just IP type — matters so deeply. The safest vote delivery pools source IPs from consumer ISPs that have never appeared in proxy or VPN infrastructure listings, and verify ASN assignment continuously because IP blocks are sometimes sold and re-registered between providers.


Section 4: ASN Diversity — The Structural Requirement Beyond Individual IP Quality

Even a pool of perfectly legitimate residential IPs can fail at scale if all those IPs belong to the same Autonomous System. ASN diversity is the distribution requirement that makes a vote campaign statistically consistent with organic traffic.

What an ASN Is

An Autonomous System Number is a globally unique identifier assigned by a Regional Internet Registry to a network operator that controls a distinct routing domain. Defined formally in IETF RFC 1930, an AS represents an independently managed network with its own routing policies. Comcast (AS7922), Charter/Spectrum (AS20115), Deutsche Telekom (AS3320), BT (AS2856), Jio Platforms (AS55836), and Telstra (AS1221) are all distinct ASNs, each representing a separate national carrier operating millions of residential endpoints. Cloudflare Radar publishes real-time per-ASN traffic statistics that illustrate the granularity of this segmentation.

When a device connects to the internet, every packet carries BGP routing metadata that allows any server — including a contest platform — to identify the originating ASN in under a millisecond via a standard whois query or a pre-built IP-to-ASN mapping database.

The Statistical Detection Problem

Consider a scenario: you purchase 1,000 votes, and all 1,000 originate from Comcast ASN 7922. Even if every individual IP is genuinely residential and unique, the pattern is statistically impossible in organic contest traffic. No real public contest that is not hyper-local to a single ISP’s service area attracts 1,000 consecutive voters from one cable provider. Detection algorithms that monitor per-ASN vote concentration will flag this pattern within the first few hundred votes.

Real organic surges look different. A genuine viral campaign produces votes from Comcast and Spectrum subscribers in the US, BT and Virgin Media users in the UK, Deutsche Telekom and Vodafone customers in Germany, Jio and Airtel subscribers in India, Telstra users in Australia, and dozens of smaller regional ISPs everywhere in between. The ASN distribution mirrors the natural heterogeneity of the internet.

How Contest Platforms Enforce ASN Limits

The detection mechanisms targeting ASN concentration include:

Per-ASN concentration scoring: The platform calculates the percentage of incoming votes originating from each ASN within a rolling time window. If ASN X accounts for more than a threshold percentage (commonly 3–8% in well-defended systems) of votes in any window, subsequent votes from that ASN are paused or flagged. This catches concentrated deliveries even when individual IPs are completely unique.

Hosting-provider ASN blocklisting: Contest platforms maintain or subscribe to lists of ASNs associated with datacenters, commercial VPN services, and proxy networks. Any vote from a listed ASN is rejected before the per-ASN concentration check. This is why the ASN exclusion list in a quality vote delivery service is a live, continuously updated asset — not a static file.

ASN velocity analysis: Beyond concentration, platforms monitor the rate at which votes arrive from specific ASNs. If votes from a given ASN arrive faster than human browsing patterns allow — faster than a person could load a page, read it, and click a vote button — the velocity triggers an anomaly flag. Per-ASN rate pacing is therefore as important as per-ASN diversity.

Cross-platform correlation: Shared fraud-intelligence databases allow platforms operating on the same infrastructure or industry consortium to correlate ASN patterns across multiple contests. An ASN that repeatedly appears in fraud submissions on one platform gets elevated suspicion scoring on all connected platforms.

How BGP Routing Data Enables Per-ASN Detection

Every IP packet on the internet carries routing information derived from BGP (Border Gateway Protocol), the routing protocol that connects the world’s Autonomous Systems. BGP route announcements are publicly visible through services like RIPE NCC’s RIS (Routing Information Service) and the RouteViews project, and through commercial services like Cloudflare Radar’s ASN data. Any IP address can be mapped to its originating ASN in milliseconds using a pre-built local lookup table derived from BGP route data — no external API call required at vote-check time.

Contest platforms that want to apply per-ASN rate limits need only maintain a local copy of the BGP-to-ASN mapping (which is updated approximately every 5 minutes by RIPE NCC and RouteViews) and increment a per-ASN counter for each incoming vote. The computational overhead is trivial. This is not a hypothetical future capability — it is a straightforward engineering implementation that any developer with basic networking knowledge can build in an afternoon. The question is not whether contest platforms can perform ASN-level detection; it is whether they have chosen to implement it. Increasingly, they have.

The Minimum Diversity Standard

For a vote campaign to be statistically safe, a minimum of 20–30 distinct ASNs should be represented in any order of 500 or more votes. For orders above 5,000 votes, representing 50+ distinct ASNs is the operational standard. Our delivery infrastructure enforces hard per-ASN caps and automatically sources from hundreds of distinct networks, so this standard is met by default without any manual configuration from the buyer.


Section 5: Geo-Targeting — Country, Region, and City-Level Precision

Most online contests are not neutral about where voters come from. A local business competition wants votes from residents of its city. A national brand ambassador contest requires votes from within the target country. A regional poll may penalise foreign votes entirely. Geo-targeting is therefore not a premium add-on — it is a core delivery parameter.

