The Proxy Landscape Most Defenders Don't See

For developers building the security layer of a modern app, "proxy" used to mean one thing: a commercial VPN or an open proxy running on a cheap cloud instance. Those are still common, but they are not the dangerous ones anymore. The proxies that defeat most defences today are residential proxies — traffic routed through real consumer devices on real ISP networks.

The residential proxy market is big and growing. Mordor Intelligence sized it at roughly \$117 million in 2024, projected to reach \$148 million by 2030. The leaders — Bright Data, Oxylabs, Smartproxy, IPRoyal, NetNut — each advertise pools in the tens of millions of IPs (vendor-claimed numbers, so treat them as marketing rather than measurement). Whatever the true figure, the pools are an order of magnitude larger than most threat feeds, and almost none of those IPs look suspicious to a naive defence system because, well, they are not suspicious IPs. They are your neighbours' home internet.

This post is for developers who need to understand both types of proxies — why they exist, what they look like on the wire, and how a good IP intelligence API tells them apart.

Datacenter Proxies: The Old World

A datacenter proxy is a server running in a cloud or colocation facility that accepts connections on some port (HTTP, SOCKS, or a VPN protocol) and forwards them to the destination site, substituting its own IP for yours.

Source of the IPs. Cloud providers (AWS, GCP, Azure, Hetzner, OVH, DigitalOcean, Vultr, Linode) allocate blocks to customers. A proxy operator rents a server, binds the allocated IPs to their proxy software, and sells access to those IPs.

Identifiable characteristics. The IPs belong to an ASN registered to the cloud provider. The WHOIS data clearly shows the network is commercial hosting. Reverse DNS often leaks the provider (ec2-54-123-45-67.compute-1.amazonaws.com). BGP route announcements are public.

Why attackers still use them. Datacenter proxies are cheap (often free from trial cloud accounts) and fast. For low-value scraping or initial reconnaissance, they are still the default.

Why defenders catch them easily. Every signal above is a billboard. An IP whose ASN is AS14618 Amazon.com hitting your user-facing login endpoint should trigger a high risk score by default. Predax flags these with classification.is_datacenter: true and typically classification.risk_score >= 35 immediately.

Residential Proxies: The New World

A residential proxy is traffic tunnelled through a real consumer device on a real ISP. The IP you see is the public IP of someone's actual home router in someone's actual house, on a real Comcast / BT / Deutsche Telekom / Telstra connection.

Source of the IPs. There are three main sources, all of them morally dubious and two of them outright illegal:

1. "Free VPN" apps and browser extensions. The user installs a free VPN, grants the app network access, and — in the fine print they didn't read — consents to their device being used as an exit node for other users' traffic. The proxy operator resells that exit bandwidth. (Hola VPN famously pioneered this model.)
2. Malware botnets. Compromised home routers, IoT devices, and infected PCs get drafted into proxy networks without the device owner's knowledge. The 2024 TheMoon botnet and the older Glupteba botnet are well-documented examples.
3. Affiliate SDKs. Legitimate-looking SDK libraries offered to mobile app developers ("monetise your app without ads — just share unused bandwidth") that embed proxy functionality into the app. The user of the app has no idea their device is an exit node. Several were caught in 2023 and removed from Google Play, but the pattern persists.

Identifiable characteristics. This is the hard part — by design, there aren't many. The IP is a genuine consumer IP assigned to a real ISP. The ASN is Comcast Cable or British Telecom or Telia. Reverse DNS looks like a normal residential pool entry. A single HTTP request in isolation is indistinguishable from your actual customer next door.

What you CAN see when you look across requests. Residential proxies give themselves away through behavioural patterns that are impossible to disguise at scale:

• Session concurrency from a single IP. A real household has ~2-5 active devices, maybe 10 on the high end. A residential proxy exit point often sees hundreds of distinct sessions in the same minute, all using the same source IP but completely different user identities, browsers, and target sites.
• Geographic impossibilities. The same IP logs into Account A in Germany and Account B in Brazil within 30 seconds. Residential users do not teleport.
• High velocity. A typical home IP makes a few dozen TCP connections per minute. A proxied home IP can make thousands.
• Temporal patterns. Residential traffic follows regional diurnal rhythms (low overnight, peaks in the evening). Proxied residential traffic is flat across 24 hours because the operator has users on every timezone.

