- A 住宅为主：该模式 256 个候选网段里 ≥150 个属于住宅 ISP；B 住宅+商业混合：60–149 个；C 商业/机构为主：20–59 个；D 机房/机构为主：<20 个，或机房标记 ≥100 个。住宅 ISP = Comcast / Charter / Cox / Frontier / CenturyLink / Cablevision / Mediacom / Bell / TELUS 这类零售运营商。
- 红线：
hosting=true / proxy=true 直接判机房；Verizon Business / Level 3 / Cogent / NTT / AT&T Enterprises 这类商业中转 ASN 归 C/D —— 它们常常"代理·VPN·托管三否"，但风控视作代理段，"三否"不等于住宅 IP。
- 三层数据，各管一段：实测记录 = 53 组
o1.*.o3（13,568 个网段）用 ip-api.com 逐个查过，最准，但只覆盖这些段；IP 归属表 = iptoasn 的全球归属数据（53.9 万条，网上在用的 IP 全收录）＋ PeeringDB ＋ bad-asn-list —— 任何 IP 都查得到，但只到 ASN（运营商）这一层，级别是上限；城市数据 = DB-IP City Lite（CC BY 4.0），IP → 城市 / 国家，按 IP 第一段分片加载。
- 标定库：大型混合 ASN（AT&T Enterprises / Verizon Business / Amazon / Level 3 / Cogent…）内部既有住宅池也有企业段，只按 ASN 判会虚高；工具用实测记录的 1 万多个网段反推每个 ASN 的住宅占比（
asn-calib.js）把它压下去。
- 排序：先级别、再得分、再住宅占比、再扫描时定位在洛杉矶都会区的网段数；行内候选段也是先 ★LA、再城市、再 IP。★LA = 实测记录里这一条被 ip-api 定位在洛杉矶都会区（扫描时的实测记录，不是你清单里写的城市）。
- 「判定」= 离线分级：只拉本站数据文件，不发任何请求。「联网核验」= 整行抽样：默认不点就不发，只做推荐行（A/B 级）前 12 行，每行按打码位置抽 3 个 IP 发给
ipwho.is / ip-api（整张清单不上传），抽到机房即整行改判 D；失败只标注，不动原来的级别。
- 「实测取证」= 单个 IP 的联网核查：在行详情里点它，只查这一行的代表 IP。五个来源各自独立、谁失败都不影响别人：
rdap.org（注册局注册记录）· DoH 反向解析 PTR · Team Cymru（DoH TXT 查 origin ASN）· stat.ripe.net RIPEstat（另一条 BGP 视图，与 Cymru 互相印证）· Shodan InternetDB（扫到的端口 / 漏洞 / 标签，404 = 没有记录）。查不到就写「未获取」，不填占位数字。
- 主要国家 / 主要城市：一整行可能有多个取值（打码位展开后 254/256 个），这两列给的是取值最多的那个。国家优先用城市数据的 IP 定位国，城市数据还没加载时退回 IP 归属表的 ASN 注册国（登记在 A 国、实际用在 B 国很常见）。悬停写明用的是哪一个、占多少取值，其余落点在详情里列出来。清单里写的国家和城市一律不看，城市只作参考。
- 打码位怎么展开：第 2 段打码（
198.*.42.81）→ 枚举 198.0.42.81 … 198.255.42.81 共 256 个网段；第 4 段打码（82.24.73.*）→ 枚举这个网段的 254 个可用主机地址（1–254），.0（网络地址）和 .255（广播地址）自动排除。排名按行：带 * 的模式整行参与排名，枚举出来的 IP 只是落点参考，不单独排。
- 城市数据什么时候拉：整份清单用到的 IP 第一段在判定这一趟里一次拉完（16 份一批），判定不等它 —— 结论先出来，城市数据到一份就把那一段的两列补上。取数据的进度写在结果区上方：已取到的份数 / 这份清单需要的份数，不是库里的 220 份。城市名一律用 DB-IP 原文（英文），不做本地化：译名表永远收不全，一翻就中英混排，宁可不翻。
- 报告里的颜色：绿 = 往住宅方向推（注册记录 / 接口 org 与归属表里的运营商是同一家、实测 ASN 与离线一致）· 橙 = 移动、两路 BGP 打架或前后不一致 · 蓝灰 = 商业·机构 · 红 = 机房/代理、InternetDB 有已知漏洞 · 灰 = 没查到或中性事实（没命中不代表住宅 IP）。
- Tier A — mostly residential: ≥150 of the pattern's 256 candidate /24 blocks belong to retail ISPs; B — residential + business: 60–149; C — mostly business/institutional: 20–59; D — mostly datacenter/institutional: <20, or ≥100 datacenter flags. Retail ISP = carriers such as Comcast / Charter / Cox / Frontier / CenturyLink / Cablevision / Mediacom / Bell / TELUS.
