IP quality: residential, datacenter, and where the “proxy” flag comes from

Open the IP check on this site and you get a column of fields: the address, country and city, ASN, ISP, and then a few switch-like flags: proxy, hosting, mobile. Everyone understands the country row. The rows after it are what a site's risk engine actually cares about. They decide whether you get an extra captcha at login, whether a signup goes through, whether a streaming service will play anything.

Three kinds of IP: residential, datacenter, mobile

Roughly speaking, public addresses fall into three uses.

A residential IP is what a home broadband provider hands to the router in your flat. Comcast, BT, China Telecom, NTT: each holds large blocks and issues one address per subscriber, usually dynamic, rotating every few days or whenever the modem restarts. The defining property is "one address, roughly one household," which is why sites treat it as the most normal, most human-looking origin.

A datacenter IP, often labelled hosting, belongs to cloud providers and colocation facilities: AWS, Google Cloud, Alibaba Cloud, Vultr, Hetzner, plus countless small operators you have never heard of. What runs behind these addresses is servers, not someone on a sofa. A browser session arriving from an AWS address is a little odd on its face. Not impossible, but worth a second look.

A mobile IP comes from a phone carrier. Carriers never had enough addresses to give every handset its own, so they use CGNAT (carrier-grade NAT) to pack thousands of phones behind one exit. To a website, a mobile address means "many real people behind one number," so blocking it outright is risky and they lean on other signals instead.

ASN and ISP are not the same thing

An ASN is an autonomous system number, a routing-layer concept. The internet is a federation of tens of thousands of "autonomous systems," each announcing to the world "these address ranges are mine." AS4134 is China Telecom's backbone, AS4837 is China Unicom, AS16509 is Amazon. Looking up the ASN answers "who is responsible for this range in the routing table," and the data is public; anyone can pull it from BGP feeds.

The ISP or org field comes from WHOIS and the regional internet registries (RIRs such as APNIC and ARIN). It records who the range is registered to. Usually the two agree, but not always: a small company may lease a block from a large carrier and announce it under its own ASN, or the reverse.

A GeoIP database's job is to fold the ASN, the registration data and assorted circumstantial evidence (latency measurements, user-reported locations, Wi-Fi positioning) into a guess about which city an address sits in. Country-level guesses are quite reliable. City-level guesses are closer to a coin toss. The city on this site's IP card is regularly off by a few hundred kilometres, and that isn't a bug so much as the nature of the data.

How the proxy and hosting flags get attached

This is the most misunderstood part. There is no central authority stamping addresses as "proxy." The flags are estimates made independently by each data vendor, and they come from a handful of sources. The crudest is classification by ASN type: if the range belongs to a cloud provider, mark it hosting. Crude, but stable. Then there is active scanning, where vendors subscribe to a pile of VPN services, cycle through every exit node, and record what they see. Public lists help too; Tor exit nodes are published and open proxies get compiled into lists, and both go straight into the database. Behavioural statistics fill in the rest: one address showing up in too many different accounts and countries within a short window gets inferred to be a shared exit. And user reports, spam traps and abused signup forms feed back in.

Every one of these is probabilistic. Addresses get recycled, VPN operators swap machines, scans go stale. So the same IP can be "proxy" in one database and clean in another, and an ordinary home connection can carry a flag for years because someone ran a proxy on it once. False positives are a built-in cost of the system, not an exception.

Blacklists are a separate mechanism again. RBLs such as Spamhaus serve mail systems; what they answer is "has this address sent spam or hosted a botnet." Their effect on web logins varies by site, and many sites don't check them at all. The blacklist row on this site asks Spamhaus ZEN over DNS (no key needed) and AbuseIPDB when an API key is configured, and lists whichever zones answered: SBL, XBL or PBL. A PBL hit on its own is a policy listing, not a record of abuse; it marks ranges that shouldn't be sending mail directly, which describes most residential broadband. The row shows "—" only when neither provider answered, and that says nothing about you either way.

Why a VPN exit is nearly always a datacenter IP

Consider the operator's position. They need overseas machines with big pipes, predictable pricing and room for hundreds of users, and the only place to get that is a datacenter. Nobody rents a house in Los Angeles and runs fibre to it so you can have a node there. Self-hosted users are in the same boat: a VPS is a cloud server, and its address is hosting by definition.

Hence the product category called "residential proxies," whose selling point is an exit on genuine home broadband. Their supply deserves scepticism. Most residential proxy networks are built by reselling ordinary people's bandwidth, sometimes through an SDK bundled into free software, sometimes through apps that pay you pennies to "share idle bandwidth." Your traffic leaves through a stranger's router, and theirs may leave through yours. Whether to use one is a personal call, but it helps to know what is underneath.

What this means if you are circumventing censorship

Realistically, your exit IP will be flagged as hosting. That is nearly unavoidable, and it does not mean you did anything wrong. What matters is how each site reacts to the flag:

• More captchas at login and signup; some services refuse to send SMS codes at all.
• Streaming services enforce licensing regions and treat a datacenter IP as "not a local viewer."
• Payment and e-commerce risk engines add hosting IPs to the risk score.
• One exit shared by dozens or hundreds of people means someone else's abuse lands on you. This last one is common. When a node suddenly triggers captchas everywhere, it has usually been burned by a neighbour.

The remedies are limited but real. Switch nodes, preferring lines your provider labels as "native IP" or residential. Keep sensitive things (banking, your primary account) off a shared exit. And if a particular node keeps getting rejected by a particular site, stop fighting it on that site.

FAQ

The site says my IP is a proxy, but I'm not running one. Your carrier may use CGNAT, or the range was used as a proxy by someone before you. The flag comes from a GeoIP data source; we only relay it and cannot change it.

The city is wrong. Can I correct it? No. This site doesn't maintain its own geolocation database. Countries are usually right; city-level error is normal across the industry and doesn't affect the other checks.

Is the mobile flag good or bad? For most sites it's neutral to mildly positive: mobile ranges hide many real people and are rarely blocked wholesale. But mobile and proxy both being true still reads as suspicious.

Will the flag go away if I switch nodes? If the new node sits with the same cloud provider, the hosting flag mostly stays. What can change is the proxy flag and blacklist status, because those attach to specific addresses.