Residential vs Datacenter Proxies: Why Network-Type Blocklists Miss Most of the Problem

If you've ever treated "block datacenter ASNs" as the main proxy defence, you're mostly looking at a thin slice of the market. The addresses showing up in proxy supply this week are overwhelmingly on home broadband and mobile networks — and those look exactly like your customers.

This post walks through how IP99 (built by ThreatHunter) separates a datacenter proxy from a residential one, what this week's capture numbers look like, and how to read a free lookup without treating network type as a verdict.

Two exits, two detection problems

A datacenter proxy exits from address space that belongs to a hosting or cloud provider. Its network type gives it away: network.usage_type is IDC, and "hosting" often appears in risk.signals. Detection by type is cheap and has high recall for that class of exit.

A residential proxy exits from a real consumer connection — home broadband (DYN), mobile (MOB), or carrier-grade NAT egress (GTW). Its network type is identical to a legitimate customer's. There is no mark on the address itself. You only know it's a proxy exit because it keeps showing up in proxy supply, with a timestamp on that observation.

That difference drives everything else:

	Datacenter proxy	Residential proxy
Where it lives	Hosting / cloud ranges	Consumer ISP, mobile, CGNAT
How you detect it	Network type	Observed presence in supply
How long it stays	Often weeks	Minutes to hours (rotating); dial-up pools burn hundreds of addresses a day
Who else is behind it	Rarely a real customer	Somebody's home line; behind CGNAT, hundreds of people
Cost of a false positive	Usually low	You block customers, or whoever inherits the address next
Cost to the attacker	Cents per address, easy to list	Sold by bandwidth at a premium because it passes those lists

IP99's own guide is explicit: datacenter does not mean malicious, and residential does not mean human. A hosting address can be a legitimate VPN endpoint, a CI runner or a crawler partner. A residential address is exactly what rotating proxy networks sell.

What this week's data says

Between 4–10 October 2026 (UTC), the IP99 risk feed captured 11,171,033 proxy exit addresses it had not seen in the previous 7 days (+24% week over week). Source: ip99.com/en/proxy-exits (generated 11 Oct 2026 UTC).

By usage type:

Usage type	Share
Residential broadband	79.7%
Mobile network	12.9%
Gateway / NAT egress	4.5%
Datacenter	2.2%
Education / unclassified	~0.7%

About 65% were rated high-risk at the moment of capture. The rest still carried a proxy-class signal at a lower level.

"Captured" here means the address entered the feed with a proxy-class signal (proxy, VPN, dial-up pool, cloud phone, or hijacked shared proxy) and was not in the live 7-day risk mirror. Addresses that go quiet and return can be counted again. The page describes what 53 upstream sources delivered — not the total number of proxies in the world.

If your defence is mainly an ASN or hosting blocklist, you're mostly looking at that 2.2% datacenter slice.

How the two look in a free lookup

No key, no signup:

curl https://ip99.com/v1/ip/8.8.8.8

Live response shape (11 Oct 2026):

{
  "ip": "8.8.8.8",
  "evidence_state": "none",
  "risk": {
    "score": 0,
    "level": "none",
    "signals": ["hosting"]
  },
  "network": {
    "asn": 15169,
    "usage_type": "IDC"
  }
}

"hosting" describes the network. The score is 0 and evidence_state is none. Treat this as "not a consumer device", not as fraud.

A residential exit only shows up when there is an observation. The network block still looks ordinary (usage_type: "DYN" or "MOB"). The verdict is in risk.signals (for example "proxy" or "dialup_pool") plus evidence_state and computed_at. Real home and mobile addresses should be masked in public write-ups; check one yourself with the free endpoint rather than copying sample IPs from a blog.

Useful fields when you wire this into a decision:

• evidence_state: active (fresh evidence is scoring), stale (seen before, past the decay window, score 0), none (never seen — a coverage blind spot, not "safe").
• risk.score: 0–100 measuring freshness and strength of verifiable evidence. It is not "probability this person is an attacker".
• risk.signals: only matched slugs, alphabetical; the key is absent when nothing matched.

# Your own egress
curl https://ip99.com/v1/ip

# Remaining anonymous quota
curl https://ip99.com/v1/me

Anonymous quota is 500 lookups per day per client IP. The endpoint returns Access-Control-Allow-Origin: *, so browser clients work too.

What to do with each case

• Datacenter, no proxy evidence ("hosting", score 0): server, VPN endpoint, corporate egress or crawler. Don't treat as fraud by type alone.
• Datacenter with fresh "proxy" / "vpn": infrastructure acting as an exit right now. Safe to challenge hard; real customers are rarely here.
• Residential with fresh evidence (evidence_state: "active"): step up — second factor, delay, review. Prefer not to ban on the IP alone: the address is shared and will change hands.
• Residential with stale evidence: a weak prior. Combine with device, velocity and account age.

Neither type should be blocked by type. Blocking all residential space is how you lock out your own users. Blocking on stale labels is how you punish whoever inherited the address after a dial-up pool moved on.

ISP proxies and mobile

An ISP / static residential proxy sits on address space registered as residential but behaves more like a datacenter exit: stable for weeks, shared by many buyers. Network type still says residential; detection is still observation in supply.

Mobile proxies are sold in the same market. They sit in MOB space behind carrier-grade NAT, where one public address can sit in front of hundreds of subscribers. Blocking on that address is even more expensive than on home broadband.

Bottom line

Network type tells you where an address lives. It does not tell you whether it is being sold as a proxy exit today. Most of this week's newly captured exits sat in residential and mobile space — exactly where type-based lists are blind.

IP99 reports the observation and how fresh it is, then lets the score decay when the evidence ages out. Try a lookup on ip99.com, read the weekly breakdown on proxy exits, or pull the OpenAPI at https://ip99.com/openapi.json if you want to wire it into a tool.