The Proxy Landscape Most Defenders Don't See

For developers building the security layer of a modern app, "proxy" used to mean one thing: a commercial VPN or an open proxy running on a cheap cloud instance. Those are still common, but they are not the dangerous ones anymore. The proxies that defeat most defences today are residential proxies — traffic routed through real consumer devices on real ISP networks.

The residential proxy market is big and growing. Mordor Intelligence sized it at roughly \$117 million in 2024, projected to reach \$148 million by 2030. The leaders — Bright Data, Oxylabs, Smartproxy, IPRoyal, NetNut — collectively claim access to more than 72 million unique IPs across their pools. That is an order of magnitude larger than most threat feeds, and almost none of those IPs look suspicious to a naive defence system because, well, they are not suspicious IPs. They are your neighbours' home internet.

This post is for developers who need to understand both types of proxies — why they exist, what they look like on the wire, and how a good IP intelligence API tells them apart.

Datacenter Proxies: The Old World

A datacenter proxy is a server running in a cloud or colocation facility that accepts connections on some port (HTTP, SOCKS, or a VPN protocol) and forwards them to the destination site, substituting its own IP for yours.

Source of the IPs. Cloud providers (AWS, GCP, Azure, Hetzner, OVH, DigitalOcean, Vultr, Linode) allocate blocks to customers. A proxy operator rents a server, binds the allocated IPs to their proxy software, and sells access to those IPs.

Identifiable characteristics. The IPs belong to an ASN registered to the cloud provider. The WHOIS data clearly shows the network is commercial hosting. Reverse DNS often leaks the provider (ec2-54-123-45-67.compute-1.amazonaws.com). BGP route announcements are public.

Why attackers still use them. Datacenter proxies are cheap (often free from trial cloud accounts) and fast. For low-value scraping or initial reconnaissance, they are still the default.

Why defenders catch them easily. Every signal above is a billboard. An IP whose ASN is AS14618 Amazon.com hitting your user-facing login endpoint should trigger a high risk score by default. Predax flags these with classification.is_datacenter: true and typically classification.risk_score >= 35 immediately.

Residential Proxies: The New World

A residential proxy is traffic tunnelled through a real consumer device on a real ISP. The IP you see is the public IP of someone's actual home router in someone's actual house, on a real Comcast / BT / Deutsche Telekom / Telstra connection.

Source of the IPs. There are three main sources, all of them morally dubious and two of them outright illegal:

1. "Free VPN" apps and browser extensions. The user installs a free VPN, grants the app network access, and — in the fine print they didn't read — consents to their device being used as an exit node for other users' traffic. The proxy operator resells that exit bandwidth. (Hola VPN famously pioneered this model.)
2. Malware botnets. Compromised home routers, IoT devices, and infected PCs get drafted into proxy networks without the device owner's knowledge. The 2024 TheMoon botnet and the older Glupteba botnet are well-documented examples.
3. Affiliate SDKs. Legitimate-looking SDK libraries offered to mobile app developers ("monetise your app without ads — just share unused bandwidth") that embed proxy functionality into the app. The user of the app has no idea their device is an exit node. Several were caught in 2023 and removed from Google Play, but the pattern persists.

Identifiable characteristics. This is the hard part — by design, there aren't many. The IP is a genuine consumer IP assigned to a real ISP. The ASN is Comcast Cable or British Telecom or Telia. Reverse DNS looks like a normal residential pool entry. A single HTTP request in isolation is indistinguishable from your actual customer next door.

What you CAN see when you look across requests. Residential proxies give themselves away through behavioural patterns that are impossible to disguise at scale:

• Session concurrency from a single IP. A real household has ~2-5 active devices, maybe 10 on the high end. A residential proxy exit point often sees hundreds of distinct sessions in the same minute, all using the same source IP but completely different user identities, browsers, and target sites.
• Geographic impossibilities. The same IP logs into Account A in Germany and Account B in Brazil within 30 seconds. Residential users do not teleport.
• High velocity. A typical home IP makes a few dozen TCP connections per minute. A proxied home IP can make thousands.
• Temporal patterns. Residential traffic follows regional diurnal rhythms (low overnight, peaks in the evening). Proxied residential traffic is flat across 24 hours because the operator has users on every timezone.
• Port and TLS fingerprints. Some proxy SDKs leak unusual TLS client hellos or persistent TCP characteristics that never appear in normal browser traffic.

Why detection is still possible. Commercial proxy operators rotate their exit pools but the pools themselves leak. Good threat feeds (Predax maintains one, several others exist) map individual residential IPs to known exit pools based on observed behaviour. When a new IP starts showing the patterns above, it gets added to the feed within hours.

Typical Detection Accuracy in 2026

Rough accuracy rates from a modern IP intelligence API for each proxy type:

Residential proxies are the weak link. No provider can claim 95%+ detection there, and anyone who does is lying or measuring a specific limited subset. The honest answer is that residential proxies are a probabilistic problem and the best defence is multi-signal risk scoring — not binary classification.

Practical Integration

A realistic detection policy in application code:

const result = await checkIp(request.ip);
const c = result.classification;

// Hard block: high-confidence bad actors
if (c.is_tor || (c.is_datacenter && c.risk_score >= 50)) {
  return { action: 'block', reason: 'datacenter_or_tor' };
}

// Soft challenge: suspected residential proxy or other proxy hit
if (c.risk_score >= 40 || c.is_proxy) {
  return { action: 'challenge', reason: 'suspicious_network' };
}

// Watch but allow: marginal signals
if (c.risk_score >= 20 || (c.flags || []).length > 0) {
  return { action: 'monitor', reason: 'low_reputation' };
}

return { action: 'allow', reason: 'clean' };

The key insight is that "block" is the wrong default for residential proxies because the false-positive rate is meaningfully above zero. Challenge (CAPTCHA, email OTP, step-up auth) catches attackers while letting legitimate users on edge-case networks through.

What to Actually Do

1. Block datacenter proxies liberally. False positives are extremely rare and the signal is cheap. Most legitimate traffic is not routed through an AWS EC2 instance on its way to your login page.
2. Challenge residential proxy suspects. Use CAPTCHA, email OTP, or WebAuthn on the action you care about. Do not use a full block here.
3. Layer multiple signals. IP origin is one of several. Combine with behavioural metrics (failure rate, time-of-day, device fingerprint, credential age) to avoid false positives.
4. Subscribe to a threat feed. Don't try to build your own residential proxy detection from scratch — the data is operational and changes daily. A managed IP API aggregates dozens of upstream feeds so you don't have to.
5. Monitor your residential proxy catch rate over time. As attackers switch pools, your catch rate will drift. Review monthly and retune.

Residential proxies are not going away. The market exists because the bandwidth is real, the revenue is real, and the legal ambiguity around device owner consent is favourable to the operators. The defender's job is not to win the arms race — it is to make the cost per successful attack high enough that attackers target someone else.

Related guides

• Proxy detection API guide — the API surface for both categories in one place.
• How to detect VPN users — VPNs straddle both categories; this is how to handle that.
• Blocking Tor users — a third proxy category with its own posture.
• ASN-based blocking explained — the underlying mechanic that makes datacenter proxies easy to spot.
• How IP risk scoring works — why residential and datacenter proxy hits get weighted very differently.
• iCloud Private Relay vs Cloudflare WARP — the egress infrastructure that looks like a datacenter proxy but carries real Safari users.