Some IP or VPS providers managed to pick high-quality IPs. When you just started using it, it's labelled as green "Home Broadband IP" type.

After several weeks, it's eventually labelled as Internet Data Centre (IDC) IP and even Hosting, Proxy and VPN types.

No Worry! Kensear Laboratory will guide you explore more about it.

Video

Watch the YouTube video🎬 below for full experiments and solutions:

 Watch on YouTube

Background

I have tested WiFis🛜 at 23 different places around Hong Kong during my last experiment (article and video).

You can notice that nearly half of the IPs were labelled as the red Internet Data Centre (IDC) IP type. Some other IPs were labelled as Hosting or even VPN or Proxy by other databases.

IP Type Classification by Ping0 (Histogram)

Nearly everyone doesn't want their IPs to be labelled as Data Centre. Some users may keep changing the IP addresses of VPS servers with support tickets.

If this problem continues, it will become worse making many IP ranges labelled.

Clue

If you don't want your IPs being labelled as Data Centre or VPN, you need to know HOW do IP databases identify servers first.

Regardless of the databases (e.g., Ping0, IPinfo, ipdata), they all can identify what IPs belong to servers or data centre.

Try to explore it with this clue.

IP Type Identification by IP Databases

Ports of Computer IPs

Now, using this clue, you can guess what characteristics do servers and data centres typically have.

If you learned Linux OS, yYou might know that you can access to and manage a server with Port 22 and SSH Protocol.

Apart from Port 22, Port 80 is for HTTP and Port 443 is for HTTPS, and so on.

There are 65,535 ports under each computer and IP. Ports are necessary when you access to a server.

At this point, you might realise that IP database mainly checks whether an IP belongs to a server by port scanning.

Especially IPinfo, labelling as “SSH” after successful scans of Port 22, labelling as “Webserver” after successful scans of Port 80 or 443 (including error pages like 404), and so on.

Common Ports of Computer IPs

Experiments

Experiment 1: Port Scanning Attempts

I took out a Residential IP VPS server not being used often in the first experiment.

Apart from my IP address, all other IP addresses were blocked by the firewall and any port scanning attempts were saved to a log file.

Around 120 port scanning attempts were received and logged within 5 minutes. 15 to 30 times per minute on average.

This proved that some IP databases have their mass scanners set up globally, scanning every single IP and port.

Every IP can be Scanned 15 to 30 Times Per Minute

Similarly, when you connect to a VPS server you have just bought via SSH, there can be many SSH login failed attempts despite the several-minute time gap.

It's because some malicious scanners have been trying the SSH passwords around the world by utilising this "time gap", especially the “root” account.

Experiment 2: Proxy Discovered

Now, move on to the second experiment.

I set up Socks5 Proxy Server directly on my first server as many Residential IP providers only provide Socks5 connections (can be connected from anywhere outside Mainland).

I will talk about the differences between Socks5 Proxy and VPS products here. While Socks5 Proxy is straightforward for beginners and non-tech users, VPS servers can have more features (e.g., web server) installed but technical skills are required.

The risk score of this IP was checked (near 0%) after being purchased.

Several days later, however, it was labelled as "Proxy" by IPQS with the risk score increased to 70% to 75%.

This proved that many IP databases identify servers, whether server, proxy, etc., with global mass port scanning.

While the port was specified like 1234 (not default port), the server was still labelled as Proxy. This also proved that any port can be scanned.

Socks5 Proxy Discovered and so Labelled as Proxy by IPQS

Experiment 3: All Ports Blocked

Now, move on to the third interesting experiment.

Since the second experiment has made my IP labelled as Proxy or even High Risk, all ports were blocked this time.

Another real Residential IP VPS I bought was directly VPN type on IPinfo.

Same as the first experiment, all ports were blocked, including ICMP Ping, except my IP address.

One to two weeks later, IPinfo no longer identified it as a VPN server. The VPN label eventually disappeared changing back to a standard broadband IP.

This proved that IP databases always continue its scanning regardless of whether it's labelled, so the labels can be removed if the problems no longer exist for a while.

VPN Label Disappeared After Port Blocking

Experiment 4: Large IP Range of a University

Then I used one of the B Ranges of our university as an example.

Simply speaking, B Range means the "/16" range. If an IP address has the same first 2 parts, it belongs to this B Range.

Similarly, A Range means the first part and C Range means the first 3 parts.

This B Range of our university is for wired network and servers. Some C Ranges are for Computer Barn, some are for official website and other internal servers, and some are for Residential Wired Network.

