Types of Proxies: Residential, ISP, Datacenter, and Mobile

There are four main types of proxies, classified by where their IP addresses come from: datacenter proxies use hosting networks, ISP proxies use ISP-registered addresses on servers, residential proxies route traffic through home internet connections, and mobile proxies use cellular networks.

When a request passes through a proxy, a website sees the proxy's exit IP rather than the user's original address. Looking up that IP can reveal its network, registered organization, connection type, and whether it has been associated with proxy services. These signals help distinguish the four types, but they don't all tell you the same thing.

TL;DR

Proxy types look different in an IP lookup. A datacenter proxy sits on a network typed as hosting. An ISP proxy carries ISP-registered ownership while running on servers. A residential proxy exits from a consumer broadband network, often from someone's home. A mobile proxy exits from a carrier address that many subscribers can share at once.

• Datacenter: a hosting or cloud address is not a proxy on its own, so treat hosting as context (expected on APIs, worth light friction at consumer signups) and act harder only on the proxy and threat fields.
• ISP: a dedicated static address builds a history worth checking, but static doesn't prove dedicated, so weigh that history with its recency and the session's behavior.
• Residential: the flag ties the address to a residential proxy network, not the current request to a proxy. Instead of blocking, step up high-value actions.
• Mobile: a Mobile connection type alone is not a proxy signal, and blocking a carrier's IPv4 address can block everyone behind its carrier-grade NAT, so score the session instead.

Residential vs ISP vs Datacenter vs Mobile Proxies Compared

The four groups are a practical way to sort proxies by the exit's network, not a strict taxonomy: datacenter and ISP proxies both run on servers, residential and mobile proxies both borrow consumer connections, and sellers use the names loosely. The table puts them side by side by where the exit address lives and what a lookup usually shows. "ASN type" is the category of the network that routes the address; Check what an ASN is.

Each row is the typical case. The type describes the address, while the flags record which proxy networks have been associated with it. Datacenter and ISP proxies often keep their addresses for long periods, so an address's own history can mean something if it isn't shared; residential and mobile proxies borrow addresses real people also use, so acting on any single address is risky.

Other Ways Proxies Are Classified

Proxies can also be sorted by how they behave, which is why lists of types of proxy servers often run to a dozen entries. Each of these lines can apply to any of the four types:

• Traffic direction: a forward proxy acts for clients reaching out to the internet, which is what all four types in this guide are. A reverse proxy sits in front of servers, the way a CDN or load balancer does.
• Anonymity level: by convention, a transparent proxy passes the client's address along in a header such as X-Forwarded-For, an anonymous proxy hides the client's address but still identifies itself as a proxy (often with a Via header), and an elite proxy sends neither. The labels describe headers only; implementations vary, and none of the labels promises the proxy can't be detected. Reading the real client IP behind a proxy covers those headers from the server side.
• Protocol: HTTP and HTTPS proxies handle web traffic; SOCKS5 proxies forward general TCP and UDP connections.
• Rotation: a static proxy keeps one exit address, a rotating proxy changes it per request, and a sticky session holds one address for a set time before rotating.
• Interface: CGI and web proxies run as a web page that fetches sites for you.

Whatever its headers, a proxy's exit address can still be looked up, which is why the rest of this guide sorts proxies by where that address lives.

How to Read an IP Lookup for Proxy Type

An IP lookup answers four separate questions about an address, and telling proxy types apart means keeping them separate. The field names are IPGeolocation.io's; other providers carry similar data under their own names.

The rows can disagree, and reading the disagreement is the skill. A hosting address with no proxy flag is usually ordinary infrastructure, though a new proxy range can go unflagged until someone observes it. Because the rows answer different questions, a mid-range threat score can sit on a flagged proxy exit, and a proxy flag says nothing about the visitor's intent.

