A residential proxy is not a technical exotic. It is a product, sold by companies with pricing pages, documentation, and support teams, and the addresses it sells belong to real consumer devices on real consumer ISPs.
That is the whole difficulty. Every reputation signal that works on datacenter traffic — hosting ASN, known ranges, abuse history — returns "clean" on an address that is genuinely a home broadband line in Ohio, because it is one. The proxy layer is invisible to reputation because there is nothing disreputable about the address itself.
This guide covers how these networks obtain their pools, what that sourcing implies about their behaviour, and which detection approaches still work when the IP itself tells you nothing. For the underlying concept, start with what is a residential proxy.
Where the addresses come from
Pool sourcing determines almost everything about how a network behaves under observation, so it is worth understanding before looking at signals.
- SDK monetisation. A developer embeds a proxy SDK into a free application — a utility, a game, a VPN — and is paid per active device. The end user consented somewhere in an EULA that was almost certainly not read. This produces enormous, geographically diffuse pools with high churn, because availability depends on whether someone happens to have the app open.
- Browser extensions and desktop clients. The same arrangement with a more visible install. Pools are smaller but sessions last longer, since a browser stays open in a way a mobile app does not.
- Explicit paid opt-in. Some networks pay users directly for bandwidth. Smaller pools, more stable, and the least legally fraught of the three.
- ISP-allocated ranges. Addresses leased from ISPs and hosted in datacenters. These register as residential in most databases while behaving with datacenter stability. Commonly marketed as static residential or ISP proxies, and they are the hardest class to classify correctly, because the ASN genuinely is a consumer ISP.
Who the major networks are
The commercial market has consolidated around a recognisable set of names: Bright Data, Oxylabs, Decodo (formerly Smartproxy), SOAX, IPRoyal, NetNut, and Massive, alongside a long tail of resellers who rebrand upstream pools. Several of these operate at genuinely large scale, advertising pools in the tens of millions of addresses.
A caution worth stating plainly: you cannot reliably attribute an individual IP to a named vendor, and any tool claiming otherwise deserves scepticism. Pools overlap, resellers share upstream infrastructure, and the same consumer device may be enrolled in several networks at once. What you can classify is the *behaviour class* — is this address currently acting as a proxy exit — which is the operationally useful question anyway.
Why reputation data fails here
Three properties make these pools resistant to the signals that work everywhere else.
- The address is genuinely residential. ASN, geolocation, and rDNS all agree it is consumer broadband, because it is. There is no lie to detect at the address level.
- Rotation outpaces list-building. By the time an address has accumulated enough abuse history to appear on a list, the operator has moved on and that address is back to serving its actual owner. Blocking it now punishes a customer.
- Shared infrastructure creates collateral damage. Carrier-grade NAT means a single mobile address can front thousands of unrelated subscribers. Aggressive blocking at the address level is how teams generate false positives at scale.
Signals that survive rotation
If the address cannot tell you, the answer has to come from somewhere else. In rough order of practical value:
- Active tunnel detection. Determining whether a connection is currently traversing a proxy or VPN — rather than asking whether the address has a bad reputation — is the signal that holds up. It is a property of the live connection, so rotation does not defeat it. In our pipeline this produces the
proxiedandvpnsignals, each contributing 60 points toward the 0-100 risk score, enough on their own to reach the review band. - Cross-layer contradiction. A residential address presenting the TLS signature of an HTTP library, or HTTP/2 settings that no consumer browser produces, is a strong tell. TLS fingerprinting covers the mechanics.
- Device-level linking. When one environment creates forty accounts through forty addresses, the addresses are useless and the device correlation is decisive. This is the counter to rotation in general, and it is why device signals and network signals belong in the same decision.
- Session-shape anomalies. Sticky sessions have configured lifetimes, and expiry produces a characteristic mid-session network change. A user whose ASN changes while their session continues uninterrupted is doing something a normal user cannot.
- Improbable travel and locale disagreement. Geolocation that jumps continents between requests, or a browser locale and timezone that contradict the exit location, remains useful — attackers routinely select an exit country and forget the client environment still says otherwise.
The ISP-proxy problem
Static residential addresses deserve their own note, because they defeat the usual heuristics from both directions. They sit in ranges allocated to consumer ISPs, so ASN classification calls them residential. But they are hosted, always-on, and do not churn, so the instability signals that expose SDK-sourced pools never fire.
Two things help. Long-lived observation of the address — a genuine home connection has diurnal rhythm, an ISP proxy does not — and the same cross-layer contradiction checks, because a hosted proxy is still usually fronting scripted clients rather than real browsers. Neither is instant, which is why this class stays hard.
Enforcement that does not cost you customers
Proxy use is not itself fraud. Privacy-conscious users, corporate networks, travellers, and people in restrictive jurisdictions all route traffic through intermediaries for entirely legitimate reasons. A hard block on every proxy signal will remove real revenue.
The workable pattern is proportional response. A proxied signal at 60 points reaches review rather than block, which is correct: it warrants a second factor on a high-value action, not a refusal at the door. Combine it with a second independent signal — device linking, a protocol contradiction, a velocity pattern — before enforcing hard. That combination is where confidence gets high enough to justify the friction.
And keep the enforcement proportional to the action. Reading a page through a proxy is unremarkable. Redeeming a promotion through one, from a device that has redeemed four already, is not.
Frequently Asked Questions
How do residential proxy networks get their IP addresses?
Most large pools come from SDK monetisation, where a developer embeds a proxy SDK into a free application and is paid per active device, with end-user consent buried in an EULA. Others come from browser extensions, desktop clients, or explicit paid opt-in programmes that compensate users for bandwidth. A separate class, marketed as static residential or ISP proxies, consists of addresses leased directly from ISPs and hosted in datacenters, which register as residential while behaving with datacenter stability.
Can you tell which residential proxy provider an IP belongs to?
Not reliably, and tools claiming per-vendor attribution deserve scepticism. Pools overlap heavily, resellers share upstream infrastructure, and a single consumer device may be enrolled in several networks simultaneously. The operationally useful question is not which company sells access to this address but whether the connection in front of you is currently traversing a proxy, which is a property of the live connection and answerable regardless of vendor.
Why do IP reputation lists miss residential proxies?
Because the address is genuinely residential and has nothing disreputable about it. ASN, geolocation, and reverse DNS all correctly report consumer broadband, so there is no inconsistency at the address layer to detect. Rotation compounds this: by the time an address accumulates enough abuse history to be listed, the operator has moved on and the address is serving its actual owner again, so blocking it penalises a real customer rather than an attacker.
What detection actually works against rotating residential proxies?
Active tunnel detection is the most durable, because it establishes whether the current connection traverses a proxy rather than asking whether the address has a bad history, so rotation does not defeat it. Beyond that, cross-layer contradictions such as a residential address presenting an HTTP library's TLS signature, device-level linking that connects accounts created through different addresses, and session-shape anomalies such as an ASN changing mid-session all survive rotation because none of them depend on the address staying constant.
Should I block all traffic from residential proxies?
Generally not, because proxy use is not itself fraud. Privacy-conscious users, corporate networks, travellers, and people in restrictive jurisdictions all route traffic through intermediaries legitimately, and carrier-grade NAT means one address can front thousands of unrelated subscribers. A proxy signal is better treated as grounds for review than refusal: require a second independent signal, such as device linking or a protocol contradiction, before hard enforcement, and scale the response to what the action costs.
Detect the tunnel, not the reputation
Live proxy and VPN signals that rotation does not defeat.
Try Sentinel free →