Types of IP addresses: every kind, and which show up in attacks

The main types of IP addresses are public and private, static and dynamic, and IPv4 and IPv6. By who uses them, addresses sit on home lines, mobile networks, business networks, data centers, or anonymizers such as Tor. Server addresses appear on FFraud's list of attackers three times as often as average, and nearly every Tor exit does.

We measured that on November 12, 2026, from the reverse DNS names of 70,000 addresses: 20,000 drawn from FFraud's public list of confirmed attackers and 50,000 drawn at random from all public IPv4 space.

#What are the types of IP addresses?

IP addresses fall into types along six lines. Five come from the standards that run the internet. The sixth, who uses an address, is the one an IP fraud check reports.

#What is the difference between public and private IP addresses?

A public address is one the internet can reach, and it comes from an internet provider. IANA describes the chain: users get their addresses from providers, providers get blocks from registries, and the five regional registries get theirs from IANA.

A private address works only inside a local network. RFC 1918 reserves three blocks for it: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Shared space sits in between. RFC 6598 set aside 100.64.0.0/10 because "IPv4 address space is nearly exhausted", so providers could put customers behind carrier-grade NAT. Our guides to private IP address ranges and CGNAT cover both in depth.

Counted from IANA's registries on November 12, 2026, 86.2 percent of all 4,294,967,296 IPv4 addresses can be public:

Multicast and the block set aside for future use take one eighth of the space between them. The private, loopback, shared and other special blocks add only 1.3 percent.

#Static or dynamic: how is an address assigned?

DHCP, the protocol that hands out addresses, works in three ways according to RFC 2131. In "dynamic allocation", DHCP "assigns an IP address to a client for a limited period of time", so the address can change. In "manual allocation", the address "is assigned by the network administrator", which is what people call a static address.

Many networks write the kind into an address's reverse DNS name. Of the 50,000 random public addresses we looked up, 15,942 had a name. Among those, 14.2 percent said dynamic, with words such as dyn, dhcp or pool, and 8.4 percent said static or fixed. That is 1.7 dynamic names for every static one. Our guide to static vs dynamic IP shows how to check your own.

#What is the difference between IPv4 and IPv6?

IANA counts two versions in active use. IPv4 was first deployed on January 1, 1983, and is "still the most commonly used version". Its addresses are 32-bit numbers, written like 192.0.2.53. IPv6 deployment began in 1999, and RFC 8200 says it "increases the IP address size from 32 bits to 128 bits".

FFraud's own list is still mostly IPv4. The copy of November 3, 2026, holds 1,624,698 IPv4 and 26,805 IPv6 addresses, so 98.4 percent are IPv4.

#What are unicast, multicast, anycast and broadcast addresses?

These types describe how many machines one packet reaches:

• Unicast is "an identifier for a single interface", in the words of RFC 4291: one sender, one receiver.
• Multicast reaches a "host group", as RFC 1112 calls it. In IPv4, group addresses run from 224.0.0.0 to 239.255.255.255.
• Anycast puts one address in several places. RFC 4786 describes a service address made "available in multiple, discrete, autonomous locations", and its example is an address of DNS servers.
• Broadcast reaches every machine on the local network. RFC 919 defines 255.255.255.255 as "a broadcast on a local hardware network, which must not be forwarded". IPv6 has none: "There are no broadcast addresses in IPv6", says RFC 4291.

Classes A to E are an older way to sort IPv4. RFC 791 split addresses into classes in 1981, and CIDR replaced them. Since then, RFC 4632 notes, "it is not possible to infer the network mask from the initial bit pattern of an IPv4 address".

#What are residential, mobile, business and data center IP addresses?

These types follow the network an address belongs to. FFraud's IP check reports them in a field called connection_type, with values such as Residential, Mobile, Data Center and Relay.

• Residential: a home internet line from a cable, DSL or fiber provider. In our census, 10.3 percent of named public addresses carried a home line word such as dsl, cable or fiber.
• Mobile: a phone carrier's address. FFraud's check marks these as shared, because carriers put many phones behind one address.
• Business, education and government: addresses on networks that companies, schools and public bodies run for themselves.
• Data center: a server at a hosting or cloud company. AWS "publishes its current IP address ranges in JSON format" so that anyone can "identify traffic from AWS", and Google Cloud publishes its own list.

Our guide to ASNs explains how a network is named and numbered.

#What are VPN, proxy, Tor and relay addresses?

These addresses stand in for someone else's. With Tor, sites "will see the IP address of the exit relay instead of the real IP address of the Tor user", the Tor Project explains. It publishes the exits too: 1,259 addresses on November 12, 2026.

Apple's iCloud Private Relay swaps a user's address for "one assigned from the range of IP addresses used by the service". That address "may be shared among more than one Private Relay user in the same area", so Apple asks sites to treat its addresses "like larger carrier-grade NAT or enterprise IP addresses".

FFraud's check answered a server address from one VPN provider's own list as a VPN on a data center network. Proxies also reach into homes: the FBI warned in June 2025 that infected devices on home networks become part of "residential proxy services" that are "known to be used for malicious activity".

Our guides cover Tor exit nodes, proxy detection and Apple's relay addresses.

#Which types of IP addresses show up in attacks?

Addresses whose reverse DNS name says server or cloud appear on FFraud's list of confirmed attackers 14.0 times per 10,000. That is about three times the rate for the average public address. Names that point to a home line, a mobile network, or a static or dynamic assignment sit at or below the average of 4.4.

