Shared vs Dedicated ISP Proxies: Differences, Risks and a Free Audit Script

Shared vs dedicated ISP proxies comes down to one question: who else is sending traffic from your IP? A shared ISP proxy is a static IP that the provider sells to several customers at the same time, so you inherit whatever they do with it. A dedicated ISP proxy (also called a private ISP proxy) is assigned to one customer only for as long as they hold it, so nobody else sends traffic from it while it is yours. Shared IPs are cheaper per IP; dedicated IPs are the safer default for logins, long sessions and anything where a block costs you money. Every CleanProxies ISP proxy is 100% dedicated, never shared, as low as $0.75/IP on volume plans.

This guide explains how each model works, what "semi-dedicated" really means, what the providers themselves publish about sharing, and gives you a tested Python script that checks the things you can see from the outside: whether the exit IP stays the same, which network (ASN) it belongs to, whether it is on three public blocklists and whether two of your "different" proxies come out of the same IP.

TL;DR

• Shared = one IP, several customers at once. Cheapest per IP, but the IP's reputation is pooled: one co-user's spam, scraping burst or abuse report hits you too.

• Semi-dedicated = shared, with a small published cap on how many customers get the same IP. Still shared.

• Dedicated (private) = one IP, one customer for the length of the plan. No co-users means no one else's traffic adds to the IP's history, eats its rate-limit budget on a site or competes for it while you hold it.

• You cannot prove exclusivity from the outside. The provider's written terms are the guarantee. What you can check yourself: stable exit IPs, the ASN, blocklist status at delivery, and no duplicate IPs across your list. Our free script below runs those checks in one go.

• CleanProxies wins this one by design: every ISP IP is dedicated to one customer, on Tier-1 US carrier ASNs, with a 0 fraud score, unlimited bandwidth and threads, as low as $0.75/IP. Test it with the $4.99 trial.

Shared vs dedicated at a glance: what providers publish

Labels are not standards. "Static" does not mean dedicated, and on at least one big provider "private" does not mean one customer either. Here is what each provider's own pages said about sharing on 30 October 2026:

Two things stand out. First, the word "private" can still mean shared, so ask how many customers sit on each IP, not what the plan is called. Second, providers that sell both models usually charge a heavy premium for exclusivity: at the largest published tiers, Oxylabs lists $2.2/IP for Dedicated ISP against $1.1/IP for its shared ISP product (dedicated, shared). CleanProxies sells only dedicated ISP IPs, from $0.75/IP.

How shared, semi-dedicated and dedicated ISP proxies work

An ISP proxy is a static IP address registered to an internet provider (an ISP's ASN) but hosted on a server in a data center. That combination is what makes ISP proxies useful: websites see a consumer-network IP, while you get data-center speed and an IP that does not change. (If you are new to the category, start with what a static residential proxy is.)

What changes between the three models is not the IP type. It is how many customers the provider assigns to each IP:

Why sharing matters: reputation is per IP

Websites, CDNs and anti-abuse systems keep score per IP address. Rate limits, CAPTCHA thresholds and blocklists are applied to the address, not to the customer behind it. On a shared IP that has three practical effects:

1. Inherited blocks. If a co-user sends spam or hammers a site, the IP gets listed or rate-limited, and your next request fails even though you did nothing wrong.

2. A smaller request budget. If a site lets one IP make N requests a minute, every customer on that IP draws from the same N, so your share shrinks with each co-user.

3. Linked accounts. Platforms that tie accounts to IPs see your account next to strangers' accounts on the same address. That is the opposite of what you want for account management.

What dedicated does not change: an IP can carry history from before you got it (which is why you check it at delivery), servers and network links are still shared infrastructure, and some sites block whole ranges or /24 blocks regardless of who holds each IP. Dedicated removes the co-user risk; it does not make an IP immune to everything.

