DEV Community

全网低价IP
全网低价IP

Posted on Originally published at socks5ip.com.cn

Residential vs Datacenter IPs: How Detection Systems Actually Tell Them Apart

Every request announces three things before it carries a payload: the network it came from, the organisation that registered that network, and the reverse DNS its owner published. Anti-bot systems read all three, and care little which protocol you used to reach them.

So two proxies with identical credentials can have very different survival rates. The difference is rarely your configuration — it is the registry record behind the address.

What "residential" actually means

The word describes who an address block was allocated to, not how fast it is.

Registries allocate address space to organisations, and each allocation is announced under an Autonomous System with a number, a country and a registered organisation name. A block allocated to a consumer ISP — a company selling DSL, fibre or mobile subscriptions — is what the industry calls residential. A hosting company, cloud provider or colocation operator gets datacenter.

The other half of the vocabulary is orthogonal: static vs rotating is how long you keep an address, while residential vs datacenter is what it is registered as. Two axes, four combinations:

Static Rotating
Residential A fixed address on a real subscriber line. Best for long-lived accounts. A pool of subscriber addresses, reassigned per request or session. Best for wide crawling.
Datacenter A fixed address on hosting infrastructure. Cheap, fast, obvious. Hosting addresses cycled automatically. High throughput, low baseline trust.

Pricing arguments usually compare a rotating datacenter product against a static residential one, which is not a comparison at all. Read a spec as a coordinate on that grid.

What detectors actually look at

No serious system decides on one field. It builds a picture and asks whether the picture is internally consistent:

  • ASN classification. The organisation behind the AS — the strongest signal and the hardest to fake.
  • Reverse DNS. ISPs leave recognisable PTR patterns. A block with none reads as infrastructure, not a household.
  • Prefix geometry. Ranges where every host behaves identically look automated; consumer lines are sparse.
  • Reputation history. A recycled residential address can be dirty; a new, exclusive datacenter address can be spotless.
  • Request coherence. TLS fingerprint, header order, timezone, locale. A residential IP on a headless browser convinces nobody.

Coherence beats individual quality — a modest address with a matching client outperforms a pristine one with a mismatched client.

Classifying an exit IP yourself

Two free inputs — the ASN organisation name and the reverse DNS record — are enough for a first-order answer.

import ipaddress, json, re, socket, urllib.request

HOSTING_HINTS = ('amazon', 'google', 'microsoft', 'azure', 'digitalocean',
                 'linode', 'ovh', 'hetzner', 'vultr', 'alibaba', 'tencent')
RESIDENTIAL_PTR = re.compile(
    r'(dsl|ppp|dial|broadband|dynamic|pool|cable|client|comcast|telecom)', re.I)
INFRA_PTR = re.compile(r'(vps|server|cloud|host|colo|dedi|node|vm)', re.I)


def asn_lookup(ip):
    """{'asn': int, 'org': str}. BGPView is shown; swap in any equivalent
    BGP source."""
    url = 'https://api.bgpview.io/ip/%s' % ip
    req = urllib.request.Request(url, headers={'User-Agent': 'classify/1.0'})
    with urllib.request.urlopen(req, timeout=15) as r:
        prefixes = json.load(r)['data'].get('prefixes') or []
    asn = prefixes[0]['asn'] if prefixes else {}
    return {'asn': asn.get('asn', 0),
            'org': asn.get('name') or asn.get('description') or ''}


def reverse_dns(ip):
    try:
        return socket.gethostbyaddr(ip)[0]
    except (socket.herror, socket.gaierror, OSError):
        return ''                     # a missing PTR is itself a signal


def classify(ip):
    if ipaddress.ip_address(ip).is_private:
        return 'private', {'asn': 0, 'org': ''}, '', 0

    info = asn_lookup(ip)
    ptr = reverse_dns(ip)

    score = 0                     # positive leans residential, negative hosting
    if any(h in info['org'].lower() for h in HOSTING_HINTS):
        score -= 2
    if INFRA_PTR.search(ptr):
        score -= 1
    if RESIDENTIAL_PTR.search(ptr):
        score += 2
    if not ptr:
        score -= 1

    label = ('residential-like' if score >= 2 else
             'datacenter-like' if score <= -2 else 'ambiguous')
    return label, info, ptr, score
Enter fullscreen mode Exit fullscreen mode

Run it across a pool rather than against one address, and print the label beside the ASN: the shape of that output says more than any single row.

Judge the distribution, not the sample. One ambiguous address proves nothing; a pool sold as residential that returns three quarters datacenter-like is a routing problem you should have been told about. Cache ASN lookups by prefix — every address in a /24 resolves to the same ASN.

Registry data answers "what is this registered as", not "how my target treats it", so cross-check live: the IP information lookup returns the ASN, organisation and registration type for any address — the same field this script consumes.

Common mistakes

Assuming residential means clean. Residential describes registration, not history. A recycled address inherits someone else's reputation.

Rotating every request when the target expects a session. Aggressive rotation is a signal of its own: a real visitor's address does not change between page two and page three.

Validating against the wrong target. A pool can pass every connectivity check and still fail on the site you care about. Test the real destination, not an echo endpoint.

Ignoring the client side. If the TLS fingerprint, timezone and language do not match the address's region, the mismatch is louder than the address is good.

Buying on price per IP alone. Compare cost per usable address after the replacement rate, not the sticker count.

FAQ

Is residential always better than datacenter?
No. Datacenter is faster and cheaper, and many targets do not care. Residential matters when a risk model penalises hosting ranges.

How do I tell static from rotating?
Ask what happens when a session drops. Static returns the same address; rotating returns a different one.

What if my address returns ambiguous?
Plan as if it were datacenter and test it against your real target. It usually means a small regional operator or a reseller behind another AS.

Can I make a datacenter IP look residential?
Not convincingly. The pattern would have to hold across ASN registration, PTR records and prefix behaviour at once.


The longer version of this guide, on choosing a static residential provider for cross-border selling and data collection: 海外静态住宅IP怎么选. Per-platform pricing: pricing centre.

Top comments (0)