Skip to Content
New: a threat-model-first guide to choosing your network defence, plus the nym-smoldvpn dVPN package and nym-swizzle sender hygiene.
OperatorsResidential IP

Residential IPs

Research on scaling residential and ISP-classified IPs for Nym exit gateways.

To see the list of current residential IP nodes, run this command in your terminal:

bash -c "$(curl -fsSL https://gist.githubusercontent.com/serinko/81d2565bea4b0a32b57d1f5981497d7a/raw/c9e03a9c6542fe417ec65c93ec69db6f098aba36/get_nym_residential_ip_nodes.sh)"

Problem

NymVPN users want to reach services that block or refuse signup from VPN traffic. Among other criteria, those services check public IP-intelligence databases for a hosting tag, which is assigned to IP ranges owned by VPS providers.

Operators run nodes on servers in data centers owned by VPS providers. Those ranges carry the hosting tag, so VPN users get censored.

Operators mostly cannot run nodes at home either:

  • The public and static IP that the Nym network requires is usually not provided
  • The legal exposure to risk-reward ratio is net negative
  • A shared uplink with other users on the same fiber (house, block, street) gives a poor connection experience

The Core Mechanic

IP-intelligence databases (ipinfo.io , ipapi.is , MaxMind, IP2Location) do not look at where the box physically sits. They derive as_type largely from the WHOIS/RIR registration of the IP block and the ASN that announces it, confirm the org type by inspecting the org name and website, and weigh observed network behaviour on top of that.

NymVPN API Logic

For the NymVPN APIs  we scrape this from ipinfo.io  and expose it as location.asn.kind:

Registrant orgas_type on ipinfolocation.asn.kind in NymVPN API
Consumer ISP orgispresidential
Cloud / hosting orghostingother

A server in a rack in a data center can legitimately show as residential if the IP it exits from is registered to, and announced under, a real ISP.

⚠️

Nothing you change on the node itself moves the needle. Not reverse DNS, not config, not the kernel. The only lever is who owns and announces the IP space — and because classification is assigned per range and partly from observed behaviour, the right registrant makes a good result likely, never certain. Always verify the actual prefix.

So the whole problem reduces to: acquire IP space whose registration lineage is a consumer or fixed-line ISP, and run an Exit Gateway on it. Each route below is a different way to do that.

Solution

RouteScales?Summary
Mislabeled VPS rangesYes, but fragileCheap and immediate but it can dissapear as residential without notice
ISP-tier IP blocks and BYOIPYesLease ISP-registered space, announce it on bare metal or colo
Partnership with a small ISPYes, slowlyCleanest lineage, compounds over time, relationship work building social networks
Mobile 4G/5G gatewaysPoorlyHighest trust score of any IP class, hard to scale
Home-hosted nodesNoSub-optimal in general, but works in the Swiss setup

How to verify classification

This applies to every route. Cross-check each candidate IP against ipinfo, ipapi.is, MaxMind and a proxy/fraud score (IPQualityScore or Spur) — never just one source.

ASN → org → org-type is the chain that matters. The pass condition is a low fraud score and an isp type (mapping to residential). One without the other is not enough.

What to Avoid

Prevent burning resources on things that already failed for others.

Wrong architecture and wrong ethics.

Architecturally, they route traffic through third-party consumer devices. You don’t get to host a node on that IP, which is what an Exit Gateway needs.

Ethically, a large share of this industry sources IPs from malware and SDK-bundled installs without real consent. 911 S5 (19M hijacked IPs, FBI takedown May 2024) and NetNut (disrupted July 2026) are the headline cases. For a privacy project, buying botnet-adjacent residential access is reputational and legal poison.

A wave of cheap “residential IP VPS” shops exists. Many are just proxy fronts, or brokered residential IPs of unknown origin.

OVHcloud publicly refuses to sell residential IPs precisely because the sourcing and ownership are murky and legally risky.

If a vendor can’t tell us the ASN and the registration lineage, we can assume it won’t survive verification. See the vendor research for which ones cleared this bar and which did not.

Worth having an ASN for routing control, but it won’t classify as isp. The org resolves to a tech/VPN/hosting entity, so we’d land on hosting or business.

Owning the ASN doesn’t buy the residential tag. The ISP lineage of the block does.

No rDNS trick, tunnel, or config makes a Hetzner, OVH or DigitalOcean IP read as isp (mapping to residential).

Possible Experiments

As shared above, there are multiple routes to try, if you are interested to test the options, you can test some possibilities with a fairly low budget:

  • Lease one small ISP-classified block from IPXO or InterLIR, announce it via HOSTKEY or NovoServe BYOIP on a bare-metal box, stand up a test exit, and check as_type across ipinfo, ipapi.is and MaxMind. Confirms the route end to end for a low cost

  • Re-check the same IP after two to four weeks of live exit traffic to see whether classification or reputation drifts. This is the durability question in the BYOIP route

  • Buy one mobile-gateway setup in a target country and compare real-world unblock rates against the ISP-tier box, on the actual services users complain about

  • Look for a small-ISP partnership pitch in parallel.

Additional Concerns

⚠️

Nym Exit Gateways IPs are publicly enumerable from the network’s own mainnet API. Anyone can pull the current exit set and feed it straight into a blocklist.

Residential classification is necessary but not sufficient. It gets past Cloudflare and DataDome-style ASN gating and most geo-locked services. It will not keep Nym off dedicated exit-node feeds like Spur, IPQualityScore and ipgeolocation.io, who continuously connect through anonymity networks and record the exit IPs.

Treat these as two separate problems. Residential IPs are the high-leverage fix for the “obviously a datacenter VPN” majority of blocks. The enumeration problem is a different project — churn and rotation of exit space, not publishing more than necessary — and shouldn’t be conflated with this one when setting expectations for operators and users.

References

Last updated on
Nyx & ValidatorsMislabeled VPS