Why does a residential IP address rent by the hour for more than a datacentre one?

## The address is the product When a victim's machine is turned into a proxy exit, nothing about the machine matters except the network address it holds and the fact that it can forward traffic. The bandwidth is modest, the latency is bad, the host may vanish when someone reboots a router. None of that is the point. The buyer is paying for a property the victim did not know they owned: the reputation their address carries inside somebody else's risk model. Almost every consumer-facing site scores incoming requests, and one of the strongest signals available is what kind of network the address belongs to. Public registration data tells you whether a range is allocated to a consumer ISP, a mobile carrier, a hosting provider or a cloud platform. A request from a cloud range that claims to be a shopper browsing trainers is, statistically, automation. A request from a broadband allocation in a city where that account has logged in before is, statistically, a customer. So the same automated request is refused from one address and served from the other, and the difference in outcome is what the hourly or per-gigabyte fee buys. This is why the vocabulary of the market is "residential", "mobile" and "ISP" proxies, and why a specific country, city or carrier commands a premium. Geography that matches the account being abused is worth paying for. ## Where the supply comes from Two pipelines feed the same pool, and at the exit they are indistinguishable: - **Compromised devices.** Home routers with default or reused credentials, set-top boxes, cameras and other consumer equipment that is never updated, plus ordinary PCs infected with a small forwarding component. The owner is never told. - **Consented bandwidth sharing.** Software development kits paid into free applications, browser extensions and "earn money from your unused bandwidth" clients. Somebody clicked accept. Both produce an exit node on a consumer allocation. The vendor aggregates them into a pool of millions of addresses, and sells access with controls for country, city, carrier and session stickiness. ## Why the fee is metered by traffic An address is a wasting asset. The moment it is used against a target that scores it, the address accumulates history: challenges, blocks, abuse reports, appearances on public lists. After enough use it is worth nothing for the purpose it was rented for. That is why pricing is typically per gigabyte rather than per address, and why the vendors compete on pool size and rotation rather than on speed. The business is churn: burning victims' reputations at a controlled rate and replacing them. ## Who pays, and who never finds out The economics are unusual because there are three parties and only one of them understands the arrangement. The **victim** pays in bandwidth and data allowance, but mostly in reputation. Their address collects the consequences of the buyer's behaviour: constant challenges when they browse, services that refuse them, an abuse notice from their ISP. Where the victim is a company, the address being spent may be a corporate egress address, and the partners and services that start refusing that traffic are the company's own. The **buyer** rents an exit and often has no interest in where it comes from; some vendors advertise consented supply and the buyer takes that at face value. The **third party being defrauded** never learns a victim was involved at all. From their side, an ordinary household made a request. That is the entire product. ## The classification mistake Candidates often describe this as "hiding the attacker's IP", as if the value were anonymity. Anonymity is cheap and any hosting provider or public relay supplies it. What is not cheap is *legitimacy*: an address that a stranger's risk model has no reason to distrust. Framing it as reputation rather than concealment is what makes the countermeasure obvious, since blocking hosting ranges does nothing to a pool built out of consumer broadband, and the remaining leverage is on behaviour and on the account rather than on the address.