A simple model shows how quickly co-user risk grows. Assume every customer on an IP is independent and has the same 5% chance in a month of getting it flagged on a given site. The chance someone gets it flagged is 1 − 0.95ⁿ, where n is the number of customers on it:

This is an illustration, not a measurement: real users are neither independent nor equally risky, and the real p depends on the site and on what the other customers do, which is exactly the part you cannot see on a shared plan. The point is the shape of the curve: every extra co-user adds risk you cannot control.

Key stats: why IP reputation is under pressure

• Automated traffic is now the majority of the web. Imperva's 2025 Bad Bot Report found automated traffic made up 51% of all web traffic in 2024, and malicious bots 37% (up from 32%) (Imperva). Sites respond by scoring IPs harder, which makes the history of the IP you use matter more.

• Consumer IP ranges are on policy lists by default. The Spamhaus Policy Block List passed one billion listed IP addresses in 2014 (Spamhaus). The PBL marks end-user ranges that should not send email directly, so a PBL entry on an ISP IP is normal and is not a spam verdict. Look at spam and abuse lists, not policy lists, when you judge an IP.

• Semi-dedicated has a common ceiling. Three of the providers above publish the same cap: up to 3 customers per IP.

How to tell if your proxy is shared: what you can and cannot check

No outside test can prove that nobody else is using an IP. The provider's terms are the only real guarantee, so read them first. What you can check from the outside are symptoms. None of them proves sharing on its own, but together they tell you whether the IPs you got match what you paid for:

A tested Python script that audits your proxy list

The script below needs only the Python 3.8+ standard library. For each proxy it makes several requests through it, records every exit IP and the latency, looks up the ASN with Team Cymru's public IP-to-ASN service, checks three public DNS blocklists (reporting listed, not listed or unknown, so a DNS failure is never shown as clean) and flags any exit IP that appears behind more than one of your proxies. It ignores NO_PROXY, so no request can silently skip the proxy, and it reports how many requests succeeded, so one lucky request is not shown as a pass.

#!/usr/bin/env python3
"""Shared-IP audit for static/ISP proxies. Standard library only (Python 3.8+).

usage: python3 audit.py proxies.txt [--rounds 5]
proxies.txt: one proxy per line, host:port:user:pass or http://user:pass@host:port
"""
import argparse, ipaddress, json, os, socket, statistics, sys, time, urllib.request
from urllib.parse import quote

IP_ECHO = "https://api.ipify.org?format=json"
DNSBLS = ["bl.spamcop.net", "b.barracudacentral.org", "dnsbl-1.uceprotect.net"]


def to_url(line):
    if "://" in line:
        return line
    host, port, user, pw = line.split(":", 3)
    return f"http://{quote(user, safe='')}:{quote(pw, safe='')}@{host}:{port}"


def exit_ip(proxy_url, timeout=15):
    opener = urllib.request.build_opener(
        urllib.request.ProxyHandler({"http": proxy_url, "https": proxy_url}))
    t0 = time.perf_counter()
    with opener.open(IP_ECHO, timeout=timeout) as r:
        ip = json.load(r)["ip"]
    return ip, (time.perf_counter() - t0) * 1000


def asn_of(ip):
    """Team Cymru whois -> 'AS<n> <name>' or 'ASN unknown'."""
    try:
        with socket.create_connection(("whois.cymru.com", 43), timeout=10) as s:
            s.sendall(f" -v {ip}\r\n".encode())
            data = b""
            while True:
                chunk = s.recv(4096)
                if not chunk:
                    break
                data += chunk
        row = data.decode().strip().splitlines()[-1].split("|")
        return f"AS{row[0].strip()} {row[-1].strip()}"
    except (OSError, IndexError) as e:
        return f"ASN unknown ({type(e).__name__})"


def dnsbl_status(ip):
    """Per list: 'listed', 'not listed' or 'unknown' (lookup failed)."""
    if ipaddress.ip_address(ip).version != 4:
        return {zone: "unknown (IPv6 not checked)" for zone in DNSBLS}
    rev = ".".join(reversed(ip.split(".")))
    out = {}
    for zone in DNSBLS:
        try:
            ans = socket.gethostbyname(f"{rev}.{zone}")
            # Real listings answer 127.0.0.2-127.0.0.255; anything else is an
            # error code (e.g. refused resolver), so don't call it a listing.
            out[zone] = "listed" if ans.startswith("127.0.0.") and ans != "127.0.0.1" else f"unknown ({ans})"
        except socket.gaierror as e:
            out[zone] = "not listed" if e.errno == socket.EAI_NONAME else "unknown (DNS error)"
    return out


