Residential proxy vs datacenter proxy: how to tell them apart

A datacenter proxy exits from address space that belongs to a hosting provider, so its network type gives it away: network.usage_type: "IDC" and "hosting" in risk.signals. A residential proxy exits from a real consumer connection — home broadband or mobile — and its network type says exactly what a real customer's would. It can only be told apart by observed presence in proxy supply, with the age of that observation attached.

Side by side

Where the address lives. Datacenter: hosting and cloud ranges (usage_type IDC). Residential: consumer ISP ranges (DYN), mobile carriers (MOB), carrier-grade NAT egress (GTW).
How it is detected. Datacenter: by network type — cheap, static, high recall. Residential: only by observing the address being sold or used as an exit; the address itself carries no mark.
How long it stays. Datacenter exits are stable for weeks. Rotating residential exits change tenant within minutes to hours; dial-up pools burn hundreds of addresses a day.
Who else is behind it. A datacenter address is rarely a real customer. A residential address is somebody's home connection, and behind carrier-grade NAT one address is hundreds of people.
What a mistake costs. Blocking datacenter space by type costs little. Blocking residential space by type blocks your customers; blocking it on stale evidence blocks whoever inherited the address.
What it costs the attacker. Datacenter proxies are cents per address and trivially blocklisted. Residential proxies are sold by bandwidth at a large premium precisely because they pass those lists.

What the data says

Rotating proxy pools are overwhelmingly residential. In the 7 days to 28 October 2026, the IP99 risk feed captured 11,196,585 new proxy exit addresses; 80% of them sat in residential broadband space, 13% in mobile space and only 2% in datacenter space. The weekly breakdown by usage type, country and ASN is on Proxy exit addresses captured this week.

How the two look in a lookup

A datacenter address with no proxy evidence (Google's public resolver, captured 2026-09-13). Note that "hosting" in risk.signals is a statement about the network, not a risk verdict — the score is 0 and evidence_state is none:

{
  "ip": "8.8.8.8",
  "evidence_state": "none",
  "risk": { "score": 0, "level": "none", "signals": ["hosting"] },
  "network": { "asn": 15169, "usage_type": "IDC" }
}

A residential address that was being sold as an exit when captured (2026-09-13; it will have moved on by the time you read this). The network type is ordinary broadband — the verdict comes from the observation:

{
  "ip": "122.99.101.50",
  "evidence_state": "active",
  "risk": { "score": 78, "level": "high", "signals": ["proxy"] },
  "network": { "asn": 17471, "usage_type": "DYN" },
  "computed_at": "2026-09-13T15:41:18Z"
}

risk.signals lists the signals that matched, as slugs in alphabetical order, and the key is absent when nothing matched — the same shape the professional Pulse tier returns for its risk block. It is the only place signals appear.

What to do with each

Datacenter, no evidence ("hosting" in risk.signals, score 0): a server, a VPN endpoint, a corporate egress or a crawler. Treat as "not a consumer device", not as fraud.
Datacenter with evidence ("proxy" or "vpn" in risk.signals): infrastructure that is being used as an exit right now. Safe to challenge hard; real customers are rarely here.
Residential with fresh evidence (evidence_state: "active", "proxy" or "dialup_pool" in risk.signals): step up — a second factor, a delay, a review. Not a ban: the address is shared and will belong to someone else soon.
Residential with stale evidence (evidence_state: "stale"): a weak prior. Combine with device, velocity and account age.

FAQ

Is a datacenter IP always a proxy?

No. "hosting" in risk.signals says the address belongs to hosting or cloud infrastructure; most such addresses are servers, crawlers, VPN endpoints or corporate egress that never act as a proxy. Whether it is currently in proxy supply is a separate observation, reported by the proxy and vpn slugs in risk.signals together with evidence_state.

Are residential proxies harder to detect than datacenter proxies?

By network type, yes: a residential proxy looks identical to a customer. By observation, no: an address that keeps appearing in proxy pools is a proxy exit whatever its ISP says, and that observation, with its timestamp, is what IP99 reports.

Which one should I block?

Neither by type. Datacenter space with fresh proxy or VPN evidence can be challenged hard because real customers are rarely there. Residential space should be stepped up, not blocked, even with fresh evidence: the address is shared and changes hands.

What is an ISP proxy?

A static proxy hosted on address space registered as residential, sold as "residential" while behaving like a datacenter exit: stable for weeks and shared by many users. Its network type says residential; it is detected the same way as a rotating exit, by observed presence in supply.

Do mobile proxies count as residential proxies?

They are sold in the same market and detected the same way, but they sit in mobile carrier space (usage_type MOB) behind carrier-grade NAT, where one address is shared by hundreds of subscribers at once. That makes blocking on the address even more expensive than on home broadband.