To run the lookup yourself, request location and security data in one call:

# Security, company, and network fields need a paid-plan API key.
curl --fail -s "https://api.ipgeolocation.io/v3/ipgeo?apiKey=${IPGEO_API_KEY}&ip=165.227.0.10&include=security" \
  || echo "Lookup failed: check the API key and that the plan includes security data" >&2

The response carries all four groups, and each type section reads them for one proxy type. The IP Geolocation API documentation defines every field, and the response shown in the next section is a dated snapshot, not a guaranteed current result.

Datacenter Proxies

A datacenter proxy is a proxy server running in a data center, using an IP address that belongs to a hosting or cloud provider rather than to a consumer internet service. Providers rent servers in bulk and sell their addresses, often from contiguous ranges, so whole blocks of datacenter proxies tend to sit side by side.

Here is what that request returned for 165.227.0.10, a server address in a block registered to DigitalOcean, on October 22, 2026 (trimmed; values can change as the address is used):

{
  "ip": "165.227.0.10",
  "location": { "city": "Santa Clara", "country_name": "United States" },
  "security": {
    "threat_score": 5,
    "is_proxy": false,
    "is_residential_proxy": false,
    "is_vpn": false,
    "is_cloud_provider": true,
    "cloud_provider_name": "DigitalOcean, LLC"
  },
  "asn": { "as_number": "AS14061", "organization": "DigitalOcean, LLC", "type": "HOSTING" },
  "company": { "name": "DigitalOcean, LLC", "type": "HOSTING" },
  "network": { "route": "165.227.0.0/20", "connection_type": "" }
}

Everything about where the address lives says hosting: the ASN type, the company type, and the cloud provider flag. Nothing about what it does says proxy: is_proxy is false and the threat score is 5. That split is where datacenter traffic gets misread. A cloud address carries API clients, monitoring tools, CI pipelines, corporate services, and search engine crawlers, and most of that traffic is ordinary.

So we'd treat the hosting fields as context and the proxy and threat fields as the evidence. On an API or a B2B login, hosting traffic is expected. On a consumer signup or a checkout, a hosting address is unusual on its own, since shoppers rarely browse from rented servers, and fresh datacenter ranges may not have been flagged yet. We'd add light friction there, and challenge outright when a proxy flag or attack history comes with it. For offline checks, the IP to Hosting Database maps address ranges to the hosting provider behind them.

ISP Proxies

An ISP proxy is a proxy server hosted in a data center that uses IP addresses registered to an internet service provider, so the address looks like a consumer ISP address while the traffic runs on servers. Sellers also call them static residential proxies, since each customer keeps one address for a long time.

The address gets that ISP-looking registration through ordinary registry mechanics. A regional internet registry issues a block to a holder, and the holder can delegate part of it. ARIN, the registry for North America, describes organizations that lease IPv4 blocks "independent of connectivity services" and asks them to record leased addresses as reassignments in its WHOIS database. A reassignment shows that part of a block is used by another party, typically a customer of the holder.

Routing is recorded separately from registration. The RIPE NCC's database documentation for Europe and the Middle East spells this out: a prefix holder can authorize any originating AS to announce it. Put together, one address can be registered to an ISP-type holder, reassigned to a customer, and announced from servers in someone else's network.

That's also why the company and the ASN organization on one IP can differ. The company field names the organization registered for the address, while the ASN fields describe the network announcing it; with leased space, those are different parties. Registry mechanics allow two shapes for an ISP proxy's record. If the ISP-type holder announces the block, routes it to a hosting customer, and records a reassignment, the ASN fields read ISP while the company names the hosting or business customer. If a hosting network announces leased space and no reassignment was recorded, the ASN fields read hosting while the company still names the ISP-type holder. Why one IP's company and ASN can differ walks through a full example, and how an ISP differs from an ASN covers the terms.

Are ISP proxies detectable? They can be, but not from the ISP name alone. The registration says ISP, but the rest of the record can point to a server: a business or hosting organization on the company or ASN side, a cloud provider flag, no fixed broadband or mobile connection type, and neighbors in the same range doing the same thing. None of those clues is proof on its own: a small business on leased ISP space can show the same mismatch without running any proxy. They gain weight next to an observed proxy flag with provider names, a recent last-seen date, or what the session is doing. When you need to see the network side yourself, the IPGeolocation.io ASN API returns an ASN's announced routes and its WHOIS record, which describe the network rather than each address's reassignment.