I predicted that Ping0 labels IP type based on each C Range, whether green “Home Broadband IP” or red “Data Centre IP”. We may check it with this experiment.

You can notice that all C Ranges for servers are labelled as red “Data Centre IP” while all C Ranges for wired network are labelled as green “Home Broadband IP”.

This is because the IT department of our university blocks all inbound connections with the firewall for all C Ranges for other than servers, same as the university WiFi, including all ports and ICMP Ping. While it can’t be accessed by any IP address outside, it can access to any IP.

For this reason, it’s labelled as “Home Broadband IP”.

Purposes of Different C Ranges under our University B Range

Solutions

These are the reasons why a Residential IP can be labelled as Data Centre or even VPN.

These experiments proved that IP databases mainly rely on port scanning to check whether every single IP belongs to a server.

Do you know how to let IP databases recognise my IPs as broadbands instead of server, VPN or proxy?

Now move on to some possible solutions.

Solution 1: Block All IPs (Inbound)

First, make sure you block all ports with a firewall not allowing ports to be discovered by the mass scanners running 24*7 worldwide.

Many home broadbands don't allow any connection from the outside so they are labelled as “Home Broadband IP”.

But if you block all ports, you will not be able to connect to it as well!

As you can notice, this solution has a conflict.

Block Inbound Connections from All IPs

Solution 2: Only Whitelist your IP

You noticed that you will no longer be able to connect after blocking all IPs. How about only allowing your IP?

You need to ensure it's a static IP✅, not a dynamic IP❌.

Generally speaking, the IP address can be changed at any time whether the broadband or university IPs outside Mainland I use or public proxy services for Mainland users.

Once it's changed, you will need to whitelist your latest IP again. Sounds annoying?

Also, if your dynamic IP eventually falls outside your whitelist, you will not be able to connect via SSH.

No Longer being Able to Connect After Dynamic IP Changes

Solution 3: Add Another Intermediate Server

So, if my IP is dynamic, how can I connect to the server in a long-term while not allowing mass scanners?

Yes, there is still a way to solve it, but you may need to spend a bit more.

You will need to have a static IP address, changing your dynamic IP to this static IP.

What you will need to do is just to buy another intermediate server with a static IP, like your Residential IP VPS.

New Structure with an Intermediate Server Added

It's better to use an intermediate IP labelled as Hosting and Data Centre, and closer to your Residential IP.

You don't need to care how risky it is. It's completely OK if it is 100% risky or labelled as something like VPN.

After setting up both servers, you will still need to set up your IP whitelist to not to let the mass scanners outside come into your Residential IP server.

Real Demo

These are the theoretical knowledge. Now, let's move into our demo!

Kensear Laboratory main uses Debian 12 or 11 OS, but the commands will be quite similar for other operating systems.

I have an intermediate server and a residential IP server.

Connect to the intermediate server first with your SSH credentials and combined command:

Server SSH Connection Information & Command

Then connect to your Residential IP server via your intermediate one, as you will only whitelist your intermediate server (the latter).

You will not be able to connect to it directly from your computer.

Only Intermediate IP Allowed, Other IPs Blocked

Commands Used in the Video Demo:

sudo -iapt updateapt upgradeapt purge ufw firewalld iptablesapt install iptables iptables-persistent netfilter-persistentiptables -A INPUT -i lo -j ACCEPTiptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPTiptables -A INPUT -s (Your Intermediate IP) -j ACCEPTiptables -A INPUT -j DROPnetfilter-persistent savereboot

After this setup, try to connect to your Residential IP directly from your computer with the following commands.

You will not be able to connect if you have set up correctly.

Then run the following commands again after connecting to your intermediate server. You will only be able to connect from it.

Well Done!

ping -c 4 (Your Residential IP)ssh root@(Your Residential IP) -p 22curl (Your Residential IP):(Proxy Port)

Still Labelled as Data Centre / Proxy?

Some users may find it strange that their IPs are still labelled as Data Centre or even Proxy after several weeks, even if they have confirmed that the firewall has been set up properly.

Why is this?

This is because the database checks for IP types based on C Range rather than each IP and there were many other IPs and servers detected under the same C Range.

Moreover, if you can't access streaming services, see "IP Banned", or your IP labelled as Mainland, it's not your fault! It's because some other IPs under the same C Range are used by some Mainland public proxy providers.

But anyway, while you can't control others, just improve yourself first.

Residential IP C Range Labelled as IDC

My Intermediate IP Disappeared, What can I Do?

I also have a backup plan. If all your intermediate servers cannot be used, what can I do?