Why detection is still possible. Commercial proxy operators rotate their exit pools but the pools themselves leak. An IP that keeps turning up in abuse reports across unrelated sites, at volumes no household produces, identifies itself regardless of which ISP owns it. When a new exit starts showing the patterns above, it earns its reputation quickly.

How Well Detection Actually Works

We're not going to print an accuracy table — the "typical detection rate" percentages that circulate in this space don't trace to any measurable methodology, and a vendor quoting one for residential proxies is describing a benchmark they built themselves. What can be said honestly about the relative difficulty:

• Tor is deterministic. Exit relays must publish themselves in the network consensus, so detection is a list match — false positives are essentially zero.
• Datacenter proxies are nearly as easy. The ASN, WHOIS, and published cloud ranges all announce what the network is. Misses are rare and short-lived.
• Commercial VPNs are well-covered where the provider publishes its servers (many major ones do — Mullvad, NordVPN, Proton and others expose their own server lists), and patchier for providers that hide theirs.
• Residential proxies are the weak link, for everyone. The exit is a genuine consumer connection; detection is probabilistic, lags new pools, and degrades as operators rotate. Any provider claiming near-total residential-proxy detection is describing a subset.

The honest conclusion: residential proxies are a probabilistic problem and the best defence is multi-signal risk scoring — not binary classification.

Practical Integration

A realistic detection policy in application code:

const result = await checkIp(request.ip);
const c = result.classification;

// Hard block: high-confidence bad actors
if (c.is_tor || (c.is_datacenter && c.risk_score >= 50)) {
  return { action: 'block', reason: 'datacenter_or_tor' };
}

// Soft challenge: suspected residential proxy or other proxy hit
if (c.risk_score >= 40 || c.is_proxy) {
  return { action: 'challenge', reason: 'suspicious_network' };
}

// Watch but allow: marginal signals
if (c.risk_score >= 20 || (c.flags || []).length > 0) {
  return { action: 'monitor', reason: 'low_reputation' };
}

return { action: 'allow', reason: 'clean' };

The key insight is that "block" is the wrong default for residential proxies because the false-positive rate is meaningfully above zero. Challenge (CAPTCHA, email OTP, step-up auth) catches attackers while letting legitimate users on edge-case networks through.

What to Actually Do

1. Block datacenter proxies liberally. False positives are extremely rare and the signal is cheap. Most legitimate traffic is not routed through an AWS EC2 instance on its way to your login page.
2. Challenge residential proxy suspects. Use CAPTCHA, email OTP, or WebAuthn on the action you care about. Do not use a full block here.
3. Layer multiple signals. IP origin is one of several. Combine with behavioural metrics (failure rate, time-of-day, device fingerprint, credential age) to avoid false positives.
4. Subscribe to a threat feed. Don't try to build your own residential proxy detection from scratch — the data is operational and changes daily. A managed IP API aggregates dozens of upstream feeds so you don't have to.
5. Monitor your residential proxy catch rate over time. As attackers switch pools, your catch rate will drift. Review monthly and retune.

Residential proxies are not going away. The market exists because the bandwidth is real, the revenue is real, and the legal ambiguity around device owner consent is favourable to the operators. The defender's job is not to win the arms race — it is to make the cost per successful attack high enough that attackers target someone else.

Related guides

• Proxy detection API guide — the API surface for both categories in one place.
• How to detect VPN users — VPNs straddle both categories; this is how to handle that.
• Blocking Tor users — a third proxy category with its own posture.
• ASN-based blocking explained — the underlying mechanic that makes datacenter proxies easy to spot.
• How IP risk scoring works — why residential and datacenter proxy hits get weighted very differently.
• iCloud Private Relay vs Cloudflare WARP — the egress infrastructure that looks like a datacenter proxy but carries real Safari users.