Well I don't know how many IP addresses each of Mullvad's servers have, but they list a domain name, IPv4 and IPv6 address for all of them publicly[1].
Our detection model at ipinfo is largely based on behavior models of IP addresses. We have 700 servers around the world from which we run internet measurement, allowing us to reliably determine which IP addresses are VPNs or proxies. These measurements are largely ping/traceroute data, which enable us to estimate a number of different things most importantly IP location data.
If you are interested in what kind of other information we can discover from our internet measurements, check out our tags page: https://ipinfo.io/tags
Net flows. A residential proxy should have a residential amount of traffic coming from it. If one IP has 1000x the usual traffic one household could reasonably account for, then mark it as a residential proxy. It won't be 100% accurate, but it's sufficiently accurate for reddit to go on a blocking spree.
I am not sure how they do it, but one option is setting some arbitrary threshold for number of devices fingerprinted on a single ip in a given period of time. Something like taking the average number of devices and denying access to ips that they detect ~3 sigma different devices from.