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("file")
    ap.add_argument("--rounds", type=int, default=5)
    a = ap.parse_args()
    if a.rounds < 1:
        ap.error("--rounds must be 1 or more")
    # urllib skips the proxy for hosts matched by NO_PROXY; clear it so every
    # request really goes through the proxy under test.
    for var in ("NO_PROXY", "no_proxy"):
        os.environ.pop(var, None)
    seen = {}
    for raw in open(a.file):
        line = raw.strip()
        if not line or line.startswith("#"):
            continue
        try:
            url = to_url(line)
        except ValueError:
            print(f"skipped malformed line: {line[:40]}")
            continue
        label = url.rsplit("@", 1)[-1]
        ips, ms, errors = set(), [], 0
        for _ in range(a.rounds):
            try:
                ip, t = exit_ip(url)
                ips.add(ip); ms.append(t)
            except Exception as e:
                errors += 1
                print(f"{label}: error {type(e).__name__}: {e}")
                if "407" in str(e):
                    break  # wrong credentials or IP not whitelisted: retrying won't help
        if not ips:
            continue
        for ip in ips:
            seen.setdefault(ip, set()).add(label)
        listed = {}
        for ip in sorted(ips):
            for zone, status in dnsbl_status(ip).items():
                if status != "not listed":
                    listed[f"{ip}@{zone}"] = status
        stable = len(ips) == 1
        ok = stable and not listed and errors == 0
        print(f"{label}: {len(ms)}/{a.rounds} ok | exit {', '.join(sorted(ips))} | "
              f"{asn_of(sorted(ips)[0])} | median {statistics.median(ms):.0f} ms | "
              f"dnsbl {listed or 'not listed on any'} | "
              f"{'same IP on every successful request' if stable else 'IP CHANGED'} | "
              f"{'OK' if ok else 'CHECK'}")
    for ip, labels in seen.items():
        if len(labels) > 1:
            print(f"DUPLICATE exit IP {ip} behind {len(labels)} of your ports: {sorted(labels)}")


if __name__ == "__main__":
    sys.exit(main())

Run it with your list in host:port:user:pass or URL format (reformat any list with our proxy list formatter):

python3 audit.py proxies.txt --rounds 5

How we tested it

We ran the script on 30 October 2026 (Python 3.8, US server) against a local test bench: two password-protected HTTP CONNECT proxies on different ports that both exit through the same server IP, plus an entry with a wrong password, an indented comment and a malformed line. This bench tests the script's checks (duplicates, authentication, input handling); it is not a speed or reputation test of any provider. To reproduce it, save this 30-line bench proxy as bench_proxy.py:

import base64, select, socket, socketserver, sys, threading
AUTH = "Basic " + base64.b64encode(b"user:p@ss").decode()

class H(socketserver.StreamRequestHandler):
    def handle(self):
        head = b""
        while b"\r\n\r\n" not in head:
            c = self.request.recv(4096)
            if not c: return
            head += c
        lines = head.decode(errors="ignore").split("\r\n")
        method, target, _ = lines[0].split(" ", 2)
        auth = next((l.split(":", 1)[1].strip() for l in lines
                     if l.lower().startswith("proxy-authorization:")), "")
        if auth != AUTH:
            self.request.sendall(b"HTTP/1.1 407 Proxy Authentication Required\r\n"
                                 b"Proxy-Authenticate: Basic\r\nContent-Length: 0\r\n\r\n"); return
        if method != "CONNECT":
            self.request.sendall(b"HTTP/1.1 405 Method Not Allowed\r\n\r\n"); return
        h, p = target.split(":")
        up = socket.create_connection((h, int(p)), timeout=10)
        self.request.sendall(b"HTTP/1.1 200 Connection established\r\n\r\n")
        a, b = self.request, up
        while True:
            r, _, _ = select.select([a, b], [], [], 20)
            if not r: break
            for s in r:
                d = s.recv(65536)
                if not d: return
                (b if s is a else a).sendall(d)

