Proxy IP Ranges & Detection Directory 2026
Residential, datacenter, and mobile proxy networks — Bright Data, Oxylabs, Smartproxy, IPRoyal, SOAX and the hosting ASNs behind them. Check if an IP is a proxy, or detect proxy traffic in real time.
How Do You Tell If an IP Is a Proxy?
It depends entirely on the proxy type. Datacenter proxies run on a stable set of hosting ASNs — the same networks in our high-risk ASN directory — so they are range-flaggable and easy to catch. Residential and mobile proxies rotate across millions of real consumer ISP and carrier IPs; there is no single ASN to block, so the reliable signal is behavioral: request velocity, device/IP fingerprint mismatch, and IP-reputation history.
The honest takeaway: a static proxy IP list is always stale the moment it's published. Effective proxy detection combines ASN/range intelligence (for datacenter) with live reputation and behavioral scoring (for residential and mobile).
The Three Proxy Types (and How Detectable Each Is)
Residential proxies
Real consumer ISP IPs, sourced via SDKs bundled in free apps/VPNs or contracted directly from ISPs. The IP looks exactly like a genuine home broadband user.
Detection signal: No stable ASN to block — the pool rotates across millions of consumer IPs. Detect on behavior: request velocity, device/IP fingerprint mismatch, IP-reputation history, and the fact that a "residential" IP is making API-grade automated requests.
Mobile proxies
IPs from 4G/5G carrier gateways. Because carriers CGNAT thousands of subscribers behind one IP, mobile proxy IPs carry very high trust and rotate constantly.
Detection signal: Cannot range-block without collateral damage to real mobile users. Flag on mobile-carrier ASN combined with automation behavior and velocity — not on the IP alone.
Datacenter proxies
IPs from cloud/hosting providers (the ASNs listed below). The cheapest and most common proxy type — but also the most detectable.
Detection signal: Stable, range-flaggable. The hosting ASN, announced ranges, and reverse-DNS all give it away. A "consumer" action coming from a hosting ASN is a classic datacenter-proxy tell.
For a deeper technical breakdown, see residential vs. datacenter vs. mobile proxies and techniques for detecting residential proxies.
Why Flag Proxy Traffic?
⚠️ Risk Indicators
- • Credential stuffing and account takeover at scale
- • Web scraping and price/inventory harvesting
- • Sneaker/ticket bots and limited-drop abuse
- • Ad fraud and fake-impression farms
- • Multi-accounting, promo abuse, and chargebacks
✅ Legitimate Uses
- • Corporate egress proxies and CGNAT
- • Privacy-conscious users and researchers
- • SEO/brand-monitoring and ad verification
- • Market-research data collection
- • Users behind shared mobile-carrier IPs
Best practice: don't hard-block all proxies — mobile and CGNAT IPs carry many real users. Apply risk-based friction (step-up verification, velocity limits, review) and weigh the proxy signal alongside IP reputation and behavior. See blocking datacenter IPs without hurting real users.
Major Commercial Proxy Networks
9 networksPool sizes are the providers' own claimed figures. Residential and mobile pools rotate across consumer IPs — there is no fixed range to list — so the "signal" column describes how each is actually caught.
| Proxy Network | Type | Pool Size | Detection Signal |
|---|---|---|---|
| Bright Data (Luminati) | Residential / Mobile | 150M+ IPs | Peers via SDK on consumer devices; IPs look like ordinary broadband. Behavioral + reputation signal, not ASN. |
| Oxylabs | Residential / ISP | 175M+ IPs | Mix of P2P residential and contracted ISP ranges. ISP-sourced subnets can be range-flagged. |
| Smartproxy (Decodo) | Residential | 115M+ IPs | Rotating consumer IPs across global ISPs. Detected via velocity + device/IP mismatch. |
| IPRoyal | Residential / Datacenter | 34M+ IPs | Pawns.app peer pool (residential) plus cheap datacenter pools on commodity hosts. |
| SOAX | Residential / Mobile | 155M+ IPs | Large mobile/carrier pool — hard to range-block; flag on mobile-ASN + automation behavior. |
| NetNut | ISP-sourced Residential | 85M+ IPs | Sources static IPs directly from ISPs — appears as stable residential, not P2P. |
| Webshare | Datacenter / Residential | 30M+ IPs | Largest cheap datacenter pool; datacenter IPs sit on hosting ASNs (range-flaggable). |
| Rayobyte (Blazing SEO) | Datacenter / Residential | ~20M IPs | Heavy datacenter footprint on commodity hosting ASNs; ASN + reverse-DNS detectable. |
| Infatica | Residential | 15M+ IPs | SDK-based consumer peer network; behavioral signal, no single ASN. |
Datacenter Proxy Hosting ASNs
Datacenter proxies are the range-flaggable proxy type. These hosting ASNs carry a large share of cheap rotating datacenter proxy pools. Click an ASN to explore the full network, or a sample IP for live threat intelligence.