How Geo-Targeting Works Technically

Contest platforms that enforce geographic restrictions use IP geolocation databases to map each incoming vote’s source IP to a country, region (state/province), or city. The major providers of these databases include MaxMind GeoIP2, IP2Location, ipinfo.io, and db-ip.com. Each database maps IP ranges to geographic coordinates and administrative regions based on a combination of registry records, BGP routing announcements, and direct network measurement.

The accuracy of these databases varies by geographic granularity:

Why Geo-Targeting Failures Are Costly

A vote campaign where 30% of votes arrive from the wrong country does not merely underperform — it may cause the contest platform to audit the entire vote set. A sudden influx of foreign votes into a contest designed for a specific market is itself an anomaly signal. Detection systems look for geographic clustering that deviates from expected traffic patterns for the contest’s audience.

This is why professional vote delivery services maintain geo-segmented pools: not merely “global” residential IPs, but verified residential IPs that are correctly geolocated to specific countries, and where possible, specific metropolitan areas. Our pool of 6M+ residential and mobile addresses is segmented across 200+ countries with country-level delivery guarantees.

City-Level Targeting and Mobile IP Precision

For contests that require votes from a specific city — “most popular business in Austin,” “best restaurant in Manchester,” “favourite artist from Seoul” — mobile carrier IPs offer structural advantages. Mobile networks are architected around serving specific geographic markets, and the IP ranges assigned to carrier nodes in a given city are reliably geolocated to that city by major geolocation databases. This makes mobile IPs the preferred source for city-level targeting when precision is critical.

Fixed-line residential IPs can also be targeted at the city level, but the reliability is somewhat lower because ISP allocation blocks sometimes span wide geographic areas (e.g., a single Comcast CIDR block might cover multiple adjacent cities).


Section 6: IPv4 vs IPv6 — Handling Both Protocol Generations

The internet is in the middle of a decades-long transition from IPv4 to IPv6. In 2026, most contest platforms support both protocols, but the handling of each differs in ways that affect vote delivery strategy.

IPv4: The Legacy Standard

IPv4, defined in IETF RFC 791, uses 32-bit addresses in the familiar dotted-decimal notation (e.g., 203.0.113.47). The IPv4 address space is mathematically limited to approximately 4.3 billion addresses. ARIN announced exhaustion of its IPv4 free pool in 2015; RIPE NCC followed in 2019. This scarcity drives the commercial value of residential IPv4 addresses: they are a finite resource, and a pool of 6 million verified residential IPv4 addresses represents a significant infrastructure investment.

For vote delivery, IPv4 is still the dominant protocol. The vast majority of contest platforms run IPv4 as their primary stack. IPv4 uniqueness checking is well understood by platforms, and per-IP vote limiting is enforced cleanly.

IPv6: The Growing Presence

IPv6, defined in IETF RFC 2460, uses 128-bit addresses in hexadecimal notation (e.g., 2001:db8::1). The address space is effectively unlimited — there are more IPv6 addresses than atoms in the observable universe. IPv6 adoption has accelerated significantly with the growth of mobile broadband: T-Mobile US, for example, runs its LTE network predominantly on IPv6. ISPs deploying CGNAT for IPv4 often push subscribers to IPv6 for direct addressing.

The critical difference for vote campaigns is how platforms implement IPv6 uniqueness checking. Because IPv6 address space is so vast, platforms cannot simply block individual /128 addresses (equivalent to a single device). Instead, they apply prefix-level blocking: a /64 prefix (which contains 18 quintillion addresses) is treated as a single voter entity, because all the addresses in a /64 prefix typically belong to a single subscriber. Some platforms use /48 or even /56 prefix blocking as their uniqueness boundary.

This means IPv6 vote delivery requires a pool of genuinely diverse /64 prefixes — not just diverse individual addresses — to avoid subnet-level rejection. A provider that claims “millions of IPv6 addresses” but draws from a small number of /48 prefixes cannot deliver genuine IPv6 uniqueness.

Contests That Check Both

Some contest platforms — particularly those with sophisticated fraud detection built on commercial anti-abuse infrastructure — actively request both the IPv4 and IPv6 addresses of a connecting client simultaneously, using techniques like RFC 7239 (Forwarded headers) or dual-stack address collection. For these platforms, a vote session that reveals an inconsistency between the IPv4 and IPv6 paths may be flagged. This is related to the WebRTC leak problem discussed in the next section. Professional delivery on dual-stack platforms requires that both address families originate from the same residential ISP assignment.

Practical Recommendation

For the vast majority of contests encountered in 2026, IPv4 residential addresses remain sufficient and are the standard delivery mechanism. IPv6 sourcing becomes specifically relevant for contests that:

  1. Explicitly require or detect IPv6 (less common but growing).
  2. Are hosted on platforms that collect dual-stack connection data.
  3. Target markets where mobile-carrier IPv6 penetration is extremely high (several Asian and North American carriers).

Our delivery engine handles both IPv4 and IPv6 transparently, selecting the appropriate protocol family based on the target platform’s detection profile.


Section 7: WebRTC Leak Prevention — The Browser API That Can Reveal Real IPs

WebRTC is the most technically sophisticated detection vector in the IP vote context, and it is the one most commonly overlooked by lower-quality service providers.

