How Residential IP Infrastructure Fits into Modern Internet Networking

Most people know their home internet has an IP address, but that's usually where it ends. Few ever check what it is or who it belongs to.

Websites check all the time though. The address gives away which ISP you use, a rough location, and whether the connection is coming from someone's house or from a server somewhere, and that last part decides a lot more than you'd expect.

Here's a look at how residential IPs get handed out and why the rest of the internet cares so much about them.

How a Home Connection Ends Up With an IP

There are 4,294,967,296 IPv4 addresses in total. That seemed like more than enough when the protocol was designed in 1981, and it obviously wasn't.

The way they get distributed is pretty simple. IANA hands large blocks to the regional registries, the registries give smaller blocks to ISPs, and the ISP assigns one to your router through DHCP. Some providers let you keep the same address for months while others change it often (Deutsche Telekom used to disconnect DSL customers every 24 hours, so people got a new IP every day).

All of this is on public record too. If you do a WHOIS lookup or put an address into MaxMind's GeoIP2, you'll normally see the ISP and the town it's registered to.

Why It Matters Which Kind of IP You Have

Websites use that public info to decide how much they trust a visitor. Traffic from a Virgin Media range in Manchester looks like a normal person browsing, but traffic from an AWS range is usually treated as automated until there's a reason to think otherwise. If you're interested in how this works on the proxy side, residential proxies explained by MarsProxies goes through it in more detail.

Most bot protection services work along these lines. Cloudflare looks at the autonomous system number (ASN) of each connection, and if it belongs to a hosting company the visitor gets a worse score from the start. Akamai and DataDome do similar things.

That said, a home IP isn't automatically seen as clean. Spamhaus has a Policy Block List made up mostly of consumer IP ranges, since home connections normally shouldn't be sending email directly to mail servers.

If you've ever tried to buy tickets while connected to a work VPN and got stuck solving CAPTCHAs, you've seen the difference in practice.

What Happened When IPv4 Ran Out

IANA gave away its last free IPv4 blocks in February 2011, and after that the registries had to make do with what they had left. RIPE NCC, which is one of the five regional internet registries and handles Europe, ran out completely in November 2019.

ISPs mostly dealt with this by using carrier-grade NAT, or CGNAT. With CGNAT dozens of customers (sometimes hundreds) share one public IP address, and the IETF set aside the 100.64.0.0/10 range for it in RFC 6598 in April 2012.

It does the job but it has side effects, and the RFC itself lists a few of them. For example, geolocation tends to show where the ISP's equipment is instead of the customer, and websites that limit logins per IP can end up blocking people who just happen to share the same address.

On mobile networks this goes even further. One IP from a mobile carrier can be used by thousands of phones in a day, which is why blocking a mobile IP is rarely a good idea.

Where IPv6 Comes In

IPv6 basically solves the shortage. Home connections usually get a /56 or /64 prefix, and just one /64 has around four billion times more addresses than all of IPv4.

The rollout has been slow and uneven though. Google publishes IPv6 adoption statistics based on its own traffic, and countries like Germany and India are far ahead of most of Africa. A lot of company networks still run IPv4 only internally as well, mainly because changing years of firewall rules is a job no one wants.

For reputation systems IPv6 is harder to deal with. Blocking one address doesn't help when a household has an enormous number of others available, so blocking usually happens at the prefix level instead. On top of that, RFC 8981 privacy addresses change roughly once a day, so the same laptop can show up as a new visitor every morning.

Looking Ahead

Residential IPs are going to stay an important trust signal for a long time. What's going away is the idea that one IP equals one household, since CGNAT and IPv6 have both made that less and less true.

Detection systems will probably keep moving toward looking at prefixes and behavior instead of individual addresses. If you work in networking or fraud prevention it's worth understanding where an IP actually comes from and who else might be using it, because it can save you a lot of time when something goes wrong.