An ISP proxy usually keeps its address for a long time, so the address's own history is worth more here than on a residential exit. That holds when the address is dedicated to one customer, and static doesn't prove dedicated: sellers also offer shared ISP proxies, and leased blocks change hands. If an address opens accounts or retries logins at a rate no household would, and that record is recent, acting on the address carries less collateral risk than it would on a shared one.

Residential Proxies

A residential proxy routes traffic through a device on someone's home internet connection, so the website sees an IP address that an ISP assigned to a household. The FBI's March 2026 alert defines it as an intermediary that makes connections "appear to originate elsewhere", using addresses assigned to consumers' devices.

How those devices join a proxy network matters to anyone receiving the traffic. The same FBI alert lists software development kit (SDK) partnerships that pay app developers per download, free VPNs with hidden terms of service, compromised or pre-infected internet-connected devices, malware in pirated content, and apps that pay people for their bandwidth. Google's threat intelligence team, after disrupting one large network in January 2026, wrote that its SDKs surreptitiously enroll user devices and that proxy providers' claims of ethical sourcing are "often incorrect or overstated", while granting that some providers may enroll devices only with clear consent. In one seven-day period that month, it observed over 550 threat groups using that network's exit addresses.

Earlier academic work found the same pattern. A 2019 study presented at the IEEE Symposium on Security and Privacy collected 6.18 million unique residential proxy IPs from five services in four months. Of the 547,497 IPs whose device type it could identify, 237,029 belonged to internet-connected gadgets such as web cameras, DVRs, and printers.

So a residential proxy exit is also someone's home: the household's own browsing, streaming, and logins come from the same address as the proxied sessions.

We looked up three exits listed in the sample rows of the IPGeolocation.io Residential Proxy Database page on October 22, 2026. All three sat on a national telecom's fixed broadband network in Thailand, and all three returned the same shape: asn.type and company.type of ISP, a connection_type of Fixed Broadband, is_residential_proxy true, one named proxy provider each in proxy_provider_names, a proxy_confidence_score between 90 and 99, a proxy_last_seen date within the previous three weeks, and a threat score of 45: a mid-range score on a flagged proxy exit. We don't publish the addresses, since each one is a household's connection, and three exits from one network on one day illustrate the fields rather than measure how residential proxies look everywhere. The security fields in the docs define every one of those values.

Location alone can't catch this traffic. The FBI describes criminals buying a residential exit in the same city as a victim whose bank credentials leaked, so the login looks local. The city matches; the security data is what ties the address to a residential proxy network, and the confidence and last-seen fields show how certain and how recent that observation is.

Treat a residential proxy hit as evidence about recent activity on a shared address, never a verdict on the person in front of you. On a checkout, a payout, or a new account, a recent hit with a high proxy_confidence_score is a good reason to step up verification. As a starting point to tune against your own outcomes, we'd read 90 or more as high and a proxy_last_seen within the past 30 days as recent. For a returning customer logging in from a known device, we'd let it through and log the hit, because proxied traffic may come from another device on the same connection. For how the detection itself works, see how residential proxy detection works.

Mobile Proxies

A mobile proxy routes traffic through a phone or SIM-equipped device on a cellular network, so the website sees an IP address from a mobile carrier. Sellers commonly build them from phones or cellular modems and rotate the exit by reconnecting to the carrier for a new address. What sets them apart is the way carriers hand out IPv4 addresses.

Many mobile networks assign subscribers private IPv4 addresses and translate them into a shared public IPv4 address inside the provider's network. The IETF's requirements for carrier-grade NAT define it as a NAT used to share the same IPv4 address among several subscribers, placed in the ISP's network rather than in the customer's home. One public mobile address can therefore carry many people at once, and a mobile proxy's exit shares that address with everyone else behind the same NAT.

