- A 住宅为主：该模式 256 个候选 /24 里 ≥150 个属于住宅 ISP；B 住宅+商业混合：60–149 个；C 商业/机构为主：20–59 个；D 机房/机构为主：<20 个，或机房标记 ≥100 个。住宅 ISP = Comcast / Charter / Cox / Frontier / CenturyLink / Cablevision / Mediacom / Bell / TELUS 这类零售运营商。
- 红线：
hosting=true / proxy=true 直接判机房；Verizon Business / Level 3 / Cogent / NTT / AT&T Enterprises 这类商业中转 ASN 归 C/D —— 它们常常"代理·VPN·托管三否"，但风控视作代理段，"三否"不等于住宅 IP。
- 三层数据，各管一段：实测样本 = 53 组
o1.*.o3（13,568 个 /24）用 ip-api.com 逐个查过，最准，但只覆盖这些段；全球段表 = iptoasn 全量 IPv4 段表（53.9 万段，覆盖全部可路由地址）＋ PeeringDB ＋ bad-asn-list —— 任意 IP 都查得到，但只到 ASN 这一层，级别是上限；城市库 = DB-IP City Lite（CC BY 4.0），IP → 城市/国家，按 /8 懒加载。
- 标定库：大型混合 ASN（AT&T Enterprises / Verizon Business / Amazon / Level 3 / Cogent…）内部既有住宅池也有企业段，只按 ASN 判会虚高；工具用实测样本的 1 万多个 /24 反推每个 ASN 的住宅占比（
asn-calib.js）把它压下去。
- 排序：先级别、再得分、再住宅占比、再扫描时定位在洛杉矶都会区的 /24 数；行内候选段也是先 ★LA、再城市、再 IP。★LA = 实测样本里这一条被 ip-api 定位在洛杉矶都会区（扫描时的实测记录，不是你清单里写的城市）。
- 「判定」= 离线分级：只拉本站数据文件，不发任何请求。「联网核验」= 整行抽样：默认不点就不发，只做推荐行（A/B 级）前 12 行，每行按打码位置抽 3 个 IP 发给
ipwho.is / ip-api（整张清单不上传），抽到机房即整行改判 D；失败只标注，不动原来的级别。
- 「实测取证」= 单个 IP 的联网核查：在行详情里点它，只查这一行的代表 IP。五个来源各自独立、谁失败都不影响别人：
rdap.org（注册局注册记录）· DoH 反向解析 PTR · Team Cymru（DoH TXT 查 origin ASN）· stat.ripe.net RIPEstat（另一条 BGP 视图，与 Cymru 互相印证）· Shodan InternetDB（扫到的端口 / 漏洞 / 标签，404 = 没有记录）。查不到就写「未获取」，不填占位数字。
- 主要国家 / 主要城市：一整行可能有多个取值（打码位展开后 254/256 个），这两列给的是取值最多的那个。国家优先用城市库的 IP 定位国，城市片还没加载时退回全球段表的 ASN 注册国（登记在 A 国、实际用在 B 国很常见）。悬停写明用的是哪一个、占多少取值，其余落点在详情里列出来。清单里写的国家和城市一律不看，城市只作参考。
- 打码位怎么展开：第 2 段打码（
198.*.42.81）→ 枚举 198.0.42.81 … 198.255.42.81 共 256 个 /24；第 4 段打码（82.24.73.*）→ 枚举这个 /24 的 254 个可用主机地址（1–254），.0（网络地址）和 .255（广播地址）自动排除。排名按行：带 * 的模式整行参与排名，枚举出来的 IP 只是落点参考，不单独排。
- 城市片什么时候拉：整份清单用到的 /8 在判定这一趟里一次拉完（16 个一批），判定不等它 —— 结论先出来，城市片到位一片就把那个 /8 的两列补上。顶栏徽标的数字 = 已取片数 / 这份清单需要的片数，不是库里的 220 片。城市名一律用 DB-IP 原文（英文），不做本地化：译名表永远收不全，一翻就中英混排，宁可不翻。
- 报告里的颜色：绿 = 往住宅方向推（注册记录 / 接口 org 与段表运营商是同一家、实测 ASN 与离线一致）· 橙 = 移动、两路 BGP 打架或前后不一致 · 蓝灰 = 商业·机构 · 红 = 机房/代理、InternetDB 有已知漏洞 · 灰 = 没查到或中性事实（没命中不代表住宅 IP）。
- Tier A — mostly residential: ≥150 of the pattern's 256 candidate /24 blocks belong to retail ISPs; B — residential + business: 60–149; C — mostly business/institutional: 20–59; D — mostly datacenter/institutional: <20, or ≥100 datacenter flags. Retail ISP = carriers such as Comcast / Charter / Cox / Frontier / CenturyLink / Cablevision / Mediacom / Bell / TELUS.
