Skip to Content
New: a threat-model-first guide to choosing your network defence, plus the nym-smoldvpn dVPN package and nym-swizzle sender hygiene.
OperatorsResidential IPBYOIP on Bare-metal

ISP-tier IP Blocks and BYOIP

This is the industry’s “static residential” or “ISP proxy” model, repurposed. Lease IP space that is registered under a real ISP’s ASN, then announce it via BGP on a bare-metal or colo provider that supports BYOIP. The box sits in a data center, and the exit IP classifies as isp (mapping to residential).

Operators control the hardware and bandwidth, which fits Exit Gateway, WG-exit and IPR needs. It scales by leasing more space rather than by recruiting more households.

Two variants, and the difference matters

The durability of this route depends entirely on which one you build.

Lease a clean /24 and announce it under your own (that is, hosting) ASN.

The block may still WHOIS to the leasing org for a while, but self-announcing VPN-exit traffic under a hosting ASN is exactly what re-classification heuristics catch. This decays.

BYOIP Hosts

Providers seen offering BYOIP on dedicated or colo.

ProviderBYOIP costServer typesKey terms / notes
HOSTKEY FreeDedicated + coloARIN/RIPE, next-business-day setup. Drops your announcement if the block hits Spamhaus, which matters for GWx
NovoServe FreeBare metalIPv4 + IPv6, announce under your own ASN, explicitly VPN-operator friendly
Dedicated.com ~$250 setup + $100/mo per locationDedicated / colo, not VPSYou run the BGP session yourself
ServerSP TBDBare metal / VPS / VDCAnnounce under their ASN (AS214456) or yours. Integrates with IPXO-leased space

IPv4 Leasing Brokers

For the block itself.

BrokerPrice (/24, per IP/mo)Block sizesRIRsSetupIncludedNotes relevant to us
IPXO ~$0.35/IP (2026 avg), 5% txn fee/24+Any RIR~1–3 days, often under 24hAutomated LOA/ROA, WHOIS + rDNS sync, geolocation correction, continuous blocklist and reputation monitoringLargest, most self-service inventory. Filter by size, RIR and geolocation — but no as_type=isp filter, and org type still tracks the block’s registrant. Their reputation tooling is about clean, not residential
InterLIR  (InterLIR GmbH, Berlin)~$0.50–0.60 clean, $0.30–0.40 reputation-flagged; from €99–110/mo per /24/24–/16RIPE primary, plus ARIN, APNIC, LACNIC, AFRINIC24–48hLOA/RPKI/ROA, 50+ blacklist screen at onboarding, 24/7 abuse management, free replacement if a leased IP gets blacklistedManaged hybrid model. Can sponsor ASN registration in RIPE if you don’t have an LIR, which is useful here. Watch hidden fees: setup $50–200, BGP config $100–300, early-termination penalty
IPbnb Per-listing, transparent, 5% flat txn fee/24+RIPE primary, ARIN~24hRPKI/ROA, LOA, ASN registration, reputation checks at onboardingTwo-sided marketplace, so you see the subnet’s source and terms before committing. Less opaque than a managed pool, good for vetting registrant lineage

Possible Downside

⚠️

Brokers sell clean space (blocklist-free, correct geo). That is not the same as residential.

as_type follows the block’s registrant org, and marketplace inventory skews hosting and enterprise, so the default result is hosting or business, not isp (residential). None of the brokers filter by ISP registrant.

So request ranges whose holder is an ISP org, then verify the exact prefix on a sample across ipinfo , ipapi.is  and MaxMind  before signing anything. Registrant identity is a signal, not a result — one org can hold ranges that classify differently, so a good answer on one prefix does not carry to the next.

And if you announce under your own ASN, the ROA names your ASN as origin, which is the reclassification-drift risk described above. InterLIR’s RIPE ASN-sponsorship path  is the cleanest fit here.

Suggested first experiment

Lease one small ISP-classified block from IPXO  or InterLIR , announce it via HOSTKEY  or NovoServe  BYOIP on a bare-metal box, stand up a test exit, and check as_type across ipinfo , ipapi.is  and MaxMind . That confirms the route end to end for a low cost.

Then re-check the same IP after two to four weeks of live exit traffic, to see whether classification or reputation drifts.

References

Last updated on
Mislabeled VPSISP Partnership