How to Audit ASN and Prefix Concentration Before Buying a Proxy Pool

“Millions of IPs” is not a procurement result. It is a catalog claim whose denominator, observation window and geographic distribution may be unclear. A rotating residential proxy service can expose many unique addresses while most of your usable traffic still comes from a small number of autonomous systems, prefixes, cities or upstream sources.

Concentration is not automatically bad. A country may legitimately have a few dominant access providers, and a tightly scoped city test may be expected to use a small set of networks. The problem is unmeasured concentration: when a buyer assumes that IP count equals route diversity, or that two differently branded providers offer independent supply.

This guide builds an audit that answers four practical questions:

1. How many distinct exits did the workload actually observe?
2. How concentrated were those exits by ASN and analytical prefix bucket?
3. Did concentration change by region, target, time block or session mode?
4. How much did two candidate providers overlap?

What ASN, registration and routing data can prove

An Autonomous System Number identifies a routing domain, not a household and not a quality score. Registration Data Access Protocol data provides structured registration records for IP networks and ASNs. Routing data helps identify the origin network and, where available, routing authorization or path evidence.

Use those data sources to describe an address's network context. Do not claim that an ASN name alone proves that an exit is residential, ethically sourced, exclusive or clean. Consumer providers operate hosting services; business networks may use access-provider address space; mobile and carrier-grade NAT complicate one-address assumptions; registration records may lag operational changes.

Cloudflare's August 24, 2026 addition of ASPA path validation to Radar is a useful reminder that network identity and route integrity are different layers. ASPA checks whether an observed provider path is covered by published authorizations; it does not certify a proxy's sourcing or business practices.

Design the sample before collecting exits

A defensible comparison holds commercial and technical variables as constant as possible.

Define the decision unit

Write down the exact product and use case: rotating residential or static ISP, approved countries and cities, sticky-session duration, protocol, target category, expected monthly traffic and required concurrency. Never mix product types in one score.

Use blocked sampling

Create the same blocks for every provider:

Begin with low concurrency and bounded retries. Collect only the exits produced by normal authorized use; do not force rapid rotation to enumerate a provider's entire supply.

Capture an event-level record

For each request, store:

• provider and product label;
• anonymous test-run and session identifiers;
• requested region and observed exit IP;
• address family;
• request timestamp and latency;
• transport result and application outcome;
• observed ASN and registration prefix;
• analytical prefix bucket;
• consent or sourcing documentation version supplied by the vendor.

Keep credentials and target cookies out of the dataset. Hashing an IP is not the same as anonymizing it; limit raw-address access and retention.

Normalize without inventing precision

Normalize IPv4 and IPv6 text before grouping. Keep the authoritative registration prefix from RDAP as one field. If you also create fixed-size analytical buckets—such as an IPv4 /24 or an IPv6 /48—label them explicitly as analysis buckets, not ownership boundaries.

Resolve routing and registration context at collection time or preserve the lookup timestamp. Networks change. A lookup performed weeks later can describe a different operational state.

Separate these concepts:

• unique exit: a normalized IP observed at least once;
• ASN: the observed route-origin grouping used for concentration analysis;
• registration prefix: the network object returned by the registry;
• analysis bucket: a fixed grouping chosen for statistical comparison;
• provider claim: vendor metadata that has not yet been independently verified.

Calculate four complementary metrics

No single number describes pool quality. Report the following per provider, product, region and time block.

1. Unique-exit rate

unique exits / successful proxy sessions

This shows how much address reuse the sample experienced. It is sensitive to session rules and should never be compared across different sticky durations.

2. Largest-share concentration

Report the share of successful sessions from the largest ASN and largest analysis bucket. Averages hide dominant clusters; the top share exposes them.

3. Herfindahl concentration and effective groups

For group shares p, calculate HHI = sum(p²). Then report 1 / HHI as the effective number of equally sized groups. If ten ASNs are present but one carries most sessions, the effective count will be far below ten.

Do not apply a universal pass/fail threshold. Compare candidates inside the same region and workload, then set a threshold that reflects your continuity requirement.

4. Cross-provider overlap

Use Jaccard overlap for the observed ASN sets and analysis-bucket sets:

intersection size / union size

Also calculate traffic-weighted overlap. Two providers may share only a few ASNs, but those shared ASNs may carry most of both samples. High overlap does not prove a reseller relationship; it shows that the tested supplies may not provide independent network diversity.

Avoid five common false conclusions

“More unique IPs means a better pool.” Not if most successful traffic still depends on one ASN, target success is poor or the vendor cannot document sourcing.

“A consumer ISP ASN proves residential sourcing.” It describes network context, not consent, device type or commercial chain.

“One low-overlap sample proves independence.” Pool composition changes by time and geography. Repeat blocks and report uncertainty.

“Every repeated IP is a defect.” Sticky sessions intentionally repeat exits. Measure rotation and stickiness against their separate promises.

“Route validation proves proxy quality.” Routing authorization can reveal route-integrity issues, but it does not measure latency, target success, session stability or ethical sourcing.

Turn the audit into acceptance criteria

Build a scorecard with raw values and decisions, not a decorative total score.

Require vendors to explain material discrepancies. A useful explanation identifies product, region, observation window and expected pool behavior. A raw global IP count is not an explanation.

Procurement checklist

• The compared products, regions and session modes are identical.
• Sampling covers multiple time blocks and at least two days.
• Concurrency, pacing, request count and target class are controlled.
• Exit IPs are normalized and raw access is restricted.
• RDAP registration data and routing context have lookup timestamps.
• Registration prefix and fixed analysis bucket are stored separately.
• Unique-exit rate, top shares, HHI and effective groups are reported.
• ASN and prefix overlap are calculated for primary and backup vendors.
• Results are segmented by region instead of using only global totals.
• Sourcing, consent, replacement and incident processes are reviewed.
• Cost includes unsuccessful requests, retries and operational overhead.
• The pilot has written stop conditions and does not attempt to evade target controls.

Pair this audit with 98IP's guides to run a statistically defensible proxy pilot, test session stickiness, and detect route leaks.

FAQ

How many exits should we sample?

Enough to make the decision inside each critical region and time block. A global sample of thousands can still be useless if a required small market has only a handful of observations. Start with a pilot, review uncertainty, and expand only where the decision remains unclear.

Is ASN diversity the same as geographic diversity?

No. One ASN can span many regions, and one city can contain several ASNs. Measure requested geography, observed geography and ASN separately.

Should IPv6 addresses be counted individually?

Report unique addresses, but also group them using clearly labeled prefixes or analysis buckets. Large IPv6 address space can make raw uniqueness misleading.

Can this audit identify a reseller?

It can identify observed overlap and concentration, not contractual relationships. Treat reseller status as a vendor due-diligence question requiring documentation.

Compliance note

Run this audit only through accounts, endpoints and targets you own or are authorized to test. Respect vendor terms, target rules, rate limits, privacy obligations and applicable law. Minimize IP-address retention, protect event-level data, and verify that residential supply is based on informed consent. Do not use diversity metrics to evade access controls or conceal prohibited activity.

Source note: ARIN, “Whois/Registration Data Access Protocol (RDAP)”; Cloudflare, “RPKI ASPA path validation on Cloudflare Radar,” published August 24, 2026. Source URLs are retained only in 98IP's internal operations record under the website's zero-external-link policy.