TL;DRIP databases classify an address by combining its ASN type, WHOIS/RDAP registration, rDNS pattern, BGP announcement and — increasingly — passive traffic observation. No field is decisive alone. Vendors weight these differently and update on different cycles, which is why the same address is often labelled residential by one database and hosting by another.
What signals go into the classification
An IP database does not read a label off the address. It infers one from several independent signals, each of which can be misread on its own.
| Signal | What it shows | How it gets misread |
|---|---|---|
| ASN type | Whether the block belongs to an access ISP or a hosting/cloud network | A provider announcing its own block sits in a non-ISP ASN even when sold as residential |
| WHOIS / RDAP | Registration and whether the block was reassigned (SWIP) to a company | Registration lags real use for months; absence of a SWIP is a signal, not proof |
| rDNS / PTR | The naming pattern the ISP uses for that line | Consumer pools, static/business ranges and infrastructure (cgnat, lsn) each have distinct patterns |
| BGP announcement | Who routes the block and what its neighbours are | The routing path is hard to fake — the neighbours in a block often reveal what it really is |
| Passive observation | Whether the address behaves like a proxy egress or a real subscriber | This is how modern vendors catch residential proxies that pass every static signal |
The vendors don't work the same way
Their methods diverge, which is the direct cause of the disagreements people see. The differences are documented.
- ipinfo states its classification relies on IP behaviour detection plus a machine-learning classifier over network attributes and traffic patterns — and describes competitors as leaning mainly on WHOIS plus a little scanning. Its residential-proxy dataset is built by observing proxy network activity over time, separately from ordinary network signals.
- MaxMind derives user type from registration information plus traffic and usage patterns, and flags a residential proxy only when an address shows both anonymised-network behaviour and residential ISP allocation — two signals stacked.
- IPQualityScore blends reputation and abuse history, network context, anonymity detection and behavioural signals, drawing on a honeypot network across 150+ countries and billions of events.
- Spur identifies residential proxies through client-clustering — where users are actually observed, not where the IP is registered — plus geographic mismatch, device diversity and behavioural correlation.
Usage type vs company type — two different rows
The single most common misreading is treating these as one field. Usage type describes how the address is used; company type describes what kind of entity holds the block. They answer different questions and can legitimately disagree.
- MaxMind splits user_type (about 15 values — Residential, Business, Cellular, Hosting, College and so on) from connection_type (only four — Cable/DSL, Cellular, Corporate, Satellite), in two separate fields.
- ipinfo separates the company's nature (Business/ISP/Hosting/Government/Education), the ASN's network role, and the privacy/proxy detection into three distinct datasets.
- IP2Location carries one usage_type field with about 13 codes (COM, ISP, MOB, DCH for datacenter, and others).
An address can legitimately show consumer usage under a business-account holder. Comparing the two rows across databases resolves more confusion than staring at any single cell.
Why the same IP gets different labels
Because the databases pull from different sources and refresh on different schedules. WHOIS-led vendors trail behavioural ones; some categories are barely maintained (MaxMind marks its Router and Cafe types as assigned very rarely and not actively maintained); and registration can be months out of date while behaviour changes daily.
IP2Location states outright that usage-type definitions differ between databases and should not be used as a sole basis for a decision. That is the vendor telling you the same thing this guide does: read the labels as votes, not verdicts.
How to read a classification correctly
- Start with the ASN and its neighbours. Routing is the least-interpreted signal, and the company on the block tells you more than any label.
- Read usage type and company type as separate answers, then compare both across databases.
- Treat a lone dissenter among consistent peers as the outlier. The real warning sign is consistent agreement on hosting when the seller told you otherwise.
- Remember that a clean static-signal profile does not rule out a proxy — modern vendors catch those by observation, not by the fields above.
Frequently Asked Questions
How does an IP database know if an address is residential?
It combines the ASN type, WHOIS/RDAP registration, the rDNS pattern, the BGP announcement and passive traffic observation. No single field decides it; a residential label means most of these signals point at consumer access rather than a hosting network.
Why does ipinfo say residential and MaxMind says hosting for the same IP?
Because they use different methods and update on different cycles. ipinfo leans on behavioural and traffic modelling; WHOIS-led data can lag for months. Divergence is expected — weight the ASN and registration facts above either label.
What's the difference between usage type and company type?
Usage type describes how the address is used (residential, hosting, mobile); company type describes the entity that holds the block (ISP, hosting, business). They are separate fields and can legitimately disagree — an address can show consumer usage under a business account.
Can a residential IP still be detected as a proxy?
Yes. Static signals like ASN and rDNS can all look residential while the address is used as a proxy egress. Modern databases catch this by observing behaviour over time — where users appear, device diversity, geographic mismatch — not from the registration fields.
Updated 2026-08-25 · Back to Guides · View plans →