- Red lines:
hosting=true or proxy=true means datacenter. Carrier-transit ASNs such as Verizon Business / Level 3 / Cogent / NTT / AT&T Enterprises are ranked C/D — they often show hosting, proxy and VPN all “false”, yet risk engines treat them as proxy blocks. “All false” does not make a residential IP.
- Three data layers: measured sample = 53
o1.*.o3 groups (13,568 /24 blocks) looked up one by one via ip-api.com — the most accurate, but it only covers those blocks; Global ASN table = the full iptoasn IPv4 table (539k segments, every routable address) plus PeeringDB and bad-asn-list — any IP resolves, but only down to the ASN, so the tier is an upper bound; City DB = DB-IP City Lite (CC BY 4.0), IP → city/country, lazily loaded per /8.
- Calibration: large mixed ASNs (AT&T Enterprises / Verizon Business / Amazon / Level 3 / Cogent…) hold both residential pools and enterprise blocks, so judging by the ASN alone inflates the score. The tool infers each ASN's residential share from the 10k+ measured-sample /24 blocks (
asn-calib.js).
- Sorting: tier, then score, then residential share, then how many /24 blocks ip-api located in the LA metro when it scanned; candidate blocks inside a row are ordered ★LA first, then city, then IP. ★LA = the measured sample located that record in the LA metro area (a scan record, not a city written in your list).
- “Judge” = offline tiering: it only loads this site's own data files and sends no requests. “Online check” = sampled per row: nothing is sent unless you press it; it covers the first 12 recommended (tier A/B) rows, sends 3 IPs per row (picked by the masked position) to
ipwho.is / ip-api — your whole list is never uploaded — and one datacenter hit flips the row to tier D. Failures are only annotated; the original tier stays.
- “Live lookup” = one IP, online: press it in a row's detail panel and only that row's representative IP is queried. Five independent sources — one failing never affects the others:
rdap.org (registry record) · DoH reverse DNS (PTR) · Team Cymru (origin ASN over DoH TXT) · stat.ripe.net RIPEstat (a second BGP view that cross-checks Cymru) · Shodan InternetDB (scanned ports / CVEs / tags; 404 means “no record”). Anything unavailable is written as “not fetched”, never a placeholder.
- Main country / Main city: a row can hold many values (254/256 after expanding the mask), and these two columns show the most common one. Country prefers the IP-location country from the City DB and falls back to the ASN registration country from the global ASN table while that /8's city slice is still loading (registered in country A, used in country B is common). The tooltip says which one was used and how many values it covers; the remaining landing points are listed in the detail panel. Countries and cities written in your list are ignored entirely, and the city is a hint only.
- How a masked octet expands: 2nd octet masked (
198.*.42.81) → 256 /24 blocks, 198.0.42.81 … 198.255.42.81; 4th octet masked (82.24.73.*) → the /24's 254 usable host addresses (1–254), with .0 (network) and .255 (broadcast) skipped. Ranking is per row: a masked pattern (*) is ranked as a whole, and the IPs it expands into are landing-point hints only.
- When city slices load: every /8 the list needs is fetched during the judging run (16 at a time), but judging does not wait — conclusions appear first and each slice fills in that /8's two columns as it arrives. The header badge counts slices loaded / slices this list needs, not the 220 slices in the database. City names are always shown exactly as DB-IP spells them (English) and never localized — a translation table is never complete, and one missing entry leaves a list mixing languages.
- Colours in the report: green = evidence pushing towards residential (registry record or API org matching the block's carrier, live ASN matching the offline table) · orange = mobile, two BGP views disagreeing, or an inconsistency · slate = business/institutional · red = datacenter/proxy, or known CVEs in InternetDB · grey = not found or a neutral fact (“no hit” does not mean residential).
纯静态站点 · 无后端 · 无追踪 · 粘贴内容不上传 · 数据包随仓库发布