Rotating residential proxies and dial-up pools: what they are and how to detect them

Q: Is the lookup free?

Yes: GET https://ip99.com/v1/ip/{ip} needs no key and no signup, 1000 lookups per day per client IP. A free account raises the allowance, and higher volumes or a self-hosted mirror are on the pricing page.

A rotating residential proxy sells somebody's home or mobile connection as an exit for minutes at a time; a dial-up pool does the same thing by forcing a broadband line to redial and pick up a fresh address on every connection. Both make the address look like an ordinary subscriber, so anything built on network type alone will not see them. They can only be detected from observed presence in proxy supply, with the age of that observation attached — the address itself carries no mark.

What they are

Rotating residential proxies

Proxy networks pay or trick consumers into running an SDK on their phone or router; the network then resells that connection as an exit. The address belongs to a real ISP customer, changes hands every few minutes, and is shared by whoever is renting the pool at that moment. The usual selling point is exactly that it passes datacenter blocklists.

Dial-up pools

A dial-up pool (ADSL or fibre lines that redial on demand, sometimes across many cities) gets a new address from the carrier on every reconnect. One line can burn through hundreds of addresses a day, all of them legitimate residential space that a subscriber will be assigned later the same day.

Mobile and ISP proxies

The same market also sells carrier-grade NAT mobile exits and static "ISP proxies" hosted on residential ranges. Different plumbing, same effect for a defender: a clean-looking network with a churning tenant.

Why network type cannot see them

Usage type answers "what kind of network is this" — residential, mobile, business, datacenter. For all of the above the honest answer is residential or mobile, and that is precisely the point of the product. A datacenter blocklist has zero recall here, and a residential allowlist has zero precision. The signal has to come from somewhere else.

What does detect them

Presence in proxy supply. Whether this address is currently being sold as an exit is an observation about the market, not a property of the address. It has to be collected continuously from the supply side.
Exit behaviour. Exits that are rented out show up in many unrelated places within minutes: the same address touching services that have nothing to do with each other is a stronger signal than any single sighting.
The age of the observation. This decides whether the first two still mean anything. A dial-up pool address is somebody else's ordinary connection an hour later. A verdict without a timestamp is not usable; a verdict older than the churn window is a false positive waiting to happen.

How IP99 reports it

One lookup, free, no signup, no API key — 1000 lookups per day per client IP:

curl https://ip99.com/v1/ip/73.113.74.194

A residential address currently sold as an exit looks like this (example captured on 2026-09-13; the address will have moved on by the time you read this, which is the whole point):

{
  "ip": "73.113.74.194",
  "evidence_state": "active",
  "risk": { "score": 94, "level": "high", "tags": ["proxy"] },
  "signals": { "proxy": true, "dialup_pool": false, "vpn": false, "hosting": false, "mobile": false },
  "network": { "usage_type": "DYN" },
  "computed_at": "2026-09-13T09:06:01Z",
  "meta": { "data_version": "risk:20260913170556 geo:20260913" }
}

The fields that matter: network.usage_type says it is dynamic residential space; signals.proxy and signals.dialup_pool say it is in proxy supply and whether the supply is a dial-up pool; evidence_state together with computed_at says how current that is; risk.score compresses freshness and strength of the evidence into 0–100. The same lookup is available to agents as an MCP tool at https://ip99.com/mcp. Field reference: API documentation.

What to do with a hit

Do not hard-block on the network type. Residential is where your customers live.
Step up, don't stop. A fresh proxy or dialup_pool signal on a signup, a coupon claim or a login from a new device justifies a second factor or a delay, not a ban.
Read the age. evidence_state: "stale" means the address was in supply before and is not now; treat it as a weak prior, not a verdict.
Keep the source. Every response carries source_url; store it with the decision so a disputed block can be traced back to what was observed and when.

FAQ

Is a residential proxy the same as a VPN?

No. A VPN is a service the user chooses, usually on datacenter or dedicated ranges, and it announces itself by its network type. A residential proxy hides inside consumer address space and is often running without the address owner's knowledge; it can only be detected from observed exit behaviour, not from the network it sits in.

What is a dial-up pool?

A pool of broadband lines that redial on demand to receive a fresh address from the carrier on every connection, sometimes spread across many cities. IP99 reports it as signals.dialup_pool. Chinese-language sources call the same thing "miaobo" (per-second redial); IP99's English term is dial-up pool.

Can you tell from the IP address alone?

No. The address itself carries no mark. What can be checked is whether it has been observed in proxy supply and how recently, which is why every IP99 verdict comes with evidence_state and computed_at.

How long does a detection stay valid?

Only as long as the evidence is fresh. Rotating exits change tenant within minutes to hours, so the score decays with the age of the last observation and the state moves from active to stale. Re-query at decision time rather than caching a verdict.

Is the lookup free?

Yes: GET https://ip99.com/v1/ip/{ip} needs no key and no signup, 1000 lookups per day per client IP. A free account raises the allowance, and higher volumes or a self-hosted mirror are on the pricing page.