This matches what we see in weekly proxy-exit captures: the bulk sits on residential and mobile space, not hosting ranges. A VPN boolean and a residential-proxy observation are different risk inputs with different false-positive profiles.
The other trap is treating a hit as permanent. Rotating pools recycle addresses back to real households, so freshness matters as much as the flag. IP99 models that as evidence_state (active/stale/none) plus a score that decays—useful next to graduated friction instead of a hard block on consumer ASNs.