How the Far Side Classifies Your IP Address

Choosing between residential, datacenter and ISP addresses is easier once you stop describing them by how they are sold and start describing them by what a website can determine about them before it has rendered a single byte. Four checks do most of the work, and all four run before your page loads.

The autonomous system number

Every address on the internet belongs to an autonomous system — a block announced by an organisation. Looking up which one is a single query against public routing data, it costs nothing, and it is the first thing any detection layer does.

The result is not ambiguous. Hosting providers announce their ranges under their own names, and the list of hosting ASNs is public, cheap to license and kept current commercially. When an address arrives from one of those systems, a site knows it is not a household before it has looked at anything else.

This is why datacenter proxies fail on defended targets in a way no amount of header tuning repairs. The classification happened at the network layer, upstream of everything your browser can be persuaded to say about itself.

Reverse DNS and registry records

The second check resolves the address backwards to a hostname. Consumer lines usually return something structured by the provider — a pattern with a region code and a subscriber identifier. Hosting addresses frequently return either nothing or a name that is plainly infrastructure.

Registry records add a third view: the WHOIS entry for the range, its allocation type and the customer it was assigned to. These sources sometimes disagree with each other, and the disagreement itself is informative. An address announced by a hosting ASN but registered to a consumer provider is the exact signature of a static ISP proxy, and a detection vendor that cares will notice the mismatch.

Shared reputation feeds

The third layer is the one people underestimate. Commercial feeds track addresses seen doing unwanted things across many customer sites, and membership propagates. An address that was abused on somebody else's site last month may arrive at yours already carrying a score, with nothing in its behaviour to explain it.

This matters most for cheap shared pools, where you inherit whatever the previous user did. It is also why a pool that worked reliably for months can degrade without any change on your side: the addresses did not change, their reputation did.

Residential addresses are not immune, but they recover differently. A consumer line is reassigned by its provider over time, and blocking it too aggressively means blocking a real customer later — so the incentive is toward short memory rather than permanent exclusion.

Behaviour, once the other three pass

Only after an address survives those checks does behaviour start to matter: request pacing, navigation order, whether the timezone agrees with the geolocation, whether the same address is signing into unrelated accounts.

The ordering has a practical consequence that is easy to miss. Behavioural discipline cannot rescue an address that failed the network check — the request was classified before your pacing was observed. And a clean address can still be lost to careless behaviour. The two are sequential gates, not a total that can be balanced.

How each type scores

Datacenter. Fails the ASN check outright, usually fails reverse DNS, and often carries shared reputation. Excellent throughput and price. Correct for targets that never run these checks, which is more targets than purists admit.

Residential. Passes the ASN check because it genuinely is a consumer network, and reverse DNS matches the provider's pattern. Reputation varies with pool hygiene. Slower and less predictable, because it is somebody's home connection.

Static ISP. Passes ASN and registry checks, since the range is registered to a consumer provider, while delivering facility-grade throughput. The mismatch described above is detectable by a determined vendor, but far fewer sites look that deeply than run a plain ASN lookup. Its real advantage is stability: the address stays yours, which is what account work requires.

What follows from this

Two things, mainly.

First, test targets individually rather than reasoning from category. Whether a site runs the deeper checks is empirical, and the cheapest way to find out is a small sample against that specific site. Providers cannot answer this for you, because the answer belongs to the target rather than to the pool.

Second, treat address type and behaviour as separate budgets. Buying cleaner addresses does not compensate for hammering a target, and careful pacing does not rescue an address that announced itself as hosting infrastructure at the moment the connection opened.

IPIDEA runs residential and static ISP addresses on consumer-registered networks with city-level selection, which addresses the first two gates. The third and fourth are yours to manage.

FAQ

Can I check what my own address looks like?

Yes. Public tools report the ASN, reverse DNS and organisation for any address. Running one through your proxy tells you what the first gate sees.

Do all sites run all four checks?

No, and that is the point. Most run the ASN check because it is nearly free. Far fewer compare registry records against routing data.

Does a clean address stay clean?

Only while it is used carefully. Reputation is earned continuously, by whoever is using the address at the time.

Is static ISP detectable as a proxy?

By a vendor specifically looking for the routing-versus-registration mismatch, sometimes. By a plain ASN lookup, no.