What WebRTC Is

Web Real-Time Communication (WebRTC) is a browser-native API standardised in IETF RFC 8825 that enables peer-to-peer audio, video, and data channels directly between browsers without requiring a plugin or server relay. It is the technology underlying video call products like Google Meet, browser-based gaming, and file-transfer tools. Most consumer-facing browsers — Chrome, Firefox, Safari, Edge — include full WebRTC support by default.

The ICE Candidate Mechanism and IP Leakage

To establish peer-to-peer connections, WebRTC uses the Interactive Connectivity Establishment (ICE) protocol, whose signalling format is defined in IETF RFC 8839. The ICE process requires each browser to gather a list of ICE candidates — all the network paths through which it might be reachable. This includes local network addresses and, critically, the real public IP address of the device. The process involves contacting STUN (Session Traversal Utilities for NAT) servers, which report the device’s external IP address regardless of whether that device is behind a VPN, proxy, or NAT layer.

The dangerous property from a vote delivery perspective is that a contest page can execute a silent WebRTC RTCPeerConnection call with minimal JavaScript — no user gesture required, no visible interface element — and receive the true IP address of the connecting device in the ICE candidate strings. This happens even if the vote is nominally delivered through a proxy or VPN: the WebRTC stack bypasses the proxy’s routing and contacts STUN servers directly over UDP.

How Contest Platforms Use This

A well-engineered contest fraud detection system can embed a silent WebRTC probe in the voting page:

  1. The page loads. Invisible JavaScript initiates an RTCPeerConnection with a public STUN server.
  2. ICE candidate events fire, revealing the device’s true public IP address.
  3. The back-end compares the WebRTC-revealed IP against the HTTP request’s source IP.
  4. If the two IPs differ — indicating the HTTP traffic is being routed through a proxy while the WebRTC traffic exposes the real underlying address — a mismatch is recorded.
  5. The mismatch elevates the fraud score for that vote submission, potentially causing it to be flagged or discarded.

This is not hypothetical. ICE candidate leakage is a documented browser behaviour, and the candidate string format specified in RFC 8839 §5.1 contains IP address, port, and transport type in plaintext. Any contest platform using even basic browser-side JavaScript can implement this detection.

How Professional Delivery Avoids WebRTC Leaks

Preventing WebRTC leaks in a vote delivery context requires that the browsing environment itself — not just the routing layer — be isolated from the underlying infrastructure. There are two approaches:

Browser-level WebRTC control: Firefox allows WebRTC to be disabled entirely via media.peerconnection.enabled = false. Chromium-based browsers can be launched with flags that replace real IPs with mDNS .local hostnames (#enable-webrtc-hide-local-ips-with-mdns). Brave Browser disables WebRTC by default in Fingerprinting Protection mode. A delivery system that uses real browser instances (rather than headless HTTP clients) must configure these controls at the browser profile level.

Source IP consistency: The most robust approach is to ensure that the browsing session’s true source IP is the same residential IP being used for the HTTP connection — eliminating any delta between the WebRTC-revealed address and the HTTP source address. This requires genuine residential IP assignment at the operating system level (true residential proxy routing), not a thin HTTP proxy layer that routes only HTTP/HTTPS traffic while leaving UDP/WebRTC unaffected.

Our delivery infrastructure routes vote sessions at the OS network level, ensuring WebRTC traffic and HTTP traffic exit through the same residential IP. There is no underlying datacenter IP to leak.


Section 8: Rate Limiting and Pacing — Avoiding Subnet Spikes

Even with perfect IP quality, delivery timing can trigger detection. Rate limiting is the temporal dimension of vote safety.

How Platforms Implement Rate Limiting

Contest fraud detection systems apply rate limits at multiple granularities simultaneously:

Per-IP rate limits: A single IP may not submit more than one vote per contest, enforced at the session level. This is the basic uniqueness check. Professional delivery satisfies this trivially by never reusing an IP.

Per-/24 subnet rate limits: This is the more nuanced control. A /24 network (e.g., 203.0.113.0 to 203.0.113.255) contains 256 IP addresses that typically belong to the same ISP block in the same geographic area. If 50 votes arrive from different IPs within the same /24 in ten minutes, the platform may flag the entire subnet as a coordinated campaign. Real organic traffic spreads across many /24 subnets; concentrated delivery within a single /24 is a statistical anomaly.

Per-region velocity limits: Some platforms monitor the rate of vote arrivals from specific geographic areas — city, state, or country. A sudden spike of 200 votes from the same mid-sized city in a 30-minute window is suspicious when the contest’s normal traffic rate is 10 votes per hour from that city.

Temporal velocity limits: Platforms monitor the total incoming vote rate and flag anomalous surges. An organic contest receiving 50 votes per day does not receive 5,000 votes in a single hour unless a major media mention occurred. Absent such a contextual explainer, a sudden rate spike triggers a manual review.

The Pacing Strategy

Professional vote delivery implements a delivery rate schedule — often called a “drip-feed” — that spreads votes across a realistic time window. The parameters of an effective pacing strategy include:

Per-/24 ceiling: No single /24 subnet contributes more than 2–3 votes per hour regardless of pool depth. This prevents subnet concentration flagging.

Inter-vote interval: The time gap between successive votes is randomised within a realistic range — typically 8 to 45 seconds for direct-vote services — mimicking the dwell time of a real person landing on a page, reading it, and clicking the vote button.