class S(socketserver.ThreadingMixIn, socketserver.TCPServer):
    allow_reuse_address = True; daemon_threads = True

for port in map(int, sys.argv[1:]):
    threading.Thread(target=S(("127.0.0.1", port), H).serve_forever, daemon=True).start()
threading.Event().wait()

Then run:

python3 bench_proxy.py 18081 18082 &
printf '127.0.0.1:18081:user:p@ss\nhttp://user:p%%40ss@127.0.0.1:18082\n  # indented comment\nbadline\n127.0.0.1:18081:user:wrong\n' > proxies.txt
NO_PROXY='*' python3 audit.py proxies.txt --rounds 5

Our output (IPs and ASN masked):

<ip>:18081: 5/5 ok | exit <ip> | AS<n> <name> | median 84 ms | dnsbl not listed on any | same IP on every successful request | OK
<ip>:18082: 5/5 ok | exit <ip> | AS<n> <name> | median 73 ms | dnsbl not listed on any | same IP on every successful request | OK
skipped malformed line: badline
<ip>:18081: error URLError: <urlopen error Tunnel connection failed: 407 Proxy Authentication Required>
DUPLICATE exit IP <ip> behind 2 of your ports: ['<ip>:18081', '<ip>:18082']

• The duplicate check fired, and the malformed line and the comment were skipped without stopping the run: two "different" proxies came out of one IP, which is what you would see if a provider handed you the same IP twice.

• The wrong-password entry got a 407 even with NO_PROXY='*' set, which proves the request really went through the proxy (an earlier version of our script was fooled by NO_PROXY and connected directly; that is why it now clears it). It stopped after one 407 instead of retrying (see our guide to fixing proxy errors for every 407 cause).

• We validated the blocklist lookup with the test address every DNS blocklist lists on purpose (127.0.0.2): all three lists returned it as listed, while a well-known public resolver IP (8.8.8.8) came back clean on all three. The ASN lookup returned AS15169 (Google) for 8.8.8.8.

How to read the results

• IP CHANGED on an ISP proxy means you were given a gateway that changes IPs. That is not a static proxy at all.

• DUPLICATE means you paid for N proxies but got fewer unique IPs.

• A hosting ASN (a cloud or data-center company) means it is a datacenter proxy, not an ISP proxy. For an ISP proxy you want a consumer provider.

• A blocklist hit at delivery means the IP had a history before it reached you. A new hit after a week of clean use does not prove sharing (lists can also catch an earlier history late, or make mistakes), but it is a fair question for the provider. Run the script daily for the first week, keep the output and compare. unknown means the lookup failed, not that the IP is clean: rerun it.

• These are email and abuse blocklists. They don't measure how a specific website scores the IP; for that, watch your own success, CAPTCHA and 429 rates on the sites you use.

• For a one-off check without code, paste an IP into the IP blacklist checker, the IP lookup tool (ASN and owner) or the proxy checker. Our proxy quality testing guide covers speed, fraud score and leak tests in more depth.

Spamhaus does not answer queries that come through large public DNS resolvers, which is why the script uses three lists that do. Some lists also refuse heavy or public-resolver traffic, so run it on a machine with a normal ISP or self-hosted resolver and keep the list of IPs modest.

When shared proxies are enough, and when you need dedicated

Shared IPs make sense when the IP does not carry anything you care about and a failed request is cheap. The more a block costs you, and the more the IP is tied to an identity, the more dedicated pays off. Three questions decide it:

1. Is the IP tied to an account, a login or a long session? If yes, co-users on the same IP are a direct risk.

2. What does a failure cost? A retried public-page fetch costs a fraction of a cent. A locked account, a skewed ad report or a missed price change costs far more.

