As far as “multiple accounts that haven’t misbehaved yet”, quite a while ago I looked into this as part of a browser extension. Both the SUM and length() approach slowed things down to the point of detectable grind.
The closest I came to having anything acceptable was a “this IP compared with the previous IP in the list”
I.E. sequentially registered accounts having the same IP with +/- margin of error.