A Proxy Detection API Built for Residential Proxies, Not Just Datacenter Ranges
Datacenter proxies are the easy half of the problem — providers publish their own ranges. The traffic that actually hurts you exits through real homes on real ISPs, rented by the gigabyte from pools like Bright Data. Sentinel tells the two apart, names the network when attribution is known, and layers device signals so rotating the exit IP stops helping.
Why proxy traffic gets past IP filtering
Residential exits look exactly like customers
A residential proxy routes the request through a real consumer device on Comcast, Vodafone, or Deutsche Telekom. The address has normal ISP history, a normal ASN, and a plausible geolocation — every naive check reads it as a legitimate home user.
ASN lists only catch the lazy half
Blocking hosting-provider ASNs stops datacenter proxies and nothing else. The residential pool's entire value proposition is that its exits sit inside the same consumer ASNs as your paying users — block the ASN and you block your customers with it.
Rotation defeats per-IP controls
Commercial pools advertise tens of millions of rotating addresses. An attacker can present a fresh residential IP on every single request, so rate limits, velocity rules, and IP-based bans never accumulate enough history to fire.
Geolocation becomes attacker-controlled
Residential pools sell city-level exit targeting. Geo-fencing, regional pricing, and "impossible travel" logic all assume the IP's location means something — behind a proxy pool, it means whatever the attacker selected from a dropdown.
What Sentinel does for you
- Separate signals for proxy, VPN, Tor, and datacenter origin — residential proxies don't hide in an "anonymous" catch-all
- Named attribution when known:
network.servicereturns the operator behind the exit, e.g.BRIGHT_DATA network.residentialdistinguishes consumer ISP space from hosting ranges on every evaluation- 400+ device signals tie rotating IPs back to one machine — headless browsers, antidetect tooling, and repeat hardware all surface
- Signals and score returned together, so blocking policy stays in your code
One call, both layers
For browser traffic, /v1/evaluate scores the network and the device in one round trip — the proxy verdict plus the fingerprint evidence that survives IP rotation. Screening bare IPs server-side (logs, webhooks, batch jobs)? Use GET /v1/lookup — same key, same bucket, network signals only.
// Full evaluation: network + device layers in one verdict const verdictRes = await fetch('https://sntlhq.com/v1/evaluate', { method: 'POST', headers: { 'Authorization': 'Bearer ' + process.env.SENTINEL_KEY, 'Content-Type': 'application/json' }, body: JSON.stringify({ token: req.body.sentinel_token }) }); const risk = await verdictRes.json(); // risk.network.proxy -> true when the request exits a proxy // risk.network.residential -> consumer ISP space vs hosting range // risk.network.service -> named operator when known: 'BRIGHT_DATA' if (risk.decision === 'block') return res.status(403).json({ error: 'Request rejected' }); if (risk.decision === 'review') flagForReview(risk.reasons);
Connect through the proxy you're worried about and run the live scanner on the homepage — it shows the verdict Sentinel would hand your server. Or paste any exit IP into the free IP lookup tool. Both are keyless previews with a reduced signal set; the full API adds device intelligence and multi-account linking.
The signals that matter here
Residential exits, identified by intelligence — not inference. You cannot compute your way from an ASN to "this specific Comcast address is currently a rented proxy exit." That knowledge comes from curated, continuously refreshed tunnel intelligence — Sentinel's primary network source — which tracks which addresses are actively carrying proxy traffic right now, as pools rotate. When the operator is attributable, network.service names it: BRIGHT_DATA is a very different conversation with your fraud team than "anonymous IP."
The datacenter layer, hardened by the providers themselves. For the easier half, Sentinel combines tunnel intelligence with address ranges that cloud providers publish about their own infrastructure, so the dch signal stands on authoritative ground. The layering is strict by design: published ranges only ever add evidence — a range hit can never short-circuit tunnel detection, because VPN and proxy exits frequently live inside datacenters too.
The device behind the pool. Rotation changes the IP; it doesn't change the machine. Sentinel's device layer reads 400+ signals per session — enough to spot headless Chrome under stealth patches, antidetect browsers with spoofed fingerprints, and virtual machines — and its cross-browser device ID with a "times seen" counter ties request #50 to the same hardware as request #1, whichever exit carried it. Per-customer and hash-only, always.
Weak evidence stays weak. A proxy signal alone doesn't have to mean "block" — plenty of corporate egress and privacy tooling proxies traffic legitimately. Every response carries the individual signals, the named service, and the reasons array alongside the decision, so you can block residential-proxy checkout attempts while merely reviewing proxy-flagged logins. For the deeper story on why this class of traffic breaks IP-only defenses, read the residential proxy detection guide.
Common questions
/v1/evaluate response names the operator in network.service — for example BRIGHT_DATA for a Bright Data exit or PROTON_VPN for a VPN. That attribution turns a generic "proxy detected" into something you can write policy against and show an analyst.residential: true with the proxy signal false, and contributes nothing to the risk score. Signals only fire on addresses currently acting as proxy or tunnel exits. And because every response carries the individual signals alongside the score, you decide what happens on a hit: block, review, or extra verification.See the proxy, name the network, keep the customer
Free tier: 1,000 requests/hour. No card, no expiry. Detects residential proxies, datacenter exits, antidetect browsers, and AI bots.