- Red lines:
hosting=true or proxy=true means datacenter. Carrier-transit ASNs such as Verizon Business / Level 3 / Cogent / NTT / AT&T Enterprises are ranked C/D — they often show hosting, proxy and VPN all “false”, yet risk engines treat them as proxy blocks. “All false” does not make a residential IP.
- Three data layers: measured records = 53
o1.*.o3 groups (13,568 /24 blocks) looked up one by one via ip-api.com — the most accurate, but it only covers those blocks; IP owner table = iptoasn's worldwide ownership data (539k entries, every in-use IP) plus PeeringDB and bad-asn-list — any IP resolves, but only down to the ASN, so the tier is an upper bound; city data = DB-IP City Lite (CC BY 4.0), IP → city/country, loaded per first octet.
- Calibration: large mixed ASNs (AT&T Enterprises / Verizon Business / Amazon / Level 3 / Cogent…) hold both residential pools and enterprise blocks, so judging by the ASN alone inflates the score. The tool infers each ASN's residential share from the 10k+ measured /24 blocks (
asn-calib.js).
- Sorting: tier, then score, then residential share, then how many /24 blocks ip-api located in the LA metro when it scanned; candidate blocks inside a row are ordered ★LA first, then city, then IP. ★LA = the measured records located that record in the LA metro area (a scan record, not a city written in your list).
- “Judge” = offline tiering: it only loads this site's own data files and sends no requests. “Online check” = sampled per row: nothing is sent unless you press it; it covers the first 12 recommended (tier A/B) rows, sends 3 IPs per row (picked by the masked position) to
ipwho.is / ip-api — your whole list is never uploaded — and one datacenter hit flips the row to tier D. Failures are only annotated; the original tier stays.
- “Live lookup” = one IP, online: press it in a row's detail panel and only that row's representative IP is queried. Five independent sources — one failing never affects the others:
rdap.org (registry record) · DoH reverse DNS (PTR) · Team Cymru (origin ASN over DoH TXT) · stat.ripe.net RIPEstat (a second BGP view that cross-checks Cymru) · Shodan InternetDB (scanned ports / CVEs / tags; 404 means “no record”). Anything unavailable is written as “not fetched”, never a placeholder.
- Main country / Main city: a row can hold many values (254/256 after expanding the mask), and these two columns show the most common one. Country prefers the IP-location country from the city data and falls back to the ASN registration country from the IP owner table while that block's city data is still loading (registered in country A, used in country B is common). The tooltip says which one was used and how many values it covers; the remaining landing points are listed in the detail panel. Countries and cities written in your list are ignored entirely, and the city is a hint only.
- How a masked octet expands: 2nd octet masked (
198.*.42.81) → 256 /24 blocks, 198.0.42.81 … 198.255.42.81; 4th octet masked (82.24.73.*) → the /24's 254 usable host addresses (1–254), with .0 (network) and .255 (broadcast) skipped. Ranking is per row: a masked pattern (*) is ranked as a whole, and the IPs it expands into are landing-point hints only.
- When city data loads: every first octet the list needs is fetched during the judging run (16 at a time), but judging does not wait — conclusions appear first and each file fills in that block's two columns as it arrives. Progress is shown above the results: files loaded / files this list needs, not the 220 files in the database. City names are always shown exactly as DB-IP spells them (English) and never localized — a translation table is never complete, and one missing entry leaves a list mixing languages.
- Colours in the report: green = evidence pushing towards residential (registry record or API org matching the carrier in the owner table, live ASN matching the offline data) · orange = mobile, two BGP views disagreeing, or an inconsistency · slate = business/institutional · red = datacenter/proxy, or known CVEs in InternetDB · grey = not found or a neutral fact (“no hit” does not mean residential).
纯静态站点 · 无后端 · 无追踪 · 粘贴内容不上传 · 数据包随仓库发布