IPv6 changes the picture where a carrier has deployed it. Networks built on 3GPP standards, the family behind 4G and 5G, assign a /64 prefix to each connection, which the IETF describes as completely dedicated to the device and shared only with anything tethered to it. A new connection can bring a new prefix, so scoring or rate-limiting by the /64 works for a session where blocking one IPv4 address can't, but it isn't a lasting identity for the device.

On IPv4, sharing is what makes blocking dangerous. The IETF's analysis of address sharing says IP blocking for abuse will cause collateral damage, and that one user's failed logins can lock out others sharing the address, so penalty-box defenses "simply will not work".

The ASN type doesn't separate mobile from fixed broadband. A mobile carrier's ASN can be typed ISP, the same as a broadband provider's: T-Mobile USA's AS21928 returns type ISP in IPGeolocation.io data. The field that names the access type is network.connection_type.

We looked up three T-Mobile USA addresses on October 22, 2026, one each from three address ranges that AS21928 announces, and all three returned connection_type Mobile. Two of them carried is_residential_proxy true with several proxy providers named, and the third had no proxy flags and a threat score of 0. In these lookups, mobile proxy exits carried the same is_residential_proxy flag as home broadband exits, which matches the Residential Proxy Database's description of mobile proxies as residential proxies on cellular networks; connection_type is what tells them apart. A Mobile connection type on its own says nothing about proxies, as the unflagged third address shows, and three lookups illustrate the fields rather than measure how often carrier addresses are flagged.

For mobile traffic, score the session rather than the address, rate-limit per account or device, and save hard friction for high-risk actions.

How to Handle Each Proxy Type on Your Site

The right response depends on what the visitor is doing and how costly a false positive would be. A proxy flag on a public page may need no action, while the same signal during a suspicious payout may justify additional verification.

Combine IP data with account history and device signals where possible. The following table provides starting points, not universal blocking rules.

In every row, the proxy type informs the decision, while the action at stake, the strength of the evidence, and the cost of a mistake settle it.

Some anonymized traffic isn't a proxy for hire at all. Privacy relays such as iCloud Private Relay and Cloudflare WARP and corporate security gateways carry ordinary users, and the is_relay and is_corporate_gateway flags keep them apart from proxy and VPN exits.

Some limits come with the data, whoever supplies it. Residential and mobile exits come and go as devices join and leave networks, shared addresses mix proxied and ordinary traffic, and a new range has no history until someone observes it. IPGeolocation.io answers those limits with fields rather than a single yes or no: proxy_confidence_score and vpn_confidence_score for how certain a detection is, proxy_last_seen for how recent it is, and provider names for who was seen using the address.

Checking Proxy Types With IPGeolocation.io

IPGeolocation.io puts every layer this guide reads into one response: geolocation, security data (VPN, proxy, residential proxy, relay, and Tor detection, with confidence scores and last-seen dates on proxy and VPN hits, plus a threat score), ASN, company, and network data. The same lookup can add abuse contact, time zone, and user agent data, so the proxy signals arrive next to the context that explains them.

We collect the security data behind the detection ourselves. We continuously connect through VPN and proxy provider networks, record tagged exit addresses, and use active honeypots and curated threat feeds to capture addresses tied to brute force, credential stuffing, scanning, and spam. The section on detecting hidden and risky IPs explains the method.

Where to start depends on volume. To check one address or one live request, call the IP Security API on its own or with the rest of the lookup. To screen logs or a whole user base, use the bulk endpoints, or run the IP Security Database and the Residential Proxy Database (ranges with the provider and last-seen date, in CSV and MMDB) locally. For live sessions, real-time proxy and VPN detection tests the visitor's connection in the browser. Security data is included in paid plans; pricing lists what each plan includes. A good first test: run last week's flagged signups through the API and sort them by asn.type, company.type, connection_type, is_proxy, and is_residential_proxy. That shows how your own traffic splits across the four types, with possible ISP proxies standing out as an ISP-versus-hosting mismatch between asn.type and company.type.