Experiments Tutorials Residential IP Web Tech Networking About

Residential IP Labelled as IDC/Hosting? Why is this and How to Solve?

Published on 2025-09-11; Updated on 2025-09-11

Language/语言: English 繁體中文 简体中文

Do you notice this problem annoying when you use Residential IPs or VPS?

Some IP or VPS providers managed to pick high-quality IPs. When you just started using it, it's labelled as green "Home Broadband IP" type.

After several weeks, it's eventually labelled as Internet Data Centre (IDC) IP and even Hosting, Proxy and VPN types.

No Worry! Kensear Laboratory will guide you explore more about it.

Video

Watch the YouTube video🎬 below for full experiments and solutions:

  Watch on YouTube

Background

I have tested WiFis🛜 at 23 different places around Hong Kong during my last experiment (article and video).

You can notice that nearly half of the IPs were labelled as the red Internet Data Centre (IDC) IP type. Some other IPs were labelled as Hosting or even VPN or Proxy by other databases.

Nearly everyone doesn't want their IPs to be labelled as Data Centre. Some users may keep changing the IP addresses of VPS servers with support tickets.

If this problem continues, it will become worse making many IP ranges labelled.

Clue

If you don't want your IPs being labelled as Data Centre or VPN, you need to know HOW do IP databases identify servers first.

Regardless of the databases (e.g., Ping0, IPinfo, ipdata), they all can identify what IPs belong to servers or data centre.

Try to explore it with this clue.

Ports of Computer IPs

Now, using this clue, you can guess what characteristics do servers and data centres typically have.

If you learned Linux OS, yYou might know that you can access to and manage a server with Port 22 and SSH Protocol.

Apart from Port 22, Port 80 is for HTTP and Port 443 is for HTTPS, and so on.

There are 65,535 ports under each computer and IP. Ports are necessary when you access to a server.

At this point, you might realise that IP database mainly checks whether an IP belongs to a server by port scanning.

Especially IPinfo, labelling as “SSH” after successful scans of Port 22, labelling as “Webserver” after successful scans of Port 80 or 443 (including error pages like 404), and so on.

Experiments

Experiment 1: Port Scanning Attempts

I took out a Residential IP VPS server not being used often in the first experiment.

Apart from my IP address, all other IP addresses were blocked by the firewall and any port scanning attempts were saved to a log file.

Around 120 port scanning attempts were received and logged within 5 minutes. 15 to 30 times per minute on average.

This proved that some IP databases have their mass scanners set up globally, scanning every single IP and port.

Similarly, when you connect to a VPS server you have just bought via SSH, there can be many SSH login failed attempts despite the several-minute time gap.

It's because some malicious scanners have been trying the SSH passwords around the world by utilising this "time gap", especially the “root” account.

Experiment 2: Proxy Discovered

Now, move on to the second experiment.

I set up Socks5 Proxy Server directly on my first server as many Residential IP providers only provide Socks5 connections (can be connected from anywhere outside Mainland).

I will talk about the differences between Socks5 Proxy and VPS products here. While Socks5 Proxy is straightforward for beginners and non-tech users, VPS servers can have more features (e.g., web server) installed but technical skills are required.

The risk score of this IP was checked (near 0%) after being purchased.

Several days later, however, it was labelled as "Proxy" by IPQS with the risk score increased to 70% to 75%.

This proved that many IP databases identify servers, whether server, proxy, etc., with global mass port scanning.

While the port was specified like 1234 (not default port), the server was still labelled as Proxy. This also proved that any port can be scanned.

Experiment 3: All Ports Blocked

Now, move on to the third interesting experiment.

Since the second experiment has made my IP labelled as Proxy or even High Risk, all ports were blocked this time.

Another real Residential IP VPS I bought was directly VPN type on IPinfo.

Same as the first experiment, all ports were blocked, including ICMP Ping, except my IP address.

One to two weeks later, IPinfo no longer identified it as a VPN server. The VPN label eventually disappeared changing back to a standard broadband IP.

This proved that IP databases always continue its scanning regardless of whether it's labelled, so the labels can be removed if the problems no longer exist for a while.

Experiment 4: Large IP Range of a University

Then I used one of the B Ranges of our university as an example.

Simply speaking, B Range means the "/16" range. If an IP address has the same first 2 parts, it belongs to this B Range.

Similarly, A Range means the first part and C Range means the first 3 parts.

This B Range of our university is for wired network and servers. Some C Ranges are for Computer Barn, some are for official website and other internal servers, and some are for Residential Wired Network.

I predicted that Ping0 labels IP type based on each C Range, whether green “Home Broadband IP” or red “Data Centre IP”. We may check it with this experiment.

You can notice that all C Ranges for servers are labelled as red “Data Centre IP” while all C Ranges for wired network are labelled as green “Home Broadband IP”.

This is because the IT department of our university blocks all inbound connections with the firewall for all C Ranges for other than servers, same as the university WiFi, including all ports and ICMP Ping. While it can’t be accessed by any IP address outside, it can access to any IP.

For this reason, it’s labelled as “Home Broadband IP”.

Solutions

These are the reasons why a Residential IP can be labelled as Data Centre or even VPN.

