Your IP Address Does Not Have a Day Job

We recently received a ticket from a remarkably persistent customer who wanted to know what “types” of IP addresses we use. At first, this sounded easy. IPv4 or IPv6? Public or private? Unicast, multicast, or anycast?

No. He meant residential, datacenter, corporate, VPN, proxy, and several other labels found in IP intelligence databases.

In other words, he was not asking about a technical property configured by the network operator. He wanted to know which labels third-party IP databases assign to our addresses. That distinction matters because different databases can classify the same address differently, and their answers can change over time.

An IP address does not contain a small employment record saying that it works in a datacenter from nine to five and operates a VPN on weekends. These labels are classifications created by commercial data providers. They can be useful, but they are not standardized properties of an address, they are not assigned by an internet registry, and a hosting provider cannot flip an official residential=true bit because no such bit exists.

What an IP address actually is

At the protocol level, an IP address identifies an interface or set of interfaces for delivering packets. Its structure and special uses are defined by standards. Registries and network operators then manage address blocks, registration records, routing, and assignments.

Some distinctions are real protocol or operational concepts. IPv4 and IPv6 are different protocols. Public and private address space behave differently. Unicast, multicast, and anycast describe delivery models. Loopback, link-local, documentation, and other special-purpose ranges have defined uses. IANA maintains the official IPv4 Special-Purpose Address Space registry for precisely this reason.

“Residential” is not in the packet header. Neither are “corporate,” “hosting,” “VPN,” or “probably a person trying to buy twelve limited-edition trainers.” Those are conclusions drawn about who appears to use an address and how.

Who invents residential, datacenter, and corporate types?

Companies selling GeoIP, fraud prevention, advertising, security, and IP intelligence data build their own taxonomies. One database may call a network hosting; another may call it business; a third may expose several independent flags such as hosting, vpn, and proxy.

There is no universal dictionary. MaxMind, for example, documents user types including residential, business, cellular, and hosting. IPinfo exposes hosting and anonymization signals and can separately identify VPNs, proxies, Tor exits, relays, and residential proxies. The overlap is obvious, but the models are not identical. Even classification vendors describe these values as signals that need context, not divine revelation delivered over BGP.

Typical commercial labels mean approximately the following:

• Residential usually means the classifier believes an ISP provides the address to household customers.
• Mobile or cellular usually means the address appears to serve customers of a mobile network.
• Datacenter or hosting usually means the prefix belongs to, is routed by, or is strongly associated with cloud or hosting infrastructure.
• Corporate or business usually means the address appears to be used by an organization rather than a mass-market access service.
• VPN means the classifier has evidence that traffic exits a VPN through the address.
• Proxy means it has evidence of proxy activity. Some products further distinguish public, residential, rotating, or other proxy models.
• Tor generally means the address is observed in the published or independently collected Tor exit ecosystem.

Notice how often “usually,” “believes,” and “appears” occur. That is not evasive writing. It is the entire mechanism.

A label describes observed use, not the nature of the address

Suppose an operator assigns an address to a mobile internet gateway today. Next month, the network is reorganized and the same address is attached to a web server. Later, it is delegated to a corporate customer, who installs Microsoft Exchange because apparently email administration was not already exciting enough.

The number has not undergone a transformation. It remains the same IP address. Its user, route, reverse DNS, traffic patterns, registration data, and operational purpose may have changed.

This is why multiple labels can also be true at once. A VPN exit may run on a VPS in a datacenter, so vpn and hosting are both reasonable signals. A company can run a VPN from an office connection. A residential proxy can exit through an ordinary consumer line. Carrier-grade NAT can place many mobile subscribers behind one public address, while a fixed wireless service may look residential to one vendor and cellular to another.

Forcing all of this into one permanent “type” is convenient for an API response and inconvenient for reality.

How classification companies make an educated guess

Vendors combine many possible sources: Regional Internet Registry records, BGP routing data, autonomous system information, reverse DNS, network names, hosted-domain counts, active measurements, customer feedback, public VPN and Tor data, traffic observations, and patterns seen across nearby addresses.

The exact recipe is proprietary because the resulting database is the product. Better coverage, faster updates, and fewer false positives are what customers pay for. This is essentially GeoIP with extra dimensions: instead of estimating only where an address is used, the service also estimates what kind of network or activity sits behind it.

The process can produce valuable risk signals. A streaming platform may use them for licensing controls, a bank for fraud analysis, an advertiser for audience measurement, and a security team for investigating suspicious logins. Problems begin when a probabilistic label is treated as an official certificate of identity.

There is no central authority that audits every residential result. The RIR does not receive a form saying, “Congratulations, this /24 is now emotionally ready for corporate life.” The network operator does not announce an address type through BGP. Registration and routing show administrative and technical relationships, not the complete purpose of every machine using every address.

Can IP classification databases be wrong?

Absolutely. More importantly, they can be correct yesterday and stale today.