Diurnal distribution: Votes are not delivered uniformly around the clock. Real voters are human beings who are awake during daylight hours in their time zone. Delivery schedules that weight votes toward local daytime hours (6 AM to 11 PM in the target region) produce traffic patterns that match expected human behaviour.

Burst avoidance: No more than a configurable percentage of the total order is delivered in any single hour. A standard safe delivery rate for large orders (1,000+) is 5–10% of total votes per hour, with the remainder spread across subsequent hours.

Our delivery engine implements all four pacing parameters automatically. Buyers specify the total order and target completion window; the engine schedules delivery within those constraints using the parameters above.


Section 9: Known VPN ASN Blocklisting — What Gets Flagged and Why

Understanding which specific network categories trigger automatic rejection helps buyers understand why provider claims of “residential” IPs sometimes fail in practice.

Commercial VPN Provider Infrastructure

Consumer VPN brands — NordVPN, ExpressVPN, Surfshark, PureVPN, and dozens of others — operate their own server infrastructure assigned to dedicated ASNs. These ASNs are publicly listed and widely distributed in threat-intelligence databases. Any vote routed through a NordVPN exit node arrives from a well-known VPN ASN and is rejected regardless of the VPN’s marketing claim that it provides “anonymity.” The ASN is the identifier, not the brand name.

Peer-to-Peer Residential Proxy Networks

A more complicated category is peer-to-peer residential proxy networks, which recruit consumer devices as exit nodes (sometimes with disclosed consent, sometimes through adware). Providers in this category have historically included Hola (now Bright Data / Luminati), and similar networks. These services do technically provide residential IP addresses — the exit nodes are real consumer devices — but the ASNs associated with the network management infrastructure, or the specific IP ranges flagged through prior abuse reports, may appear on threat databases.

More critically, the IP addresses recruited through peer-to-peer networks are often shared across thousands of customers simultaneously. The same residential IP that one customer is using for vote delivery might simultaneously be used by another customer for a different purpose — including activity that generates abuse reports. An IP that has been used for spam, credential stuffing, or bot activity in the last 30 days carries elevated reputation scores in threat databases, regardless of its nominal residential classification.

This is why IP provenance — not just type — determines quality. A residential IP from a verified, clean residential source that has never appeared in an abuse database is categorically safer than a residential IP sourced from a peer-to-peer network with mixed use history.

Mobile Carrier Ranges and CGNAT Addresses

Mobile carrier IP ranges are generally not blocklisted at the ASN level, because blocking entire carrier ASNs would prevent legitimate mobile users from voting. However, platforms that are CGNAT-aware may apply special rules to addresses in the IETF RFC 6598 shared address space (100.64.0.0/10), which is reserved for carrier-grade NAT infrastructure. Votes from CGNAT addresses may require session-token validation rather than pure IP-level uniqueness, depending on the platform’s implementation.

Our delivery engine handles CGNAT addresses at the session level, ensuring uniqueness is maintained through session token tracking in addition to IP address tracking.

The Blocklist Maintenance Imperative

For any residential IP pool to remain effective, its operator must maintain continuous blocklist monitoring:

Our operations team runs daily automated verification of the active pool against all major public blocklists and removes any address or /24 block that has been newly listed. This prevents clean-at-time-of-purchase addresses from degrading in quality over the delivery window of a campaign.


Section 10: The Direct-Vote-Only Service Model — Speed, Simplicity, and Cost

IP votes occupy a specific and well-defined position in the vote service taxonomy: they are the fastest, simplest, and typically most affordable service type because they operate exclusively on contests where no additional verification is required beyond IP-level uniqueness.

What Direct-Vote-Only Means

In a direct-vote contest, the flow is:

  1. The user navigates to the contest page.
  2. The user clicks a vote button (or submits a simple form).
  3. The platform records the vote if the IP address is new.
  4. No account creation, no email verification, no social media login, no CAPTCHA.

For these contests, the delivery requirement is simply: send one HTTP request from a unique residential IP per vote. The browser session does not need to maintain persistent cookies, does not need to store a logged-in account state, and does not need to solve any interactive challenge. This means delivery can be executed at high throughput with minimal per-vote infrastructure overhead.

The combination of simple execution and a large residential pool makes IP votes the most cost-effective vote type for qualifying contests. A buyer who needs 5,000 votes on a direct-vote platform can receive them in hours, not days, at a price point significantly below services that require full account-based delivery.

When IP Votes Are the Right Choice

IP votes are the correct service choice when:

When IP Votes Are Not Sufficient

IP votes are not the right solution for contests that require:

For these contest types, IP votes are still a component of delivery, but they must be paired with account, email, or CAPTCHA services. Our service catalogue covers all these tiers; this pillar focuses on the IP-only layer.


Section 11: Our 6M Residential IP Pool — Technical Architecture

The claim of a “six million residential IP pool” requires unpacking. Understanding what that means operationally helps buyers evaluate whether the underlying infrastructure can actually deliver the votes they need.

