Most fraud tooling blocks datacenter IPs reasonably well. The moment an attacker routes through AWS or DigitalOcean, something catches it. Residential proxies exist specifically to route around that defense, and they are the class that layered VPN and proxy detection finds hardest to see. If you are seeing them in your traffic at scale, you are seeing what a technically sophisticated attack looks like when it targets systems that only check for datacenter IPs.
What a Residential Proxy Network Actually Is
A residential proxy network is a pool of real home internet connections available for rent by the minute. When someone uses it, their traffic exits through a home IP that a consumer ISP such as Comcast assigned to a real household, instead of their actual IP. To any destination server, the request looks like it came from that household.
The IPs in the pool come from one of two sources:
Botnet-sourced (without consent): Malware installed on a victim's device routes third-party traffic through the victim's connection. The victim has no idea. Their household IP is sold in a proxy marketplace for $5–15 per GB while they pay the bandwidth bill. This is illegal in most jurisdictions.
SDK-sourced (with buried consent): A software SDK is embedded in free apps: VPNs, games, utilities, browser extensions. The terms of service, buried in thousands of words, include a clause allowing the operator to use your bandwidth. The user agreed, technically, but did not understand what they agreed to. Honeygain, IPRoyal Pawns, and similar services operate this way.
Both produce functionally identical exit IPs from a detection standpoint: real residential ISP addresses that pass every naive check. That is what sets them apart from the datacenter end of the full taxonomy of proxy types. The same supply chains now extend onto carrier networks, where mobile proxies rent 4G/5G exit IPs that are even harder to act on.
Why Basic Checks Miss Them
Understanding why you see residential proxies helps you understand why they appear in your fraud filter output:
| Check type | Why it misses residential proxies |
|---|---|
| Datacenter ASN block | Residential proxies use ISP ASNs (Comcast, Vodafone, etc.) |
| IP blocklist | Exit IPs rotate constantly; lists go stale within hours |
| VPN protocol probe | No server software running on the exit device |
| rDNS analysis | Returns a typical ISP hostname pattern |
| Geolocation check | Returns a legitimate city and residential address range |
The only reliable detection methods involve signals that residential proxies cannot fake: behavioral evidence that the IP is being used simultaneously or sequentially by many different sessions (high reuse), appearance in proxy network advertising databases, and mismatches between the IP's residential fingerprint and the session's device or behavior profile. Most of that lives at the session level. An IP lookup on its own, including GeoIPHub's VPN and proxy detection, can only infer residential-proxy status coarsely from ASN data.
The Scale of Residential Proxy Networks
The numbers are larger than most fraud teams expect:
- Bright Data (the largest residential proxy network by disclosed size) claims over 72 million residential IPs in its pool
- Oxylabs claims 100 million+ residential IPs
- Smartproxy, SOAX, and NetNut each claim tens of millions
These are the disclosed numbers from legitimate (or semi-legitimate) commercial providers. Botnet-sourced networks do not publish their pool sizes, but Lumen/Black Lotus Labs estimated over 190,000 compromised residential nodes active in a single botnet-as-a-proxy operation in 2024.
Total pool size across all providers, commercial and criminal, likely exceeds 200 million IPs. This is why volume in your traffic is unsurprising once you have detection in place.
What Residential Proxy Traffic Looks Like in Your Logs
Before detection, residential proxy traffic is invisible. After detection, patterns appear:
High IP diversity in bot campaigns: Each request in a credential stuffing attack comes from a different residential IP. Per-IP request volume stays at 1–3 requests, well below rate limits. The signal is the cross-session pattern, not the per-IP volume.
Geographic scatter: Residential proxy pools span hundreds of countries. A campaign using them will show requests from 40+ countries in a few minutes, a pattern that does not match organic traffic distribution.
Timing anomalies: Automated campaigns through residential proxies often show request timing that is too regular (sub-second intervals between logins) or too irregular (burst patterns inconsistent with human navigation speed).
Device/IP mismatch: A session claiming to be a mobile device in rural Iowa comes from a Comcast residential IP in Houston. Geolocation is consistent with a household but inconsistent with the claimed device or the session behavior.
Checking an IP: a real lookup
Before you label an address a residential proxy, look it up. Here is a real response from the GeoIPHub API for 104.28.46.99, trimmed to the fields that matter for this question:
curl https://api.geoiphub.com/v1/lookup/104.28.46.99 \
-H "x-api-key: YOUR_API_KEY"
{
"ip": "104.28.46.99",
"asn": {
"asn": 13335,
"org": "CLOUDFLARENET - Cloudflare, Inc.",
"user_type": "consumer_privacy_network"
},
"detection": {
"is_proxy": false,
"is_vpn": false,
"is_relay": true,
"is_residential_proxy": false,
"relay_provider": "iCloud Private Relay",
"anonymity_level": "medium"
},
"scoring": {
"fraud_score": 9,
"recommended_action": "allow",
"detection_methods": ["relay_ip"]
}
}
This address is not a residential proxy at all. It is an iCloud Private Relay egress, which means the person behind it is almost certainly a paying Apple customer who turned on a privacy feature. The API says so directly (is_relay: true, relay_provider: "iCloud Private Relay") and scores it 9, with a recommendation to allow.