1. Server or cloud14.0
2. Other name5.0
3. All addresses4.4
4. Says dynamic4.1
5. No name3.9
6. Home line3.7
7. Says static3.4
8. Mobile network2.2

Source: FFraud list (copy of November 3, 2026) and reverse DNS of 70,000 addresses, November 12, 2026

Most server names follow the default formats of two large clouds, and those two clouds' rates differed more than tenfold, so judge a cloud address by its network. Generic server words alone, such as vps or hosting, still ran at 15.4 per 10,000.

One network gives all of its addresses the same generic name with the word adsl in it, and many of them are listed. Without that network, home line names ran at 2.4 per 10,000.

Tor exits stand far above every group. Of the 1,259 exits on the Tor Project's list on November 12, 1,216 were on FFraud's list built on November 3. That is 96.6 percent, about 2,200 times the average.

FFraud's free IP check sorts the same types and scores each one by what it hides. We asked it about one address of each type on November 12, 2026:

The scores follow FFraud's published rules. Shared connections get a ceiling, because "one bad user among thousands should not condemn the whole gateway", and Tor exits carry a high floor. The methodology explains the bands, from none (0 to 10) to critical (86 to 100).

• Judge a data center address by its network. The two largest clouds in our sample differed more than tenfold.
• Do not block a home or mobile address for its type alone. Those names showed up on the list less often than average.
• Treat relay, mobile and carrier NAT addresses as shared, as Apple asks for its relay. A block there hits everyone behind the address.
• Decide on Tor on purpose. Nearly every exit is on FFraud's list.

#How can you tell what type an IP address is?

1. Check the reach. An address in 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 or 100.64.0.0/10 is private or shared, and the internet cannot reach it.
2. Read its reverse DNS name with dig -x 192.0.2.1, or in the free reverse DNS lookup. RFC 1912 asks that every address have "a matching PTR record", and many networks write the type into that name.
3. Confirm the name. Google tells sites to check that a crawler's name ends in googlebot.com, google.com or googleusercontent.com, then to look that name up again.
4. Compare it with the operators' own lists. AWS, Google, the Tor Project and Apple all publish theirs.
5. Or ask a lookup. FFraud's free IP lookup returns the connection type, the VPN, proxy, Tor and relay flags and a fraud score in one call. The proxy and VPN check tests one address for a proxy, VPN, Tor exit or data center, and What is my IP shows the same for your own connection.

Most names say nothing about the type. Of the 15,942 named addresses in our random sample, 55.6 percent carried none of the words we looked for. The rest said:

1. Says dynamic14.2%
2. Home line10.3%
3. Server or cloud10.1%
4. Says static8.4%
5. Mobile network1.4%

Source: FFraud reverse DNS census, November 12, 2026

#How we measured

We used FFraud's public list of confirmed abusive IPs, the copy built on November 3, 2026, at 21:30 UTC. It holds 1,651,503 addresses, each confirmed at least twice, and it is free under the MIT license on the open data page.

We drew 20,000 of its 1,624,698 IPv4 addresses at random, and 50,000 random addresses from all public IPv4 space. Public means outside the blocks IANA marks as not reachable, outside multicast and outside the block for future use.

On November 12, 2026, between 18:38 and 18:47 UTC, we looked up the reverse DNS name of all 70,000 addresses through the public resolvers 1.1.1.1, 8.8.8.8 and 9.9.9.9. Of the listed addresses, 7,923 had a name, and of the random ones, 15,942.

Each name went to the first group whose words it contains, in this order:

1. Server or cloud: server servers srv vps vds dedicated dedi hosting hosted cloud compute colo colocation, and the default names of AWS (compute.amazonaws.com) and Google Cloud (bc.googleusercontent.com).
2. Mobile network: mobile mob lte 3g 4g 5g gprs umts cellular.
3. Says dynamic: dynamic dynamicip dyn dynip dhcp pool dial dialup ppp pppoe.
4. Says static: static staticip fixed.
5. Home line: dsl adsl vdsl xdsl cable catv fiber fibre ftth fttx fttb fttp broadband bredband cpe res residential home.

A word counts only when it stands between dots or hyphens, with digits allowed after it. The brand name t-mobile does not count as a mobile word, because that carrier's names also cover home fiber lines.

A group's rate is its share among listed addresses times 1,624,698, divided by its share among random addresses times the 3,702,258,689 public IPv4 addresses. With 95 percent confidence, the server rate lies between 13.1 and 14.9 per 10,000. The mobile rate rests on only 46 listed names, so its range is wider: 1.6 to 3.0.

For Tor, we read the Tor Project's exit list on November 12, 2026, at 18:31 UTC and matched it against the same copy of FFraud's list. For the table, we asked FFraud's public IP check without a key at 18:51 UTC.

The addresses were 192.168.1.1, 100.64.0.1, 52.54.55.66 (the example in AWS's documentation), 66.249.66.1 (Google's crawler list), 172.224.226.1 (Apple's relay list) and the Tor exit 171.25.193.25. A server came from one VPN provider's own list, and a home and a mobile address from our random sample.

A reverse DNS name says whatever its network chose to write, so the groups describe names. FFraud's list holds what FFraud's monitoring caught by November 3, and another list would give other rates. Every number holds for the dates above.

#Questions people ask