Unique IPs and Class-C Metrics Outlived Their Assumptions

Unique IP and “unique class-C” counts appear in older backlink tools and in some current ones. The idea was that links from many distinct network locations are less likely to be one person’s link network than links from a handful of addresses. That inference depended on a web where a site’s IP told you something about who ran it, and that web is gone.

The metric is still computed. What it measures now is mostly which CDN your linking sites use.

What the metric was originally doing

In the era it comes from, most small sites sat on one server with one IP, and a network of sites built by one person for link purposes frequently sat on the same server, or in the same address block. So counting distinct addresses — and distinct third octets, the “class C” grouping — approximated counting distinct operators.

“Class C” is itself a legacy term. Classful addressing was superseded by CIDR long before these metrics became popular; what the tools actually group on is the /24, i.e. the first three octets. The name persisted because SEO vocabulary is conservative.

As a heuristic it was crude and it worked well enough to be worth having. Three changes since then removed the assumption underneath it.

The three things that broke it

Shared hosting at scale. Very large numbers of unrelated sites share addresses on commodity hosts. Two links from the same IP now carry approximately zero information about common ownership, because millions of unrelated sites are co-located.

CDNs and reverse proxies. A site behind a large CDN presents that CDN’s address, not its own. Sites on the same CDN look like the same network location. Since a substantial fraction of the web now sits behind a handful of providers, IP-diversity counts are compressed toward the number of major CDNs in use rather than the number of operators.

Trivial address diversity. For anyone deliberately constructing a network, spreading sites across providers and regions is cheap and automated. The metric’s only value was as a signal that was expensive to fake; it isn’t.

Put together: the metric now produces false positives (unrelated sites appearing related because they share infrastructure) and false negatives (related sites appearing independent because diversity is cheap). Both errors, in the same metric, in unknown proportion.

What it still weakly indicates

Two narrow cases survive, and they’re worth stating so the metric isn’t dismissed entirely.

Extreme concentration is still odd. If 300 referring domains resolve to four addresses, that’s a pattern worth looking at. It might be one hosting reseller. It might not. Either way it’s a prompt to open a few of the sites, not a conclusion.

Sudden change is informative. If a profile’s IP diversity collapses over a quarter, something structural happened — a mass migration, a scraper network, or an influx from one source. The change is the signal, exactly as with lost-link reports and index churn.

In both cases the metric functions as a sort key that surfaces something to inspect. It is not evidence on its own.

The measurement problems on top of the conceptual one

Even taking the metric at face value, the data has issues.

IP is resolved at crawl time, once. Addresses change. A vendor’s recorded IP for a linking domain may be years old, and nothing in the interface tells you how stale it is — the same provenance question as what first seen and last seen actually mean.

IPv6 complicates the grouping. The /24 grouping is an IPv4 concept. How a tool buckets dual-stack or IPv6-only hosts is a vendor decision that is rarely documented.

Multiple A records and geo-routing. A domain may resolve differently depending on where the resolver sits. Two vendors crawling from different regions can record different addresses for the same site, entirely legitimately.

Load balancers rotate. A recorded address may not be stable enough to group on at all.

So the metric is a stale, region-dependent, single-sample observation of a property that no longer means what the metric assumes.

What to do when a client or vendor report shows it

Don’t report it as a diversity or safety metric. “Link diversity: 640 unique class-C” implies a level of independence you cannot substantiate.

If it’s in a template you can’t remove, annotate it. One sentence: “IP and /24 counts are a legacy heuristic; shared hosting and CDNs mean they no longer approximate distinct operators.”

Use the thing it was a proxy for instead. What people wanted was “are these links from genuinely independent sources.” The better proxies are qualitative and cheap: do the sites have different designs, different authors, different content, plausible reasons to cite you? Twenty minutes of looking beats any address count.

Watch for it in vendor-supplied “safety” scoring. Where a toxicity or risk score includes IP concentration as a feature — and some do — it inherits this metric’s error rates. Worth knowing when reading what a toxic-link score is actually measuring.

The general lesson, which is bigger than this metric

This is the clearest available example of a measurement outliving its validity. The formula never broke. The world it was a proxy for changed, and the number kept being computed with the same name, the same range, and the same implied meaning.

There are almost certainly other metrics in current use in the same condition, and the tell is always the same: a metric whose usefulness rests on an unstated assumption about how the web is put together. When you meet one, the question to ask isn’t “is this computed correctly” — it usually is. It’s “is the thing this was a proxy for still connected to it.”

Which is a habit worth generalising. Every derived metric in a link tool encodes assumptions about the web at the time it was designed, and none of them come with an expiry date on the label. See what a link index actually contains for the version of this problem that applies to the raw data itself.