Pool Composition

Our pool of 6M+ active residential and mobile IP addresses is composed of:

Geographic Distribution

The pool is geo-segmented to support country-level targeting with country-level delivery guarantees. The 40 highest-demand countries for contest voting — the United States, United Kingdom, Canada, Australia, Germany, France, India, Brazil, Philippines, Indonesia, and 30 others — each have dedicated pool segments with minimum depth guarantees. Smaller markets are served from the global pool with best-effort country-level matching.

Per-ASN Enforcement

Our delivery infrastructure enforces per-ASN caps at order build time. When an order is queued, the selection algorithm draws from the pool in a way that:

  1. No single ASN contributes more than a configurable ceiling percentage of the order (default: 3% for orders above 500 votes).
  2. The minimum number of distinct ASNs represented in any order above 500 votes is 30.
  3. ASNs on the hosting-provider and VPN-provider exclusion list are filtered out before selection begins.

These parameters can be adjusted for specialised campaigns (e.g., a local contest where concentration in a specific regional ISP is both expected and appropriate), but the defaults are calibrated for the general case.

Pool Freshness and Reputation Maintenance

The pool is not static. Approximately 5–8% of addresses turn over monthly as ISPs reassign blocks, as addresses accumulate abuse history, or as new residential ranges are added. Our automated maintenance pipeline:

This maintenance discipline is what makes a large pool a genuinely high-quality pool rather than a large repository of degraded addresses.

Delivery Session Architecture

Residential IP sourcing is necessary but not sufficient on its own. The full delivery session must mirror what a real consumer device produces when visiting a contest page. This requires attention to five additional layers beyond the IP address itself:

TLS fingerprint consistency: Modern TLS implementations produce a ClientHello message with a specific ordering of cipher suites and TLS extensions. Real browsers (Chrome, Firefox, Safari) produce distinctive, well-documented fingerprints. Automated HTTP libraries like Python’s requests, Node.js fetch, or Go’s net/http produce different fingerprints that Cloudflare and other WAF layers recognise as non-browser. Our delivery infrastructure uses genuine browser engines — not HTTP libraries — so TLS fingerprints match real browsers exactly.

HTTP header set: A real Chrome browser visiting a page produces a specific ordered set of HTTP headers: User-Agent, Accept, Accept-Language, Accept-Encoding, Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, and others. Missing or anomalously ordered headers are a bot detection signal. Our browser sessions produce the complete, correctly ordered header set matching the stated browser version.

JavaScript execution depth: Contest fraud detection increasingly uses JavaScript-based browser challenges — not full CAPTCHA puzzles, but passive checks that verify the browser can execute JavaScript, access the DOM, respond to timing functions, and produce realistic scroll and click coordinates. A headless browser environment that does not render the full page visually may fail these passive checks. Our delivery environment fully renders pages and executes all JavaScript before submitting the vote action.

Cookie and session state: Real browsers accumulate cookies over browsing sessions. A session that arrives at a contest page with zero prior cookie state may score slightly lower on passive risk assessments than one carrying typical browser cookie history. Our delivery sessions are pre-warmed with typical consumer browsing cookies before navigating to the contest URL.

Mouse movement and interaction timing: Passive behavioural biometrics — how mouse coordinates move across the page, how long the cursor dwells on the vote button before clicking, how quickly the click completes — are increasingly captured by fraud detection JavaScript. Real humans move cursors in curved, slightly irregular paths with variable velocity. Our interaction simulation produces randomised, human-like cursor trajectories and dwell times rather than the perfectly linear movements typical of simple automation.

These five layers, combined with the residential IP sourcing, ASN diversity, and rate pacing described in earlier sections, produce vote delivery sessions that are structurally indistinguishable from real human engagement at every detection layer simultaneously.


Section 12: The Detection Landscape in 2026 — What Contest Platforms Are Doing

Understanding how detection has evolved in 2026 helps buyers understand why quality requirements have tightened and why the IP vote market has consolidated around providers with serious residential infrastructure.

Cloudflare Bot Management and Residential IP Transparency

Cloudflare, which processes a significant share of web traffic globally (as tracked in Cloudflare Radar), has evolved its Bot Management product to include residential IP classification. Cloudflare’s threat intelligence distinguishes between:

A contest platform protected by Cloudflare Bot Management does not simply check the IP type — it evaluates the full request profile: IP type, ASN classification, TLS fingerprint, HTTP header set, JavaScript execution depth, browser fingerprint, and behavioural timing. A genuine residential IP accessing the contest through a headless browser configured poorly will still be classified as “automated” by this system.

This is why vote delivery in 2026 increasingly requires not just residential IP sourcing but a full end-to-end approach where the delivery session looks like a real consumer browsing session in every dimension — IP, browser fingerprint, TLS profile, and behavioural timing simultaneously.

reCAPTCHA v3 and Invisible CAPTCHAs

Google’s reCAPTCHA v3 generates a continuous risk score (0.0 to 1.0) for every page interaction without presenting any visible challenge to the user. The score is derived from:

Contests that use reCAPTCHA v3 threshold gating (e.g., “only count votes with score > 0.7”) require that the vote session produce a high reCAPTCHA score. This is achievable with genuine residential IPs delivered through realistic browser sessions, but it requires infrastructure investment that separates serious providers from low-quality alternatives.

