On this page
Ask a VPN company and the answer is no. Surfshark's explainer says a regular VPN "typically assigns you an IP (Internet Protocol) address from a commercially owned server", and Private Internet Access's says it "gets its IP addresses from data centers". Both describe a residential VPN as a separate kind of product. But sites that block datacenter traffic give a VPN every reason to look residential, and residential proxy networks sell exactly the addresses those blocks let through. When we checked VPN exits against hosting ranges for an earlier post, 14.7% were in none.
So we took the 1,197,178 IPv4 addresses our VPN IP database had as commercial VPN exits on 2026-10-07 and looked each one up in the 90-day list of our Residential Proxy IP database from the same day. 155,039 were in both: 13.0%.
Most of it is one brand
| VPN brand | Exits | Also in Residential Proxy IP | Share |
|---|---|---|---|
| NordVPN | 152,679 | 66,904 | 43.8% |
| VPN Gate | 24,673 | 20,507 | 83.1% |
| Private Internet Access | 75,044 | 7,306 | 9.7% |
| Proton VPN | 53,572 | 6,192 | 11.6% |
| CyberGhost | 114,276 | 5,854 | 5.1% |
| IPVanish | 17,862 | 4,602 | 25.8% |
| Surfshark | 24,006 | 4,359 | 18.2% |
| Windscribe | 71,851 | 4,001 | 5.6% |
| FastVPN | 13,195 | 3,199 | 24.2% |
| Cloudflare WARP | 16,344 | 3,112 | 19.0% |
| ExpressVPN | 24,841 | 3,025 | 12.2% |
| Mullvad | 68,091 | 2,711 | 4.0% |
NordVPN has 43.2% of all the shared exits, and its share holds whatever the evidence behind an address. In VPN IP Extended, 42.4% of its exits with scan evidence, addresses that answered as a VPN server themselves, are shared, against 48.2% of those it has by infer.
VPN Gate is peer-based: its servers run on volunteers' own connections, so most of its exits are residential by design, on the same kind of connection proxy networks run on.
Past those two, the share drops fast. Of the 23 brands with 10,000 or more exits, 15 have under 10% of them shared, and three are close to none: Njalla at 0.1%, VyprVPN and SaferVPN at 0.3%.
Fewer than in June
| Databases as of | VPN addresses also in Residential Proxy IP | NordVPN's |
|---|---|---|
| 2026-06-01 | 210,070 | 85,534 |
| 2026-07-01 | 214,038 | 85,812 |
| 2026-08-01 | 187,935 | 82,144 |
| 2026-09-01 | 193,350 | 93,729 |
| 2026-10-01 | 160,031 | 71,959 |
| 2026-10-07 | 156,229 | 67,007 |
This table counts every address VPN IP attributed at high confidence, including the ones that only take connections in, which the earlier lists don't tell apart; on October 7 that's 1,190 more than the exits above. Over the same months VPN IP's attributed addresses went from 955,480 to 1,311,943, so as a share the shared ones went from 22.0% to 11.9%.
Most of the fall came in four days. Between July 1 and July 5, the number of VPN addresses residential proxy networks showed each day halved, and it has stayed near that level since. An address stays in the 90-day list for 90 days after it was last seen, so the monthly counts trail the change.
The theory, by country
The theory behind the question is that VPNs buy residential exits to reach countries where they have few servers of their own. If they did, a brand's shared exits would sit in its thinnest countries. They don't.
With countries from our IP Geolocation database on the same day, the 21 brands with 10,000 or more exits, NordVPN and VPN Gate aside, share 54,384 exits with residential proxy networks. 2,371 of those are in a country where most of that brand's exits are shared, and 10 of the 21 brands have no such country.
NordVPN runs the other way. Its shared exits sit in its biggest markets, and the US, the UK and Canada hold 63.2% of them:
| Country | NordVPN exits | Shared | Share |
|---|---|---|---|
| United States | 49,297 | 27,217 | 55.2% |
| United Kingdom | 15,388 | 9,817 | 63.8% |
| France | 9,316 | 2,965 | 31.8% |
| Canada | 8,848 | 5,275 | 59.6% |
| Germany | 8,494 | 2,799 | 33.0% |
| Netherlands | 5,412 | 1,430 | 26.4% |
| Japan | 4,306 | 751 | 17.4% |
| Sweden | 3,090 | 517 | 16.7% |
What the data can't tell
An address in both databases carries both kinds of traffic. It doesn't say who runs it. Three setups look the same from outside: a VPN buying exits from a residential proxy network, a proxy network sending some of its traffic out through VPN servers, and the two renting addresses from the same ISPs. The countries argue against the first as a way to fill in a map; nothing in the data tells the three apart address by address.
What it means for detection
Neither database stands in for the other. Even the 90-day residential list misses 87.0% of VPN exits, and a VPN list misses the residential proxy traffic that never touches a VPN. The residential window you check matters too. Of the 1,197,178 exits:
An address in both is anonymized traffic whichever setup is behind it, and VPN IP's provider names the brand. VPN Provider flags VPN Gate and the rest of the peer-based kind p2p_infrastructure, so a residential match there is expected.
How we measured
The VPN side is every IPv4 address our VPN IP database attributed to a named commercial VPN at its highest confidence tier on 2026-10-07, 1,311,943, less the ones that only take connections in rather than send traffic out: 1,197,178 exits. Business VPN services are left out, as they are from the VPN IP v1 export. The residential side is Residential Proxy IP's lists from the same day, and each earlier month compares the two databases as built on the 1st. Our August report gave this overlap as 6.1%, a share of every address VPN IP attributes at any confidence; here it's a share of high-confidence exits.
To license the databases, see pricing or talk to us.
