Types of Proxies

Proxies come in different layers and serve different purposes, and understanding the distinction matters for detection. At the simplest level, HTTP proxies are servers that forward HTTP requests on your behalf. Many are open proxies—accidentally misconfigured servers left exposed to the internet—and they're among the easiest to catch because they show up in abuse databases within hours of going live.

HTTPS and CONNECT proxies handle encrypted traffic using the CONNECT tunneling method, and they're structurally similar enough to HTTP proxies that the same detection methods apply. SOCKS4 and SOCKS5 proxies operate at a lower layer and can tunnel any TCP traffic (SOCKS5 adds UDP and authentication support). They're popular with automated tools precisely because they don't care what protocol runs on top.

Residential proxies are a different animal entirely. Instead of routing through datacenter servers, they funnel traffic through real consumer ISP connections—often acquired through malware, browser extensions, or peer-to-peer rental networks. The exit IP is a legitimate home internet connection, which is what makes them so valuable for abuse and so hard to detect. They cost more to operate, which means they're usually deployed for higher-value attacks.

Rotating or backconnect proxies cycle through a pool of exits on each request or at a configurable interval. This defeats per-IP rate limiting because by the time you block one IP, the next request comes from a different one. The exit pools are often residential.

Why Proxies Are Used for Abuse

The reason attackers reach for proxies is consistent across abuse patterns: hiding where they really are. Bot traffic and web scraping operations use proxy pools so each request appears to come from a different IP, defeating IP-based blocking. Ad fraud networks generate clicks and impressions through proxies to bypass geolocation and fraud detection rules. Credential stuffing campaigns distribute login attempts across proxy pools to spread load and evade per-IP rate limits. Geo-bypass—whether deliberate fraud or just a user circumventing content restrictions—uses proxies to appear in a different country.

How IP APIs Detect Proxies

The most reliable detection method for datacenter and commercial proxies is BGP and ASN data. When an IP address belongs to an ASN registered to a known proxy provider, or when an ASN exhibits the traffic patterns of proxy infrastructure (many distinct source IPs, high volume, customers spread across geographies), it gets flagged as high-confidence proxy traffic.

Published lists form the second pillar. Open proxies advertise themselves by nature—that's how users find them—so they appear in public proxy lists within hours of going online. Predax ingests several community-maintained lists on a rolling schedule, alongside VPN providers' published server lists and feeds like Spamhaus DROP that track hijacked and criminal-operated netblocks. We deliberately exclude sources whose licenses don't permit commercial use; a few well-known "free" databases fall into that category, and building a commercial product on unlicensed data is a shortcut we don't take.

Cloud provider IP ranges are another anchor point. AWS publishes ip-ranges.json, GCP publishes cloud.json, and every major cloud provider maintains authoritative lists of their ranges. An IP belonging to one of those ranges but not associated with a legitimate cloud workload is a strong proxy indicator.

Behavioral signals round out the picture. Proxy infrastructure leaves traces in traffic patterns—uniform user-agent strings across sessions, complete absence of browser fingerprint variation, request volumes no household internet connection produces. These heuristic patterns get flagged when analyzed at scale.

Residential Proxies: The Harder Problem

Residential proxy detection relies on confidence scoring rather than definitive flags. Because the exit IP is a real consumer ISP address, you cannot simply check it against a datacenter range list.

Detection approaches include:

• Velocity analysis — A residential IP generating request volumes that no household produces is a proxy exit, not a real user. The behaviour, not the address, gives it away.
• Community reputation aggregation — When multiple sites report the same IP for abuse within a short window, confidence in proxy classification increases even without a definitive network match. Providers like Bright Data, Oxylabs, and Smartproxy rotate their pools, but the abuse those pools carry keeps re-identifying them.

For residential proxies, use the classification.risk_score field alongside classification.is_proxy — a score above 60 on a residential-looking IP is a meaningful signal even if is_proxy is false.

Making the API Call

curl

curl -s -X POST "https://predax.io/api/v1/check/ip" \
  -H "X-API-Key: prdx_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ip": "91.108.4.1"}'

Python

import httpx

def check_ip(ip: str) -> dict:
    r = httpx.post(
        "https://predax.io/api/v1/check/ip",
        headers={"X-API-Key": "prdx_live_YOUR_KEY"},
        json={"ip": ip},
        timeout=2.0,
    )
    r.raise_for_status()
    return r.json()

def is_proxy_risk(ip: str) -> bool:
    result = check_ip(ip)
    classification = result.get("classification", {})
    # Hard proxy flag OR high risk residential
    return classification.get("is_proxy") or classification.get("risk_score", 0) >= 60

Legitimate Privacy Tools vs. Abuse

The key insight is that proxy use is not inherently malicious. Privacy-conscious users, journalists, researchers, and people in countries that censor the internet all have legitimate reasons to tunnel their traffic through proxies. Hard-blocking every proxy will lock out a meaningful fraction of your real user base, which is why the response needs to be proportional to the risk.

For login protection, the right strategy is to block datacenter proxies (datacenter ranges plus open proxies flagged at risk score 65+) outright, because genuine users don't log in from AWS or DigitalOcean. But challenge commercial VPN users with MFA rather than blocking them—a legitimate privacy-conscious user should be able to get in with an extra verification step. At checkout, the calculation shifts: the cost of fraud is higher, so block datacenter proxies but hold commercial proxy orders for manual review rather than declining them outright. The false-positive cost (turning away a legitimate customer) goes down relative to the fraud cost as order value rises.

API access has its own profile. Block open proxies and Tor exits (both high-abuse surfaces), rate-limit datacenter traffic more aggressively than residential, but don't outright block commercial VPNs unless your terms of service specifically prohibit them—many legitimate API consumers authenticate through corporate VPNs. For content geo-restriction, use the proxy flags themselves (classification.is_proxy: true or classification.is_vpn: true) as your primary signal, and supplement with a risk score threshold (≥40) to catch likely residential proxies. Accept that a small false-positive rate—a traveller using a legitimate VPN—is unavoidable and manageable.

Related guides

• Residential vs datacenter proxies — the most important categorisation to get right when acting on proxy hits.
• How to detect VPN users — VPN is a proxy subtype; same API, different threshold guidance.
• Blocking Tor users — Tor exits are proxies too, but warrant their own policy.
• How IP risk scoring works — turning multiple proxy signals into a single score.
• ASN-based blocking explained — bulk-blocking proxy ASNs without per-IP overhead.

See pricing to start scoring proxies in production.