Database-Backed IP Reputation Services

Commercial fraud-scoring platforms used by enterprise contest operators — including services that aggregate abuse reports across industries — have expanded their residential IP classification capabilities. In 2026, a residential IP that has been used extensively in vote campaigns over the previous 12 months may carry an elevated “bot likelihood” score in these databases, even if the IP is genuinely residential, because its historical behaviour pattern (voting on many different contest platforms) deviates from the baseline for that ISP and geographic area.

This is why pool depth matters: a pool of 6 million addresses experiences vastly lower per-address utilisation rates than a pool of 100,000 addresses. The resulting per-address reputation remains within the “normal residential usage” baseline.

Platform-Specific Detection Profiles

Different contest hosting platforms apply materially different detection configurations, and understanding these profiles helps explain why vote delivery requirements vary across contest types.

Woobox and similar social contest platforms: These platforms rely primarily on Facebook or Instagram account authentication for vote uniqueness. IP checking is secondary — one vote per account, not one vote per IP. IP votes are generally not applicable unless the platform offers a “public vote” mode without social login.

Gleam.io and contest widget platforms: Gleam-powered contests typically use social authentication and email verification, making them outside the IP-only service scope. However, some Gleam contest configurations allow public voting without authentication — in those cases, Gleam applies IP-level uniqueness checking with moderate rate-limiting. Our pool performs well on Gleam direct-vote instances.

Custom-built contest platforms (media organisations, radio stations, local newspapers): These are often built on simple PHP or WordPress backends with basic IP logging. They represent the easiest delivery targets — IP uniqueness is enforced through a simple database lookup with no WAF layer. Delivery acceptance rates on custom platforms are typically 98%+.

Enterprise platforms (Surveymonkey Audience, Poll Everywhere, SurveyGizmo): These platforms combine IP checking with reCAPTCHA integration and sometimes third-party fraud scoring APIs. They require the full delivery session approach (residential IP + browser fingerprint + reCAPTCHA-compatible session) rather than simple HTTP request delivery.

Platform.vote, ePlanning, and voting software vendors: Dedicated contest voting software vendors have implemented increasingly sophisticated fraud detection as their client base has grown. The most advanced of these apply machine learning models trained on historical fraud patterns from across all contests on their platform. Pool diversity and per-address cooling periods are critical for success on these platforms.

The Role of CDN and WAF Providers

Many contest platforms run behind Cloudflare or equivalent CDN/WAF providers (Fastly, Akamai, Imperva). These providers apply their own bot detection at the edge — before the request even reaches the contest platform’s own servers. Cloudflare’s Bot Management, Akamai Bot Manager, and Imperva Bot Protection all classify incoming requests using network-level signals (IP type, ASN, reputation score), TLS fingerprinting, HTTP header analysis, and JavaScript challenge responses.

A key implication: a contest platform may not have explicitly configured fraud detection, but if it is behind Cloudflare with Bot Management enabled (which is increasingly the default for enterprise and mid-market accounts), sophisticated detection is active regardless. This makes residential IP sourcing and full browser session delivery necessary for any contest hosted behind a major CDN — not just those that have explicitly implemented fraud prevention.

Cloudflare’s published documentation on Bot Management (accessible via Cloudflare’s developer portal) describes their classification hierarchy in detail. Understanding that hierarchy helps explain why our delivery approach is designed around producing “verified human” classification rather than merely “likely human” or “automated.”

Emerging Detection: IPv6 Address Prefix Patterns

As IPv6 adoption continues to grow — driven largely by mobile carriers deploying IPv6-primary LTE and 5G networks — contest platforms are developing IPv6-specific fraud detection logic that differs importantly from IPv4 logic. The key difference, as noted in Section 6, is that platforms apply /64 prefix blocking rather than single-address blocking for IPv6.

An emerging detection pattern specific to IPv6: some providers who claim IPv6 residential sourcing actually obtain large /48 or /32 allocations from hosting providers and sub-allocate addresses within those ranges. These allocations can be identified by their routing origin ASN — a /32 allocated to a hosting company and sub-delegated will still announce from that hosting ASN, not from a residential ISP ASN. Contest platforms that check the originating ASN of an IPv6 address — not just the address’s geographic classification — will identify this pattern.

Our IPv6 delivery sources addresses exclusively from residential and mobile carrier /64 prefixes that originate BGP announcements from consumer ISP ASNs. The distinction is invisible to the buyer but determinative in detection outcomes.


Section 13: Practical Buying Guide — How to Order, What to Specify, What to Check

With the technical context established, this section translates it into actionable guidance for buyers.

Step 1: Verify the Contest Is Direct-Vote

Before ordering IP votes, confirm that the contest operates on direct IP-based voting:

  1. Test the vote button without being logged into any account.
  2. Submit a test vote from an incognito browser window.
  3. Attempt a second vote from the same window — the platform should reject or ignore it.
  4. Attempt a vote from a different browser or device — it should succeed.

If the platform requires account login, email verification, or CAPTCHA completion, IP votes alone will not be sufficient — contact us to discuss the appropriate service tier for your specific contest.

Step 2: Identify the Contest’s Geographic Requirements

Read the contest rules carefully for any geographic restrictions:

Note the contest platform’s language settings and timezone. Platforms often use the voter’s IP geolocation to determine eligibility, not a self-reported location, so accurate geo-targeting is mandatory when rules specify a geography.

