How are these residential proxies made?

We have several types of proxies such as datacenter and residential proxies.

For datacenter proxies, it is clear how they work. they buy a vps, server and a block of ips, then install proxy on them.

But how does this work for residential proxies? Some sellers claim huge numbers like 10m rotating res proxies.
though they exaggerate about numbers of proxies like 10m , 20m....
But I can only think of two possibilities :

1. A botnet infected residential devices and turned them into proxies.
2. They are actually datacenter proxies, but the IPs are registered under ISP names or residential looking ASNs.

What do you think?

there’s a third big route too: opt-in apps/SDKs and bandwidth-sharing networks where real users agree to let traffic pass through their connection. plus plenty of “providers” are just reselling the same upstream pool under different branding.

Proxellor said:

there’s a third big route too: opt-in apps/SDKs and bandwidth-sharing networks where real users agree to let traffic pass through their connection. plus plenty of “providers” are just reselling the same upstream pool under different branding.

Click to expand...

"opt-in apps/SDKs and bandwidth-sharing networks" no such a thing exist

Jackreach3r said:

"opt-in apps/SDKs and bandwidth-sharing networks" no such a thing exist

Click to expand...

Yes, they do.