You run a scrape, it works for twenty minutes, and then every response is a CAPTCHA or a flat 403. You didn't change a line of code. You didn't hammer the site. So what happened?

Nine times out of ten, the site finally looked at your IP and decided it was a datacenter IP — and that one signal is enough to treat you as a bot.

I've lost more hours to this than I'd like to admit, so here's the mental model I wish someone had handed me earlier.

There are really only three kinds of IP that matter

Every public IPv4 address is routed by some network, and that network falls into one of three buckets as far as anti-bot systems care:

• Datacenter — cloud and hosting providers. AWS, Google Cloud, OVH, Hetzner, DigitalOcean. Cheap, fast, and the first thing every blocklist flags.
• Residential — the IP your home ISP hands you. Comcast, BT, Jio, whatever. Shared with real households, so blocking it has a cost.
• Mobile — a carrier assigning you an address over 4G/5G. The hardest of the three to block, because thousands of real phones sit behind each one.

The site doesn't guess. It looks up the ASN — the autonomous system number that owns the IP — and the ASN basically wears a name tag. AS16509 is Amazon. AS15169 is Google. AS14061 is DigitalOcean. If your request arrives from one of those, you've announced "I am a server," and servers don't browse shopping sites at 2am.

How to actually check what you're working with

Before you blame your code, look at the IP. Two quick checks:

Load what-is-my-IP — it shows your current exit IP, the owning network, and a datacenter / mobile / residential guess in one shot. If you want to inspect a specific IP or an ASN, the ASN lookup gives you the org and country behind it.

The reverse DNS is a dead giveaway too. Hosting providers leave obvious PTR records — if yours looks like ec2-54-x-x-x.compute-1.amazonaws.com, no detection model on earth is going to think you're a person. Real carrier IPs almost never have a tidy hostname like that.

Why "just rotate more datacenter IPs" doesn't save you

This is the trap. People hit a block, buy a bigger pool of datacenter IPs, and rotate harder. It buys you an afternoon. The problem was never that IP — it was the category. A thousand datacenter IPs are still a thousand IPs wearing the same name tag.

What actually changes the outcome is moving to a category sites can't cheaply ban. Residential helps. Mobile helps more, because carrier-grade NAT means one IP is shared by a crowd of genuine users, so a site that bans it also bans paying customers. That shared-trust is the whole point of a mobile proxy — you borrow the reputation of real phone traffic instead of fighting the datacenter label.

A sane order of operations

1. Get blocked.
2. Check the IP's category before touching your scraper logic. Most "my code broke" bugs are "my IP got flagged" in disguise.
3. If it's datacenter, stop rotating datacenter IPs and switch categories.
4. If you're already on mobile and still blocked, now it's worth looking at your headers, timing, and whether you're leaking your real IP through something like WebRTC.

Most of the time it's step 2. The IP told the site everything it needed to know before your first request header was even read.

Questions I get asked

Is a VPN a residential or datacenter IP? Almost always datacenter. Commercial VPNs run on hosting providers, so their exit IPs sit in cloud ASNs and get flagged the same way a raw server would. A VPN hides your IP from the site owner you're visiting over the network, not from the fingerprinting that classifies the exit.

Can a site be 100% sure my IP is a datacenter IP? Not literally 100%, but close enough that it doesn't matter. ASN ownership is public routing data, so the classification is cheap and reliable. Treat "probably datacenter" as "will be treated as datacenter."

My IP shows as residential but I still get blocked — why? Category is necessary, not sufficient. Behaviour (request rate, headers, mouse movement, TLS fingerprint) still matters. A clean IP buys you the benefit of the doubt; acting like a bot spends it.