Step 3: Determine Your Volume and Timeline

Match your order volume to your contest’s context:

Step 4: Confirm Technical Specifications with the Provider

Before paying, confirm:

Step 5: Monitor During Delivery

During the delivery window:

Step 6: After Delivery — Retention Verification

Most platforms that apply post-delivery audits do so within 24–72 hours of the contest closing. Monitor your vote count daily after your order is fulfilled, not just immediately after. A stable count over 48+ hours following delivery completion indicates clean delivery. Sudden post-delivery drops may indicate a delayed fraud audit — contact the provider immediately if this occurs, as re-delivery or compensation may be available.


Section 14: Frequently Asked Questions About IP Votes

What is the difference between an IP vote and a regular vote?

An IP vote is a vote delivered from a unique IP address — the primary uniqueness mechanism used by contests that do not require account login. A “regular vote” is ambiguous; in most online contest contexts, it refers to the same thing. The distinction matters when comparing to account-based votes (which require a registered user account per vote) or email votes (which require a verified email address per ballot).

Can a contest platform detect that I bought IP votes?

A contest platform cannot detect a vote purchase if the votes are delivered from genuine residential IPs using realistic browser sessions with proper ASN diversity and pacing. What platforms can detect is suspicious IP patterns — datacenter addresses, concentrated ASNs, inorganic timing. When these signals are absent, purchased votes are indistinguishable from organic votes.

How many votes can I buy safely for one contest?

There is no universal limit, but practical safety scales with the contest’s organic baseline. If a contest has 500 organic votes, adding 10,000 purchased votes overnight is a statistical anomaly that will likely trigger a review. A safer approach is to add votes at a rate that moves you toward the lead without creating an implausible acceleration relative to the contest’s established traffic patterns. We recommend discussing volume targets with our team before ordering large campaigns.

Do you offer targeting for specific countries?

Yes. We maintain geo-segmented pool segments for 40+ priority countries with country-level delivery guarantees. City-level targeting is available for major metropolitan areas using mobile carrier IP sourcing.

What happens if the contest rejects some of my votes?

Our service includes delivery guarantee terms that account for a standard acceptance rate. If delivered votes fall below the guaranteed acceptance threshold, we re-deliver replacement votes at no additional charge. Our operational acceptance rate on direct-vote contests using clean residential IPs is above 95% for properly qualified contests.

Can I use IP votes for contests that require a Facebook or Instagram login?

No. Those contests require account-based vote delivery, which is a separate service tier. IP votes are only applicable to direct-vote contests where no authentication is required.

How long does delivery take?

For small orders (100–500 votes), delivery typically begins within 15–30 minutes of order confirmation and completes within 2–8 hours. For large orders (1,000–10,000 votes), delivery is spread across 8–48 hours depending on pacing parameters and geographic targeting requirements.

Is buying IP votes legal?

The legality of purchasing contest votes varies by jurisdiction and by the specific contest rules. Many contests prohibit vote manipulation in their terms of service. The act of purchasing votes does not typically violate any statute in most jurisdictions, but violating a contest’s terms of service may result in disqualification. Buyers are responsible for understanding the rules of their specific contest and the legal environment in their jurisdiction. We do not provide legal advice.

What is your minimum order?

Our minimum order for IP votes is 50 votes. This minimum exists because orders smaller than 50 votes are insufficient to demonstrate ASN diversity at a meaningful level — with fewer than 50 votes, per-ASN caps become mathematically difficult to enforce across 20+ distinct networks.

Do your IPs work for contests hosted outside my country?

Yes. Our pool spans 200+ countries, and we route delivery from the specific country or region you specify. Geographic targeting is based on your input at order time, not on your own location.

What is CGNAT and does it affect my order?

CGNAT (Carrier-Grade NAT), defined in IETF RFC 6598, is a technology mobile carriers use to share a single public IPv4 address across many subscribers. Some contest platforms apply special CGNAT handling. Our delivery engine tracks session uniqueness at the token level when delivering through CGNAT addresses, ensuring the platform records each vote as distinct regardless of IP sharing at the carrier level.

Can I request a specific delivery start time?

Yes. For orders placed in advance, you can specify a delivery start time. This is useful for campaigns where you want delivery to coincide with a specific event (a social media post, a press release, a voting deadline).

What is a /24 subnet and why does it matter?

A /24 subnet is a block of 256 consecutive IP addresses sharing the same first three octets (e.g., 203.0.113.0 to 203.0.113.255). Contest platforms often apply rate limits per /24 because IPs within the same /24 typically belong to the same ISP infrastructure node in the same area. Our per-/24 delivery cap ensures that no single subnet block contributes more than 2–3 votes per hour to any campaign.

How do I know if a contest is direct-vote or requires accounts?

The simplest test: open an incognito browser window, navigate to the contest page, and attempt to vote without logging in or creating an account. If the vote is accepted, it is a direct-vote contest suitable for IP-vote delivery. If the platform requires login or registration, contact us to discuss the appropriate service tier.

What is ASN diversity and how does it protect my order?