No Worry! You can see the VNC function for most VPS providers.

Use the VNC function, log in to your account, turn off your proxy software.

VNC Function in some VPS Providers

Type “iptables -F” to release your firewall temporarily. All IPs will be able to connect again to reconfigure the firewall.

iptables -F

More Interesting Facts

Socks5 Proxy with Intermediate IP

I also noticed some relevant interesting facts.

You can't connect to the given Residential IP via Socks5 directly for some Socks5 Residential Proxy providers. You will be given another shared entry node IP like an intermediate server.

From my observation, the IPs by such providers have high trust scores on IPData and labelled as green “Broadband IP” on Ping0 which might be your favourite.

But for those letting you connect to your Residential IP directly, the trust score are nearly zero on IPData and might be labelled as red “Data Centre IP” on Ping0.

Some Socks5 IP Proxy Cannot be Connected Directly without Intermediate IP

Anti-scan IP Blocking Method

When you ban some IP addresses, don't give any response, whether Your IP is Banned, Invalid Password, 403 Forbidden, or even a blank webpage.

This is because it may also be recognised as a server or proxy.

So, what should you do? You must block the ports entirely (i.e., connection timeout).

Error Messages may Still Result in Webserver IP Label

Ping Blocked on some VPS Providers

Some VPS providers block ICMP Ping for all their IPs as they don't want their IPs labelled as “Data Centre” by Ping0.

For example. Some VPS provider websites show this message:
“应IP提供方要求，本产品部分IP段禁了ping，但禁ping不影响正常使用”

Ping Blocked on some VPS Providers

Summary

Many of my experiments proved that IP databases have many mass scanners working 24*7, scanning IP addresses worldwide and checking whether they are servers, proxies or VPN.

If you don't want your IPs labelled as “Data Centre”, you need to block all ports.

But because you will not be able to access it and your IP may change at any time, you will need another intermediate server with a static IP, whitelisting its IP address.

That's the end and see you next time! You can also explore more on my website & channel.

As mentioned on other channels and articles online, using proxies⛓️‍💥 with thousands of (or even more) other users increases the risk of account ban🚫, making Residential IPs an essential for Mainland users.

Due to the very large demand of Residential IPs and relevant VPS servers by Mainland users, they can be sold out very quickly🫙 and even majorly abused⚠️, increasing the risk score of such IP addresses.

But do you know how do the IP addresses of the HK broadband that we use every day look like?

To answer this question, I spent 3 days for the WiFi testing under 23 WiFi hotspots🛜 around Hong Kong.

My Test Script: https://github.com/Kensear/ip-check-hk-personal

Video

Watch the YouTube video🎬 below for full test progress:

 Watch on YouTube

About this Research/Experiment

What were Mainly Tested?

23 places with WiFi hotspots🛜 were random selected, including:

• Free WiFi in Coffee Shops☕️, Shopping Malls🏬, etc.
• WiFi in 4 HK Universities🏫

The following information were collected for each WiFi hotspot:

1. ISP Info, including AS (Autonomous Systems) Number (e.g., AS3363, AS4760)
2. Whether Accessible to (or Banned by) Streaming Services (e.g., Netflix)
3. IP Quality and Risk Score
4. DNS Servers Used (whether ISP or Public DNS (like >8.8.4.4
5. Routing and Latency to Major 3 ISPs (Telecom, Mobile and Unicom) in Mainland

WiFi Testing for HK Universities

As a HK university student🧑‍🎓, it's my great opportunity to test the "eduroam" WiFi of each university.

It's worth to know that it takes 5 to 12 seconds⏳ to load content (like WeChat messages) when using Mainland websites and apps under my university WiFi🏫 with latencies around 150ms🐢 (discovered via traceroute/mtr commands, BGP routing issues).

Latency to Mainland IP Addresses from University WiFi

This issue does not exist loading under just 1 second, however, when using them under broadbands or mobile data (e.g., HKT, HKBN and CMHK).

For this reason, I did another experiment🧪 testing the "eduroam" WiFi of 8 HK universities around HK in one day. Please stay tuned for my latest articles for more information.

Two (2) months later followed by my report to my university IT department, the routing was successfully fixed✅ with latencies 10-20ms only.

HK Local ISPs

The following commonly-seen HK ISPs were discovered (for reference only) during this WiFi testing and basd on Residential IP VPS on the Internet:

Swipe Left/Right for Full Table Content

H: Home Broadband / B: Business Broadband / M: Mobile Data

Result Data

The experiment result data is available in JSON, CSV and PDF format you can download below. You may also refer to the YouTube video at the top⬆️.

