Every proxy provider's pricing page shows the same three tiers — datacenter, residential, mobile — with prices that differ by an order of magnitude. Datacenter bandwidth might cost $0.5–1.5/GB, residential $3–8/GB, mobile $10–30+/GB. Newcomers often read that as "better quality costs more" and stop there. But what actually is IP reputation? Why does an IP that belongs to a phone on a carrier network cost 10–20x one that belongs to a server in a datacenter? And when is paying the premium rational versus a waste?
The answer is a story about how anti-bot systems see the internet, told through ASN records, allocation history, and behavioral baselines.
The Core Concept: What an IP Address Signals About Its Human
Anti-bot vendors (Cloudflare, Akamai, DataDome, PerimeterX, and in-house teams) don't judge your request in isolation. They judge it against a prior: how likely is a human to be making a request from this address? Every IP carries a probability distribution built from:
WHOIS and ASN data. Every IP belongs to an Autonomous System — a routing domain with a registered owner. AS14061 is DigitalOcean. AS7922 is Comcast Cable. AS15169 is Google. When a request arrives from an ASN whose owner is a hosting company, the prior is "server, not human." When it arrives from a consumer ISP or mobile carrier ASN, the prior is "household or phone." This lookup is free, instant, and deterministic — it's the first and cheapest filter any anti-bot system applies.
Allocation class. Within consumer ASNs, there are static residential blocks, dynamic DHCP pools, and carrier-grade NAT (CGNAT) ranges where thousands of phones share one public IP. CGNAT is fascinating for reputation: since so many real humans share the address, the address's behavioral history is a blend of thousands of legit users — making it statistically very hard to condemn based on aggregate behavior, and very costly for a site to block outright (blocking one CGNAT IP blocks real customers).
Historical behavior. Vendors accumulate months of observation: has this IP solved captchas, been served block pages, generated HTTP/2 fingerprints consistent with curl, run at inhuman cadence, or appeared in credential-stuffing campaigns? A fresh datacenter IP starts with a bad prior; a recycled datacenter IP can start with an outright terrible one — the previous renter's sins are inherited. This is why "clean" datacenter pools vary so much between providers: it's not the IPs, it's the churn and the screening.
Reverse signals. PTR records ("pool-72-0-1-23.phlapa.fios.verizon.net"), rDNS absence, presence in public blocklists (Spamhaus, etc.), and whether the IP runs services on ports that consumers don't expose.
The Three Tiers, Properly Understood
Datacenter proxies are IPs registered to hosting ASNs. Cheap, fast (datacenter peering, low latency), enormous pools, and instantly identifiable as non-human infrastructure. Against unprotected or lightly-protected sites (many public APIs, government data portals, price feeds, anything behind simple rate limits), datacenter is perfectly sufficient — the target isn't doing ASN-based judgment. Against modern bot management, datacenter IPs get challenged at very high rates, though a well-maintained pool screened for prior abuse still gets through on sites whose sensitivity is medium.
Residential proxies are IPs registered to consumer ISP ASNs — either devices in opt-in networks or genuine ISP allocations. The ASN lookup returns Comcast/Deutsche Telekom/etc. Because the prior says "household," these IPs start with high trust. Sites that instantly challenge datacenter traffic often wave residential traffic through provided the rest of the request (TLS fingerprint, headers, behavior) is also consistent — the IP gets you past the first prior, not the whole exam. The main practical risks: quality varies by provider (some "residential" pools contain a lot of disguised datacenter space — always validate), and pricing is per-GB, so careless architecture burns money.
Mobile proxies are IPs in mobile carrier ASNs, sitting behind CGNAT. Highest trust of all: the carrier prior is "a phone," the CGNAT sharing effect launders aggregate behavior, and blocking mobile IP ranges en masse is something sites avoid because mobile users are a huge share of real traffic. Mobile is what you need for the hardest targets (certain app backends, heavily defended social platforms, sites that block residential ranges). The tradeoffs are real: expensive per-GB, slower, smaller pools, and often throttled.
Here's a runnable way to see the tier system with your own eyes — ASN lookup on your current proxy exits:
import requests
def ip_intel(ip: str) -> dict:
"""Free ASN/allocation lookup — the same first-pass data
anti-bot systems use."""
r = requests.get(f"https://api.iptoasn.com/1.2/ip/{ip}", timeout=15)
d = r.json()
return {
"ip": ip,
"asn": d.get("as_number"),
"owner": d.get("as_name"), # hosting co? consumer ISP? carrier?
"announcement_country": d.get("announced"),
}
def tier_of(owner: str) -> str:
o = (owner or "").lower()
if any(k in o for k in ("digitalocean", "aws", "amazon", "hetzner", "ovh",
"linode", "google cloud", "microsoft", "contabo",
"choopa", "leaseweb", "colocation", "hosting")):
return "DATACENTER (low-trust prior)"
if any(k in o for k in ("verizon", "comcast", "telekom", "charter", "at&t",
"deutsche telekom", "orange", "vodafone", "jio",
"chunghwa", "sky broadband", "bell canada")):
return "CONSUMER/CARRIER (high-trust prior)"
return "UNKNOWN — investigate"
# point it at your proxy exit:
# print(requests.get("https://httpbin.org/ip",
# proxies=YOUR_PROXIES, timeout=30).json())
for ip in ["104.131.180.10", # a DigitalOcean IP
"73.6.20.19"]: # a Comcast residential IP
info = ip_intel(ip)
print(f'{info["ip"]:>16} AS{info["asn"]} {info["owner"][:40]:<40} -> {tier_of(info["owner"])}')
Run this and the pricing tiers stop being marketing — you can literally see AS14061 "DIGITALOCEAN-ASN" versus AS7922 "COMCAST-7922". That's the ledger the anti-bot system is reading.
Choosing Rationally: Match the Tier to the Target
The mistake I see most is binary thinking — "our target is hard, use residential for everything." The rational model is per-target, per-endpoint tiering:
- Public endpoints, APIs, unprotected pages → datacenter (or no proxy at all). Paying residential prices here is pure waste.
- Standard e-commerce and content sites with bot management → residential, with session control.
- Login-gated flows, account-bound operations, the hardest platforms → mobile for the sensitive endpoints, residential for the browsing around them.
And the tier is only one variable. A residential IP carrying a curl TLS fingerprint still gets caught; a clean datacenter IP carrying a perfectly consistent browser fingerprint sometimes doesn't. Reputation gets you past the prior; fingerprint and behavior consistency get you past the exam. Budget accordingly: tier selection is where the money is, but fingerprint engineering is where the block-rate is.
Practical selection checklist, in order: (1) Can the target even detect ASN class? Test with a known datacenter IP first — if it sails through, done. (2) If not, residential — but validate the pool: sample exits and run ASN lookups like the script above; a "residential" pool that returns hosting ASNs more than a few percent of the time is mislabeled. (3) Reserve mobile for the specific endpoints that still block you, and only those. (4) Re-test monthly — sites change their posture, and yesterday's sufficient tier may be today's challenge wall.
IP reputation isn't mysticism. It's ASN registries, allocation classes, and behavioral history — all knowable, all testable, and all priceable. Once you can read them yourself, the tier menu makes sense as engineering, not as a upsell ladder.
Disclosure: I use Thordata's proxy network across all three tiers for the tier-matched collection described in this post. If you want to try it, they're at thordata.com, and the code **thor020* gets you 10% off.*
Top comments (0)