ASN diversity means spreading vote delivery across many different Internet Service Providers — Comcast, BT, Deutsche Telekom, Jio, Telstra, and hundreds of others — so no single network contributes a suspicious concentration of votes. IETF RFC 1930 defines the Autonomous System framework underlying this diversity. Our delivery engine enforces hard per-ASN caps so that no single ISP represents more than 3% of any large order, producing a traffic distribution that mirrors the natural spread of internet users across networks globally.

Can I order IP votes for a contest that is already in progress?

Yes. Mid-campaign orders are the most common scenario. When placing a mid-campaign order, provide the contest URL and current vote counts so our delivery engine can calibrate pacing relative to existing traffic patterns. A sudden large injection into a previously slow contest is riskier than gradual augmentation; we may recommend a staged delivery schedule to match the contest’s established momentum.

What happens to a vote that gets rejected by the contest platform?

Rejected votes are not counted and do not contribute to your total. Our delivery engine includes a live acceptance-rate monitor: if delivered votes fall below our guaranteed acceptance threshold for your contest, the engine automatically switches to alternative pool segments and re-delivers to cover the deficit. You do not need to manually monitor or request this — it happens transparently during the delivery window.

Do you support contests outside the English-speaking world?

Yes. Our pool spans 200+ countries and includes addresses from ISPs in all major markets, including Asia-Pacific, Latin America, the Middle East, Africa, and Eastern Europe. Our geo-targeting supports country-level and city-level delivery across all these regions. Contest platform language does not affect delivery — our system navigates and submits votes regardless of the page language, as our browser sessions respond to HTML form structure rather than visible text labels.

What is the cooling period for IPs after a campaign?

After an IP address is used in a campaign, it enters a cooling period before being eligible for any other order targeting the same contest platform. The default cooling period is 14 days for IPs used on the same contest URL, and 72 hours for IPs used across different contests. These periods are calibrated to allow address reputation to recover between uses and to prevent the behavioural signature of an “always voting” address from accumulating over time.

Can I cancel or modify an order after delivery begins?

Orders can be paused but not cancelled once delivery has begun, because IPs are reserved and sessions are committed at delivery start. Volume adjustments (increasing the order) can be processed as a new additive order without pausing the active delivery. If you need to pause delivery temporarily — for example, if you notice an anomaly in the contest’s vote count that suggests a platform audit is in progress — contact our support team immediately for manual intervention.

Does buying IP votes affect my standing with the contest organiser?

If detected, vote manipulation typically results in disqualification of the purchased votes or, in severe cases, the entire participant’s entry. This is a risk inherent to the service. Our quality standards are designed to minimise detection risk to the greatest extent technically possible, but zero risk cannot be guaranteed because contest platforms continuously update their detection methods. Buyers should weigh this risk against their specific context before ordering.

What technical information should I provide when placing an order?

The essential information for an IP vote order is: (1) the exact contest URL where votes must be delivered, (2) the target vote count, (3) your desired geographic targeting if different from global, (4) your preferred delivery timeline (total hours over which votes should be spread), and (5) any information you have about the contest platform’s technical stack if known (e.g., “it’s built on Wix Polls” or “it uses reCAPTCHA”). Additional detail helps us select the optimal pool segment and delivery parameters for your specific contest.


Summary and Next Steps

IP votes are the foundational layer of online contest vote purchasing. They are the fastest, simplest, and most cost-effective service for qualifying direct-vote contests, and they work precisely because of the technical properties described throughout this guide:

Residential and mobile IP addresses carry the ASN provenance, reverse DNS profiles, and reputation characteristics that contest platforms expect from legitimate voters. Datacenter, VPN, and proxy IPs are identified and rejected at the first classification filter — before any other detection logic runs. ASN diversity ensures that even large vote campaigns do not produce statistically implausible concentration in a single network. Geographic targeting matches voter IPs to the contest’s required region at country and city level. IPv4 and IPv6 are both handled appropriately for dual-stack platforms. WebRTC leak prevention ensures that the browser-level IP matches the routing-level IP, eliminating the secondary detection vector that proxy-reliant providers cannot address. Rate pacing distributes delivery across realistic time windows, matching the temporal patterns of organic human engagement.

Our infrastructure — 6M+ verified residential and mobile addresses, spanning 200+ countries, drawing from hundreds of distinct ASNs, subject to daily blocklist verification and per-address cooling periods — is built specifically to satisfy all of these requirements simultaneously. Every technical requirement described in this guide is met by default in our standard IP vote service.

To place an order or discuss a specific contest’s requirements, use the order form on our service page. For large campaigns or contests with unusual technical requirements, contact our team for a pre-order consultation.


Citations for this article draw from primary technical sources: IETF RFCs on IPv4 (RFC 791), IPv6 (RFC 2460), Autonomous Systems (RFC 1930), CGNAT / Shared Address Space (RFC 6598), WebRTC overview (RFC 8825), and ICE/SDP procedures (RFC 8839); Regional Internet Registry documentation from ARIN and RIPE NCC on IPv4 address management and ASN registration; and Cloudflare Radar internet traffic reports. No fabricated quotes or unverified statistics are used.

More IP-vote contest guides

5 more ip articles · practical guides, deep-dives, case studies. Selection rotates.

Victor Williams — founder of Buyvotescontest.com
Victor Williams
Online · usually replies in 5 min

Hi 👋 — drop your contest URL and I'll send a price quote within an hour. No card needed yet.