Is your proxy really residential? How to check an IP’s network, type and location

Why the label is not enough

In July 2025 Castle, a company that builds bot detection, bought a plan sold as sneaker proxies and analysed the 4,287 unique IPs it received. More than 99% were on datacenter networks, and about 78% sat in the same /24 blocks as one large provider’s datacenter IPs.

Classification is messy even when nobody is cheating. Proxyway’s Proxy Market Research 2026 checked IP quality with IPinfo and Scamalytics, and its analysis of IP types with IP2Location showed that the database judges addresses by who owns them rather than the network they sit on, so some genuine ISP proxies come back as hosting. Two providers’ Brazilian “mobile” pools turned out to be only about a quarter mobile. None of this shows on a pricing page; most of it shows in the IPs.

Check 1: the network behind the IP

Every public IP belongs to an autonomous system, a network with its own number (ASN) and a registered operator. That number is the fastest way to tell a household line from a server. Open a session through the proxy and ask a lookup service who you are:

curl -s -x gate.chronoproxy.com:7000 \
  -U "cp_a1b2c3-cc-us-sid-check1-ttl-10:PASS" \
  https://ipinfo.io/json

# {
#   "ip": "73.162.XX.41",
#   "city": "Philadelphia", "region": "Pennsylvania", "country": "US",
#   "org": "AS7922 Comcast Cable Communications, LLC",
#   ...
# }

The org field is the ASN and its operator. For a residential IP it should be a consumer broadband provider. An ISP proxy is a special case: the server sits in a data center, but the address is registered to and announced by a consumer ISP. That is what the product promises, so an ISP proxy should also show a consumer network. A datacenter proxy shows a hosting network, which is fine when that is what you bought.

Use the same session key two or three times in a row. Each request should come back with the same IP; if it does not, the session is not sticky, which is check 5.

Consumer networks in the US, UK and Germany

These are the largest consumer networks in our three main markets, with their share of each country’s users in APNIC Labs’ measurements (downloaded 18 October 2026). A residential exit in these countries will usually show one of them, or a smaller regional ISP.

Two traps. Charter does not use one ASN: a Spectrum customer can sit in any of about ten numbers inherited from Time Warner Cable and Bright House, so a filter on AS20115 alone throws away most of Spectrum. And registrations lag reality: Kabel Deutschland’s AS31334 and EE’s AS12576 were both registered but not announced in October 2026, and their customers appear under Vodafone’s AS3209 and BT’s AS2856. The US, UK and Germany pages have the longer lists.

Check 2: hosting networks that should not be there

If a residential, ISP or mobile exit resolves to one of these networks, it is a server, whatever the plan is called:

The geolocation column is the giveaway. A table that shows thousands of “residential” IPs in Falkenstein, a small Saxon town, is showing a hosting cluster. The same goes for counts in neat multiples of 256, which is the size of one /24 block.

Check 3: is a mobile IP really mobile?

A mobile exit should resolve to a carrier: in the US T-Mobile (AS21928), Verizon Wireless (AS6167) or AT&T; in the UK O2 (AS35228), Three (AS206067), Vodafone or EE under BT; in Germany Telekom, Vodafone, o2 or 1&1. Germany is the hard case, because its big three carry mobile and fixed lines on the same ASNs, so the number alone cannot separate a phone from a home router.

Two more signals help. Carriers share public IPv4 addresses between many subscribers through carrier-grade NAT, and Cloudflare found in October 2025 that one such address can front hundreds or thousands of users. Many carriers also run mostly on IPv6: T-Mobile and Verizon Wireless are about 94% IPv6-capable in APNIC’s data, while O2 in the UK is about 1%. A paid geolocation database with a connection-type field is the third signal, keeping in mind Proxyway’s finding that these labels vary between databases and providers.

Do not expect a mobile IP to be untouchable. The same Cloudflare study found shared carrier addresses were rate-limited about three times as often as other IPs, because a lot of traffic arrives from one address.

Check 4: location, and why databases disagree

Geolocation databases are built from registry data, routing, user reports and measurements, and they disagree at city level more often than people expect. Shifter, which publishes a test harness for residential proxies, notes that city “misses” mostly come from databases disagreeing rather than from traffic leaving from the wrong place. Run the same IP through two services before you call an exit wrong.

Remember whose opinion counts. A target site uses its own database; Google says it estimates location from the IP “roughly based on geography”, over an area of at least 3 km² shared by at least 1,000 users. Databases also mostly return English names, so code that expects Köln, München or Nordrhein-Westfalen should match Cologne, Munich and North Rhine-Westphalia.

Check 5: does a sticky session hold?

A sticky login keeps one exit for the time you set. With ChronoProxy that is -sid-<key>-ttl-<minutes>, from 1 to 60 minutes. Test it the way you will use it: same key, a request every few minutes, and a log of the IP each time.

for i in 1 2 3 4 5 6; do
  curl -s -x gate.chronoproxy.com:7000 \
    -U "cp_a1b2c3-cc-gb-sid-hold01-ttl-30:PASS" https://api.ipify.org; echo
  sleep 300
done
# the same IP six times over 25 minutes means the session held

A residential exit is somebody’s home connection, so now and then one drops before the timer runs out. Count how often that happens over a few dozen sessions; that rate, not a single drop, is what to compare between providers.

Sample the pool, not one IP

Shifter recommends 50 to 100 or more samples before drawing conclusions, which matches our experience: the first ten exits from any pool say little. This loop opens 50 sessions in one country and counts the networks behind them:

import collections, requests, uuid

GATE, LOGIN, PASS, CC = "gate.chronoproxy.com:7000", "cp_a1b2c3", "PASS", "de"
nets, cities = collections.Counter(), collections.Counter()
for _ in range(50):
    sid = uuid.uuid4().hex[:8]
    proxy = f"http://{LOGIN}-cc-{CC}-sid-{sid}-ttl-1:{PASS}@{GATE}"
    try:
        geo = requests.get("https://ipinfo.io/json", proxies={"http": proxy, "https": proxy}, timeout=15).json()
    except requests.RequestException:
        continue
    nets[geo.get("org", "?")] += 1
    cities[geo.get("city", "?")] += 1

for org, n in nets.most_common(10):
    print(f"{n:3}  {org}")
print(cities.most_common(10))

Fifty lookups cost well under a megabyte of traffic. What you want to see is many different consumer networks in proportions that look like the country, few or no hosting ASNs, and cities spread roughly where people live. The IP checker and proxy tester do the single-IP version in a browser.

Where residential IPs come from

The last question cannot be answered with curl: how did the provider get household IPs in the first place? On 2 July 2026 the FBI and IRS Criminal Investigation, with Google, Lumen, Shadowserver and others, seized hundreds of domains associated with NetNut, a residential proxy service. Security firms had reported two weeks earlier that NetNut’s software populated the Popa botnet of at least two million compromised devices, including smart TVs and streaming boxes, some of which shipped with proxy software preinstalled. KrebsOnSecurity reported no charges or arrests at the time, and the parent company said it was cooperating with investigators.

A pool can pass every technical check above and still come from devices whose owners never agreed. Ask any provider how its residential and mobile IPs are sourced and what the people behind them consented to. It is a fair question to put to us as well.

The five-minute checklist

Published Oct 18, 2026. We update this guide when the platforms change; dated facts above are as of publication.