ISP attribution, simply put, is about finding out who "issued" your IP address—which internet service provider it belongs to. The most typical ISPs are China Telecom, China Unicom, and China Mobile. To illustrate, an IP address is like your house number, and your ISP is like the delivery company that gives you that number and delivers your data.
Determining whether an IP address is a residential IP is essentially a technical judgment: is this "house number" on the door of an ordinary residential building, or on the door of a data center? While both can send and receive data, their treatment is vastly different under the internet's "community rules" (such as risk control systems and anti-fraud mechanisms).
What is ISP attribution?
To understand ISP attribution, you first need to understand the internet's "logistics system." Your computer and mobile phone can access the internet because you pay a fee to a telecom operator like China Telecom or China Mobile. They run a network cable from the street switch to your home and assign you an IP address, allowing you to access the outside world. This operator providing you with access service is your ISP. Therefore, when you query an IP's "ISP affiliation," whether you see "China Telecom" or "Alibaba Cloud" reflects the IP's origin.
From a technical perspective, global IP addresses are managed uniformly by IANA, then allocated to five regional Internet Registries (RIRs), and finally distributed by the RIRs to various network operators or organizations. Each organization that obtains an IP range has an ASN (Autonomous System Number), which is like a company's business registration number, used to identify its identity in the BGP routing protocol. Checking an IP's ASN reveals whether its registered organization is a residential ISP like China Telecom (AS4134) or a cloud service provider like Amazon (AS16509). This is the core basis for determining ISP affiliation and the foundation for subsequent IP type determination.
How to determine if an IP is a residential IP?
There is no absolutely accurate answer to this question, as the methods themselves have their own perspectives and limitations. Currently, the industry generally adopts a multi-dimensional cross-verification approach, and the technical schools can be roughly divided into the following categories:
1. Static determination based on registration information. This is the most basic and fastest method. 1. Directly check the IP's ASN and Whois information to see who its registered organization is. If it's "China Telecom" or "Comcast," it's marked as a residential IP; if it's "Amazon" or "DigitalOcean," it's marked as a data center IP. This method is fast and has wide coverage, but its major drawback is that it reflects "ownership," not "usage rights." Telecom operators can easily use an IP range for data center operations, and a cloud service provider's IP range might be subleased to home broadband users. Therefore, relying on this single field can easily lead to misjudgment.
2. Dynamic analysis based on network behavior. This method goes deeper; it doesn't look at who you are, but at what you do. For example, checking ports: Residential IPs' ports 80 (web page), 443 (encrypted web page), and 22 (remote management) are usually blocked by the home gateway (router). You wouldn't randomly log into your neighbor's router's backend from the external network, so testing these ports with telnet will likely result in a timeout, indicating a residential IP. Server IPs, on the other hand, usually have these ports open to provide services to the outside world. For example, consider reverse DNS lookups (PTR records): reverse DNS lookups of residential IPs often return domains containing words like "adsl" or "broad"; while the lookup results for data center IPs often contain keywords like "cloud" or "server".
3. Multi-source cross-validation and expert experience. This is currently a relatively cutting-edge approach in the industry with a lower false positive rate. Since single-dimensional analysis is prone to errors, multiple dimensions are used for verification. For instance, if an IP's ASN registration information shows "China Telecom," a port scan reveals that port 80 is closed, and the reverse DNS lookup points to a home broadband domain, then the confidence level for classifying it as a residential IP is very high. Conversely, if the ASN is "China Mobile," but all ports are open and an nginx service is running, then it's highly suspicious.
Many mature tools, such as ipinfo and ipip.dev, integrate databases like GeoIP2 and IP2Proxy. When you query an IP address, they not only return its geographical location and ISP, but also attempt to detect whether it's associated with proxies or Tor activities. This information can, in turn, help determine if it's a "clean" residential IP. However, be careful; if the same IP shows different results on different platforms, it's likely because each platform is only seeing different parts of the "elephant" and using different technical solutions.
FAQs：
Q: Why does the same IP address show as a residential IP on platform A but as a data center IP on platform B?
The root cause lies in the different judgment methods and technical data sources used by each platform, leading to widespread misjudgments. Some platforms only look at ASN registration information (ownership), some combine port scanning and behavioral analysis (actual use), and others rely on manually maintained IP segment labeling databases. Coupled with ISP proxy IPs, mixed use of commercial and residential broadband, and delayed changes in IP segment ownership, data discrepancies are very common.
Q: What do Tier 1, Tier 2, and Tier 3 mean in ISP classification?
This is a way of classifying ISPs. Tier 1 refers to top-tier operators who run the global internet backbone. They are interconnected free of charge and have access to all IP addresses globally, though the number is very limited. Tier 2 connects to the global network by purchasing forwarding services from Tier 1. Tier 3 consists of smaller, local ISPs that access the internet by purchasing services from Tier 2.
Q: What free tools are recommended for quickly checking if an IP address is a residential IP?
You can use ipinfo.io. Entering the IP address in the webpage will display the ISP and ASN information. Alternatively, you can use `nslookup targetIP` in the command line to check the reverse DNS and see if the domain name contains characteristics of home broadband such as ADSL or Broadband. However, remember that these quick methods may be inaccurate and should only be used as a reference.