This is for better experience of showcasing experiment results.

 JSON CSV PDF

Summary & Statistics

IPinfo

Many people enjoy IP addresses with both "ISP" labels for ASN and Company respectively (Both "ISP") by IPinfo based on other online videos and articles.

IP Addresses with Both "ISP" Labels by IPinfo

In my real life, however, not all IP addresses belong to Both "ISP" type.

The following table shows the IP address types collected in this experiment:

You may wonder why WTT/HKBNes is labelled as Both "Hosting" (and even "VPN") type by IPinfo despite a real ISP (Internet Service Provider)?

I have contacted IPinfo before.

In its email reply with the evidence from its mass scanners, however, IPinfo mentioned the large number of domain names pointed to (DNS records) and VPN servers under this ASN.

For this reason, this ASN was labelled as "Hosting" and my appeal was not successful.

It's worth to note that IP labels (e.g., Hosting and VPN) do not directly impact the accessibility to streaming services. That means, we can still use such services as usual despite Hosting/VPN labels.

The IP ban of each Internet (especially streaming) service is actually based on the number of users/abusers regardless of IP types (whether Home Broadband, Internet Data Centre (IDC), etc.).

Email Reply from IPinfo

IPData

The trust scores of real residential and business broadbands are usually between 60% and 70% based on the statistics of IPData.

There are also a few IP addresses with trust scores over 80% to 90% and a few under 30% (high-risk) due to some open ports (e.g., Port 80/443).

(Trust Score) Mean: 62.57; SD: 24.52; Min: 3; Max: 96

(Risk Score) Mean: 37.43; SD: 24.52; Min: 4; Max: 97

IP Risk Scores by IPData (Histogram)

IP Risk Scores by IPData (Box Plot)

Ping0

The risk scores of real residential/business broadbands were all under 25% based on statistics of Ping0.

Mean: 12.70; SD: 5.96; Min: 3; Max: 25

IP Risk Scores by Ping0 (Histogram)

IP Risk Scores by Ping0 (Box Plot)

Nevertheless, nearly half of the IPs tested were labelled as red "Internet Data Centre (IDC) IP" instead of green "Home Broadband IP".

IP Type Classification by Ping0 (Histogram)

Scamalytics

The statistics of Scamalytics shows discrete data with 0% risk score for many IPs.

This indicate that real broadband IPs majorly have clean records.

0%: 16; 2%: 3; 5%: 1; 11%: 3

IP Risk Scores by Scamalytics (Histogram)

IP Jiance (IP检测)

IP Jiance (IP检测) website mainly targets Mainland users using outside Internet services for their business with the need of dedicated IPs (i.e., not shared with anyone else).

Nearly 1/3 IPs are shared by more than one (1) user (i.e., many user accounts under the same Internet service) and so labelled as red "Not Recommended", likely a public proxy service (a.k.a., 机场 Airport).

优良 (Excellent): 15
合格 (Satisfactory): 0
不建议 (机场) (Not Recommended due to Public Proxy): 8

IP Risk Scores by ipjiance (Histogram)

There is something important but interesting to know.

For my university WiFi IP address, IP Jiance shows green "Excellent" during winter and summer but red "Not Recommended" during regular terms (i.e., Fall/Spring Term).

From my prediction, many Mainland students live in Halls (dormitory) and so register accounts on Internet services like Google, Instagram and WhatsApp under the university WiFi IP ranges.

IP Jiance Test Results for University WiFi in Different Time

IPQS

Many IP addresses, regardless of whether real broadband IPs or IDC IPs, are labelled as VPN, Proxy or Abuser by IPQS.

Many IP address show risk scores of either 0 or 100 with a very large Standard Deviation (SD): 42.97

From my prediction, the risk scores can be determined by the number of users for IPQS regardless of the open ports.

Mean: 58.32; SD: 42.97; Min: 0; Max: 100

IP Risk Scores by IPQS (Histogram)

IP Risk Scores by IPQS (Box Plot)

My Summary

Now, move on to my personal summary.

All IP addresses tested among the 23 places are Native IPs rather than Broadcasted IPs possibly with wrong country/region labels.

A very few network may not have their routers or firewalls set up properly with open ports, being labelled as Server, Proxy or VPN types.

Other than Wikipedia Editing, all streaming services, including Instagram Licensed Audio library, can be used by all IP addresses (all are green "Yes").

Hosting, VPN and Proxy labels are for reference only. This only indicates open ports but doesn't mean it will definitely be banned by websites/services.