How the checker works

The verdict in one paragraph

An IP is judged residential when independent signals agree that it belongs to a consumer ISP: the ASN's classification, the network category, and the operator type. Datacenter, proxy, Tor, and special-use evidence override that — in strict precedence order — so a hosting IP can never be reported as residential.

Verdict precedence

Signals are evaluated strictest-first. The first family with evidence wins:

1. Special-use / non-routable — private, reserved, or bogon space. The residential question doesn't apply.
2. Tor exit — publicly listed anonymizing-network nodes.
3. Proxy on a residential network — proxy evidence over real ISP space: what commercial residential-proxy traffic looks like.
4. Known proxy / VPN — explicit proxy evidence on non-residential space.
5. Datacenter / hosting — cloud provider ranges, hosting ASNs, datacenter classification.
6. Mobile carrier — carrier-grade NAT space shared by real devices; the strongest residential-family signal.
7. Residential ISP — consumer ISP classification with agreeing network category and operator type.
8. Business / enterprise — organization networks; a middle tier for most anti-fraud systems.
9. Unknown — insufficient evidence, reported honestly.

Data sources

• IP2Location databases — geolocation and usage-type classification.
• RIR registries (ARIN, RIPE, APNIC, LACNIC, AFRINIC) — who the address block is actually allocated to.
• Provider-published ranges — official cloud and crawler ranges (AWS, Google, Azure, and others) matched exactly.
• Proxy & Tor evidence — proxy databases and the public Tor exit list.
• Live threat feeds — FireHOL, Spamhaus, ThreatFox and others, refreshed continuously, powering the 0–100 risk score.

Confidence tiers, honestly

Confidence is computed from agreement: high means three or more independent signals point the same way; medium means the sources agree but coverage is partial; low means classification data is missing and only network-level evidence remains. A low-confidence verdict is a statement about data coverage — not a hedge.

Commercial proxy databases have gaps, and some registries publish less than others. When that happens the verdict degrades transparently rather than pretending certainty.

What this checker is not

It does not "score" you into a purchase, does not store the IPs you check, and does not claim to detect every proxy on earth. It shows the same evidence a serious anti-fraud system starts from — so you can see your traffic the way the other side sees it.

What we say — and what we never say

Every verdict on this site follows fixed wording rules:

• Verdicts describe the address, never the person. We say "this IP carries proxy evidence" — never "you are a bot".
• Risk and abuse flags come with a shared-IP disclaimer: an address's history is usually created by many users over time (proxy pools, CGNAT, reassignment), often not the current one.
• Sub-checks without data are reported as Unknown, never as safe. A missing signal is missing, not a pass.
• The usability score is framed as how likely the address is to be blocked — a property of the IP, not a judgment of its user.
• Client-supplied forwarded headers are shown as-is and never treated as the real exit IP.

The API behind this checker

Every verdict on this site is one call to the IPBot API — you can make the same call from your own stack in seconds:

curl https://api.ipbot.com/v1/ip/73.158.0.1

The response carries everything this site shows: classification, network facts, per-scenario decisions, evidence signals, and the usability score. The free tier needs no API key and is CORS-enabled.