Address space changes hands, customers leave, infrastructure moves, routes change, and new services appear. Detection also involves inference. IPinfo’s own privacy data, for example, includes confidence and last-seen information and distinguishes direct observations from classifications inferred from neighbouring addresses. That is a sensible admission that a network is not a row of identical houses merely because its addresses are consecutive.

Errors can happen in both directions. A new VPN server may not yet be detected. An address previously used by a VPN provider may retain the label after reassignment. A whole prefix may be marked as hosting because much of it hosts servers, even though one part now serves an office. Two reputable databases may disagree because they use different evidence, category definitions, update schedules, and confidence thresholds.

Consider a datacenter network containing roughly 1,000 addresses. At first, datacenter or hosting seems like the obvious classification. Then customers deploy 100 servers carrying websites and remote desktop environments, while 15 other servers run active VPN endpoints. A data vendor that detects those services and classifies at prefix level may decide that the entire network is associated with VPNs or proxies. The label now sounds impressively specific, but it says very little about the hundreds of addresses on which no VPN or proxy has ever run. Extended classification data can be useful as a clue; treating every inferred label as a precise fact is much less useful.

When a website blocks an address as a VPN or proxy, the provider of that address normally cannot remove the label directly from the website. The practical path is to identify which intelligence database the website uses and submit a correction there. Sometimes the website will not reveal its source, which turns troubleshooting into a small detective story in which every suspect sells an API subscription.

Country is not citizenship for an IP address

The geographical version of the same misunderstanding is the idea that an address is “issued in a country.” Internet number resources are coordinated globally. IANA delegates large blocks to the five Regional Internet Registries, and RIRs allocate or assign resources to organizations under their respective policies. The RIR service region is not a nationality permanently fused into each address.

Registration records may contain a country attribute, but that is not a GPS receiver. RIPE NCC explicitly warns that the country value in an inetnum object should not be expected to be 100 percent accurate. Depending on the record and registry practice, it can describe an administrative relationship or the organization associated with the resource rather than the physical location of a particular user.

Network operators can also publish a geofeed mapping their prefixes to intended locations. RFC 8805 defines a simple CSV format containing a prefix and optional country, region, city, and postal-code fields. It also says consumers may treat the data as a hint and prefer other sources. Publishing “this prefix is used in Sofia” is therefore possible; remotely engraving Sofia into every router on Earth is not.

An operator can update a geofeed when address deployment changes, and modern mechanisms let registration data point consumers toward it. Databases still need to retrieve, verify, and accept the update. Cached results and independent evidence mean different services can show different countries for some time.

This is normal. A globally routable number can be registered to an organization in one country, announced by a network connected across several countries, and used by a customer somewhere else. Packets care about routes, not passports.

And then there was the mysterious “broadcast” type

The most entertaining part of our conversation arrived when we were asked about “broadcast” addresses. We initially assumed the usual networking meaning.

IPv4 really does have broadcast addresses. 255.255.255.255 is the limited broadcast address, and a subnet can have a directed broadcast address whose host bits are all ones. Broadcast traffic is intended for all nodes on a local network; routers block forwarding directed broadcasts by default under RFC 2644, largely because history demonstrated that packet amplification and strangers on the internet are a poor combination. IPv6 does not use broadcast and relies on multicast instead.

But that was not what the customer meant. In this particular piece of internet folklore, “broadcast IP” supposedly meant an address not issued in a country but nevertheless used there.

That category does not exist. It confuses allocation, registration, routing, deployment, and geolocation, then gives the mixture the name of a completely unrelated networking concept. An address used outside the location expected by a database is simply an address whose operational geography and recorded or inferred geography differ. It is not broadcast, imported, roaming, diplomatic, or wearing a false moustache.

What providers can honestly promise

A provider can tell you whether it offers IPv4 or IPv6, whether an address is dedicated or shared, which service and location it is assigned to, and what routing or reverse-DNS options are available. It can maintain accurate registration records and publish a geofeed.

It cannot guarantee that every third-party service will classify an address as residential, corporate, clean, trustworthy, or unusually handsome. Nor can it guarantee that a classification will never change. The party operating the database controls its labels, and the party operating a website decides how to use them.

The useful conclusion

Residential, datacenter, corporate, mobile, VPN, and proxy labels can be useful descriptions of current or recently observed use. They are not intrinsic types of IP addresses, official promises from a provider, or immutable facts recorded by the internet’s routing machinery.

Our responsibility as a network provider is to route IP addresses correctly and keep them reachable through the infrastructure we operate. We also publish accurate geolocation information for every ITLDC location. Those are facts about our network that we can verify and maintain.

How an external website uses third-party IP data is its own decision, just like its choice of CAPTCHA. If it identifies an Austrian IP address as Australian or blocks an address because of a particular classification, questions about that result belong to the website and its data supplier.

Treat extended IP classifications as what they are: commercial intelligence produced from incomplete and changing evidence. Expect occasional errors, and remember that another vendor may reach a different conclusion without breaking any standard.

An IP address can host a website today, terminate a VPN tomorrow, and serve an office next month. It does not need to notify the passport office. It only needs a valid route.