These experiments proved that IP databases mainly rely on port scanning to check whether every single IP belongs to a server.

Do you know how to let IP databases recognise my IPs as broadbands instead of server, VPN or proxy?

Now move on to some possible solutions.

Solution 1: Block All IPs (Inbound)

First, make sure you block all ports with a firewall not allowing ports to be discovered by the mass scanners running 24*7 worldwide.

Many home broadbands don't allow any connection from the outside so they are labelled as “Home Broadband IP”.

But if you block all ports, you will not be able to connect to it as well!

As you can notice, this solution has a conflict.

Solution 2: Only Whitelist your IP

You noticed that you will no longer be able to connect after blocking all IPs. How about only allowing your IP?

You need to ensure it's a static IP✅, not a dynamic IP❌.

Generally speaking, the IP address can be changed at any time whether the broadband or university IPs outside Mainland I use or public proxy services for Mainland users.

Once it's changed, you will need to whitelist your latest IP again. Sounds annoying?

Also, if your dynamic IP eventually falls outside your whitelist, you will not be able to connect via SSH.

Solution 3: Add Another Intermediate Server

So, if my IP is dynamic, how can I connect to the server in a long-term while not allowing mass scanners?

Yes, there is still a way to solve it, but you may need to spend a bit more.

You will need to have a static IP address, changing your dynamic IP to this static IP.

What you will need to do is just to buy another intermediate server with a static IP, like your Residential IP VPS.

It's better to use an intermediate IP labelled as Hosting and Data Centre, and closer to your Residential IP.

You don't need to care how risky it is. It's completely OK if it is 100% risky or labelled as something like VPN.

After setting up both servers, you will still need to set up your IP whitelist to not to let the mass scanners outside come into your Residential IP server.

Real Demo

These are the theoretical knowledge. Now, let's move into our demo!

Kensear Laboratory main uses Debian 12 or 11 OS, but the commands will be quite similar for other operating systems.

I have an intermediate server and a residential IP server.

Connect to the intermediate server first with your SSH credentials and combined command:

Then connect to your Residential IP server via your intermediate one, as you will only whitelist your intermediate server (the latter).

You will not be able to connect to it directly from your computer.

Commands Used in the Video Demo:

sudo -i apt update apt upgrade apt purge ufw firewalld iptables apt install iptables iptables-persistent netfilter-persistent iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -s (Your Intermediate IP) -j ACCEPT iptables -A INPUT -j DROP netfilter-persistent save reboot

After this setup, try to connect to your Residential IP directly from your computer with the following commands.

You will not be able to connect if you have set up correctly.

Then run the following commands again after connecting to your intermediate server. You will only be able to connect from it.

Well Done!

ping -c 4 (Your Residential IP) ssh root@(Your Residential IP) -p 22 curl (Your Residential IP):(Proxy Port)

Still Labelled as Data Centre / Proxy?

Some users may find it strange that their IPs are still labelled as Data Centre or even Proxy after several weeks, even if they have confirmed that the firewall has been set up properly.

Why is this?

This is because the database checks for IP types based on C Range rather than each IP and there were many other IPs and servers detected under the same C Range.

Moreover, if you can't access streaming services, see "IP Banned", or your IP labelled as Mainland, it's not your fault! It's because some other IPs under the same C Range are used by some Mainland public proxy providers.

But anyway, while you can't control others, just improve yourself first.

My Intermediate IP Disappeared, What can I Do?

I also have a backup plan. If all your intermediate servers cannot be used, what can I do?

No Worry! You can see the VNC function for most VPS providers.

Use the VNC function, log in to your account, turn off your proxy software.

Type “iptables -F” to release your firewall temporarily. All IPs will be able to connect again to reconfigure the firewall.

iptables -F

More Interesting Facts

Socks5 Proxy with Intermediate IP

I also noticed some relevant interesting facts.

You can't connect to the given Residential IP via Socks5 directly for some Socks5 Residential Proxy providers. You will be given another shared entry node IP like an intermediate server.

From my observation, the IPs by such providers have high trust scores on IPData and labelled as green “Broadband IP” on Ping0 which might be your favourite.

But for those letting you connect to your Residential IP directly, the trust score are nearly zero on IPData and might be labelled as red “Data Centre IP” on Ping0.

Anti-scan IP Blocking Method

When you ban some IP addresses, don't give any response, whether Your IP is Banned, Invalid Password, 403 Forbidden, or even a blank webpage.

This is because it may also be recognised as a server or proxy.

So, what should you do? You must block the ports entirely (i.e., connection timeout).

Ping Blocked on some VPS Providers

Some VPS providers block ICMP Ping for all their IPs as they don't want their IPs labelled as “Data Centre” by Ping0.

For example. Some VPS provider websites show this message:
“应IP提供方要求，本产品部分IP段禁了ping，但禁ping不影响正常使用”

Summary

Many of my experiments proved that IP databases have many mass scanners working 24*7, scanning IP addresses worldwide and checking whether they are servers, proxies or VPN.

If you don't want your IPs labelled as “Data Centre”, you need to block all ports.

But because you will not be able to access it and your IP may change at any time, you will need another intermediate server with a static IP, whitelisting its IP address.

That's the end and see you next time! You can also explore more on my website & channel.