That is the trap with "too many residential proxies" dashboards. Relay traffic, mobile carrier NAT and real proxy exits can all look alike if you only check "is this a consumer IP from an unexpected place". Read detection_methods to see which signal fired, and treat is_residential_proxy for what it is: a coarse, ASN-based inference, not a direct observation of proxy networks. Pair it with the session patterns described above before you block anyone.
How to Respond
Residential proxy detection should feed a risk score rather than a hard block in most flows. The recommended response depends on context:
The key principle: residential proxy is a strong signal but rarely a complete verdict. A legitimate privacy-conscious user might use a residential proxy service. A legitimate market researcher definitely does. Reserve hard blocks for residential proxy co-occurring with other signals: high reuse score, abuse history, behavioral anomalies, or multiple detections in the same session.
Why the Volume Is Going Up
Residential proxy detection in your tooling revealing high volumes is not a sign that detection is over-triggering. It is a sign that:
- Attackers have shifted from datacenter proxies (detectable) to residential proxies (harder to detect)
- Your detection has caught up to where the attack traffic is
- The commercial residential proxy market has grown to the point where these networks are cheap enough for low-value abuse
If your previous tooling showed low residential proxy rates, it likely was not detecting them. They were never absent. Accurate detection reveals the true volume of the attack surface.
Advertisers feel this shift most sharply, because the same rented residential IPs that defeat a login rule also defeat an ad platform's IP exclusion list. That is why detecting click fraud by IP address has to be a scoring problem rather than a blocking one.
Related Reading
- Residential Proxy Fraud Detection: The Complete Guide: detection mechanics in depth
- Account Takeover & Credential Stuffing: how residential proxies enable credential stuffing at scale
- What Is IP Reputation?: how residential proxy history feeds into reputation scoring
Start Scoring Every IP in Real Time
GeoIPHub gives fraud, security, and engineering teams a single API for IP geolocation, VPN & proxy detection, threat intelligence, and an explainable 0–100 risk score.
Get Your Free API Key
Sign up in minutes — no credit card required. Upgrade only when you need more volume.
Frequently Asked Questions
What is a residential proxy?
A residential proxy routes traffic through an IP address that belongs to a real home internet connection, assigned by a consumer ISP like Comcast or Vodafone to a household. Because the exit IP looks like a regular residential user, it bypasses checks that block datacenter IPs. Residential proxy networks are built either from malware-infected devices (hijacked without consent) or from peer-to-peer proxy apps where users trade bandwidth for something else (a 'free' VPN, a game, etc.).
Why do residential proxies appear in legitimate-looking traffic?
Because they are designed to look legitimate. The IP is a real residential address, so ASN checks pass, geolocation returns a real neighborhood, and basic fraud rules that block datacenter IPs do not trigger. Residential proxies are the tool of choice when an attacker needs to bypass IP-based controls at scale (credential stuffing, ad fraud, scraping, carding), precisely because they blend in.
How do residential proxy networks get their IPs?
Two primary sources. First, malware botnets: devices infected with malware silently route attacker traffic through the victim's home connection. The user has no idea. Second, consensual peer-to-peer networks: SDK operators embed proxy functionality into apps (VPNs, file-sharing tools, games) and users unknowingly agree to share their bandwidth in exchange for the free service. Honeygain, Peer2Profit, and similar services operate this way legally; malware botnets do the same thing illegally.
Are all residential proxy detections malicious?
No. Some legitimate residential proxy services exist for market research, ad verification, and accessibility testing. A small percentage of residential proxy traffic is from these professional use cases. However, in consumer product contexts such as ecommerce checkouts, financial account logins, and content platforms, residential proxy usage has almost no legitimate explanation from a real customer. The right response is to treat it as a high-risk signal, not an automatic block.
Why can't I just block all residential proxy IPs?
Because the IPs rotate constantly and belong to real households. Blocking a residential IP that was used as a proxy today might block a real customer tomorrow, or even at the same time, since CGNAT and shared routers mean multiple people use the same IP. The right approach is to combine residential proxy detection with other session signals and escalate to a challenge (step-up MFA, email verification) rather than a hard block in most flows.
How is residential proxy detection different from VPN detection?
VPN detection is relatively straightforward: VPN servers run server software, have datacenter ASNs, and respond to protocol probes. Residential proxies are the opposite: the exit IP is residential, the ISP is a consumer provider, and there is no server software to probe. Detection requires behavioral signals: the IP appearing in proxy network advertisements, abnormal traffic patterns, high reuse across multiple sessions, or mismatch between the IP's household characteristics and the session's behavior.