3. How sensitive is the target? Sites that score IPs aggressively punish an IP's whole history, including co-users' traffic.

Cheaper per IP is not cheaper per result

The price that matters is cost per successful request: monthly cost ÷ (requests × success rate). Retries also burn time, threads and target-site goodwill, so a lower success rate costs more than the formula shows. Here is the arithmetic on illustrative numbers (your own success rates are what count, and the $4.99 trial is how you measure them):

def cost_per_1k_ok(monthly_usd, requests, success_rate):
    return monthly_usd / (requests * success_rate) * 1000

# 1,000 dedicated CleanProxies ISP IPs ($0.99/IP at 1,000), 30M requests a month
print(cost_per_1k_ok(990, 30_000_000, 0.97))  # ~$0.034 per 1,000 successful requests
# a shared plan at half the monthly price; each IP's budget is split with co-users
print(cost_per_1k_ok(495, 30_000_000, 0.45))  # ~$0.037 per 1,000 successful requests

In this example the shared plan is half the price but ends up more expensive per result once its success rate falls below about 49%, before you count retries, time or burned accounts. Measure your own rates before you decide.

If you are sizing a job, our guide to how many proxies you need turns your request rate into an IP count. For use-case setups see web scraping, ad verification and SEO.

Why CleanProxies ISP proxies are dedicated, and what that gets you

CleanProxies is built for the jobs where a shared IP is the wrong tool, so it only sells the dedicated model:

• 100% dedicated IPs, never shared. Each ISP IP is assigned to one customer for as long as they hold it. Nobody else's traffic touches its reputation, its rate-limit budget or its bandwidth.

• The cleanest ISP IPs: 0 fraud score, super clean ranges on Tier-1 US carrier ASNs (Frontier, AT&T, Comcast, Cox, RCN, T-Mobile). ISP IPs are US (plus Telus in Canada), chosen by carrier; there is no state or city selection.

• Static for the whole plan. The IP you get on day one is the IP you have on day 30.

• Unlimited bandwidth and unlimited threads, no throttling, no overage fees. Read what "unlimited" really means across the market.

• Fast: 100Gbps network ports, <20ms latency, 99.9% uptime.

• Instant delivery: in our live orders, ISP proxies were active 6–19 seconds after payment.

• Flexible auth: user:pass, IP whitelist, or SOCKS5 user:pass from the dashboard.

• Whole /24 blocks if you need contiguous ranges: ISP subnet proxies from $1.19/IP.

• Great 24/7 support.

And you do not pay a "dedicated premium": CleanProxies dedicated ISP proxies go as low as $0.75/IP on volume plans, the cheapest pricing in the market, and you can start with just 5 IPs. See how we compare on the compare page and in our bulk ISP proxy price comparison.

Buying checklist: questions to ask any provider

1. "Is each IP assigned to one customer only?" Get the answer in writing (terms, product page or support ticket). "Private" and "dedicated" should mean one customer per IP.

2. "How many customers share each IP?" Ask this even for "private" plans: at least one large provider sells "private" IPs shared by 1-2 users. If it is semi-dedicated, get the cap.

3. "Is the IP static for the whole billing period?" And can you keep it when you renew?

4. "Which ASN are the IPs on?" For ISP proxies it should be a consumer ISP, not a hosting company.

5. "Is bandwidth really unlimited?" Look for fair-use thresholds in the help center.

6. Test before you scale. Start the CleanProxies $4.99 trial (5 ISP IPs for 1 hour, or 100 MB of rotating residential; there are no refunds or IP replacements, so the trial is the way to test first), run the audit script above on the 5 IPs, check them in the proxy checker, then point your real job at them. Start the $4.99 trial.

Pricing

Every tier is on the pricing page.

Get dedicated ISP proxies

• Buy dedicated ISP proxies

• See all pricing

• Check any proxy for free

Written and tested by the CleanProxies team. Script tested 30 October 2026 from a US server on a local proxy bench; provider terms read from each provider's own pages the same day.

Frequently Asked Questions

Team CleanProxies

Proxy Infrastructure Team

Share