Right now, we have some implicit assumptions about CIDRs and how they work scattered throughout the codebase. Unfortunately, it's not entirely consistent everywhere. For example, If I block 1.1.1.0/24, search will return the right thing for 1.1.1.1/24, but not 1.1.1.1./32. Same thing for the is_blocked endpoint.
We should go through and write better tests around blocking subnets larger than /32 and 128 and fix anything that pops up.