August 1, 2026
Residential, cloud, VPN: reading IP categories like a grown-up
City is a party trick. Residential IP vs cloud vs VPN is the column I actually sort. A login flood from 40 cloud /24s is a script. The same flood from a cable residential prefix in one city might be a campus NAT or a really unlucky CMTS. A VPN exit is a person who does not want you to know, or a company laptop that has no choice.
Category is still a guess. Treat it like a prior, not a verdict.
What the labels usually mean
Residential — access networks, home broadband, a lot of mobile. Abuse here is often a bot on a real human’s CPE. You write to the ISP. You do not assume the human is the operator of the botnet.
Cloud / hosting — VPS, dedicated, the usual suspects. Fast to provision, fast to burn. This is where credential stuffing likes to live. The abuse contact is a form, and the form works if you give them the source ports and the timestamps.
VPN / proxy — exits, datacenter VPNs, some “residential proxy” products that are neither. I collapse VPN and proxy on purpose. If you need to know which product, you are already past what a public category can honestly say.
Education / government / business — useful when they are right, embarrassing when a vendor filed a whole city as “education” because one /16 belongs to a university. Glance at the origin ASN before you build a story.
How I use it on a real queue
I paste the list into geolocation lookup in bulk and I sort on category. Cloud-heavy: rate-limit and move on. Residential-heavy: look at the ASNs — one cable ASN vs fifty is the difference between a NAT and a distributed mess. VPN-heavy: decide whether your product even wants those logins. Some of us block them. Some of us just step up MFA. I will not pick that fight in a blog post.
I also look at the origin ASN next to the category. A “residential” label on a prefix originated by a known cloud ASN is a vendor lag. A “cloud” label on a regional ISP is the same lag the other way. The IP lookup that shows prefix + origin + category together is the only version of this I trust enough to paste into Slack.
Residential proxies and other cheats
There is an industry that resells access through real home connections. Those addresses will look residential, because they are. Category will not save you. Behavior will: concurrency, ASN diversity that is too perfect, headless TLS. If your fraud model is “block non-residential,” you will bless the fanciest proxy money can buy.
That does not make the column useless. It makes it one signal. I would rather have it than not. I just will not swear to it in a room with lawyers.
Write categories, not novels
In tickets I write “mostly cloud (ASN list)” or “single residential ASN” or “VPN exits, mixed.” I do not write “the attacker is in a basement in Ohio.” I do not have that information. Neither does your geolocation vendor, even when the pin looks very sure.
Read the category. Check the origin. Then decide what kind of Tuesday it is.