| Hosting ASN | Sample IP | Notes |
|---|---|---|
| AS202425 · IP Volume Inc | 45.134.212.1 | Documented residential-proxy and VPN exit node infrastructure |
| AS63473 · Router Hosting LLC | 172.86.64.1 | Known residential-proxy and VPN exit node hosting |
| AS9009 · M247 Ltd | 185.156.46.1 | Carries large VPN and proxy exit-node fleets |
| AS30633 · Leaseweb USA Inc | 23.81.0.1 | Global hosting used heavily for proxy and VPN pools |
| AS51167 · Contabo GmbH | 62.171.128.1 | Cheap VPS frequently spun up as datacenter proxies |
| AS8100 · QuadraNet Enterprises | 198.55.96.1 | US host with heavy proxy and VPN infrastructure |
| AS40676 · Psychz Networks | 138.128.0.1 | LA hosting — proxy, botnet, and scanning footprint |
| AS54290 · Hostwinds LLC | 192.236.128.1 | Budget VPS abused for proxy and scraping pools |
| AS35916 · Multacom Corporation | 172.93.0.1 | US budget host frequently used for proxy infrastructure |
| AS14061 · DigitalOcean | 64.225.0.1 | One-click VPS commonly used for DIY datacenter proxies |
| AS20473 · Vultr Holdings | 45.32.0.1 | Cheap global VPS spun up as rotating datacenter proxies |
How to Detect Proxy Traffic with IPASIS
IPASIS classifies proxy, VPN, Tor, and datacenter IPs in real-time (<20ms latency) by combining hosting-ASN intelligence with live range data, reputation, and behavioral signals — so it catches datacenter proxies on the range AND residential proxies on behavior:
- •ASN and announced-range matching for datacenter proxy hosts (IP Volume, M247, Leaseweb, Contabo…)
- •Datacenter vs. residential vs. mobile classification on every IP
- •Live reputation history for known residential-proxy peer IPs
- •Behavioral signals — velocity and device/IP mismatch — for rotating residential pools
curl -X POST https://api.ipasis.com/v1/detect \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"ip": "45.134.212.1"
}'
# Response:
{
"ip": "45.134.212.1",
"proxy": true,
"proxy_type": "datacenter",
"vpn": false,
"tor": false,
"datacenter": true,
"trust_score": 81,
"asn": {
"number": 202425,
"name": "IP Volume Inc",
"risk_level": "high"
},
"threats": ["proxy", "datacenter"],
"recommendation": "step_up_verification"
}Flagging Proxy Traffic (Code Examples)
Express.js Middleware
const ipasis = require('@ipasis/node');
app.use(async (req, res, next) => {
const result = await ipasis.detect(req.ip);
// Datacenter proxies: safe to gate hard.
if (result.proxy && result.proxy_type === 'datacenter') {
return res.status(403).json({ error: 'proxy_blocked' });
}
// Residential/mobile: friction, not a block.
if (result.proxy && result.trust_score < 50) {
req.requireStepUp = true;
}
next();
});Next.js Middleware
import { NextResponse } from 'next/server';
import { detect } from '@ipasis/node';
export async function middleware(req) {
const ip = req.ip || req.headers.get('x-forwarded-for');
const result = await detect(ip);
if (result.proxy) {
const res = NextResponse.next();
res.headers.set('x-proxy', 'true');
res.headers.set('x-proxy-type', result.proxy_type);
return res;
}
}No JavaScript on the client? See detecting proxy traffic without JavaScript, and detecting multi-hop proxy chains.
Related Resources
Is This IP a Proxy? Find Out in Real Time
Free tier includes 3,000 requests per month. No credit card required. Classify proxy, VPN, Tor, and datacenter IPs — with the proxy type — in a single REST call.