Residential Proxy

• Request IP is assigned to a residential ISP (Comcast, AT&T, BT, Deutsche Telekom) rather than a hosting provider
• IP appears in residential proxy feed databases (Spur.us, IPQS residential proxy score)
• Extremely low session persistence — requests from the same account arrive from different residential IPs within seconds
• Requests match residential IP geolocation but behavioral signals (typing speed, mouse movement) are robotic
• High throughput from a residential IP — residential connections rarely sustain API request rates >10/second
• HTTP headers lack typical browser fingerprint artifacts (canvas fingerprint, WebGL renderer inconsistencies)
• Same residential IP used to access many unrelated services within a short window (indicates proxy pool rotation)

Spur residential proxy detection

# Spur.us provides structured data distinguishing residential proxy from legitimate residential IPs
curl -H "Token: $SPUR_TOKEN" \
  "https://api.spur.us/v2/context/72.183.45.21" \
  | jq '{as, assignment, tunnels, client}'
# Look for tunnels[].type == "RESIDENTIAL" or "MOBILE"

Behavioral biometrics (device fingerprinting)

// Collect browser signals that residential proxies cannot easily fake
const signals = {
    canvas: getCanvasFingerprint(),
    webgl: getWebGLRenderer(),
    timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
    screenRes: `${screen.width}x${screen.height}`,
    cpuCores: navigator.hardwareConcurrency,
    memory: navigator.deviceMemory,
};
// Cross-reference with IP geolocation — timezone mismatch flags proxy use

Request rate anomaly detection

from datetime import datetime, timedelta
from collections import defaultdict

def detect_residential_proxy_abuse(
    ip: str,
    request_log: list[dict],
    window_seconds: int = 10,
    threshold: int = 15,
) -> bool:
    # Flag IPs exceeding realistic residential request rates.
    recent = [r for r in request_log
              if r["ip"] == ip
              and r["ts"] > datetime.now() - timedelta(seconds=window_seconds)]
    return len(recent) > threshold

1. Integrate residential proxy detection APIs: Use Spur.us, IPQS, or MaxMind's minFraud to score incoming IPs specifically for residential proxy assignment, not just data center detection.
2. Implement behavioral biometrics: Deploy device fingerprinting and mouse/keyboard behavioral analysis. Residential proxy operators cannot easily replicate realistic human behavior across sessions.
3. Challenge on geolocation inconsistency: Detect mismatches between IP-derived timezone/location and browser-reported timezone or navigator.language. Present CAPTCHA or MFA when signals conflict.
4. Apply stricter rate limits per account: Residential proxy operators rotate IPs constantly, so IP-based rate limiting is ineffective. Rate-limit by authenticated account instead, flagging accounts with impossible travel (same account, different country within 60 seconds).
5. Monitor for account credential sharing patterns: Flag accounts accessed from a residential proxy pool (many different residential IPs, no consistent device fingerprint) as potentially compromised or fraudulent.
6. Protect against ad fraud: For advertising operations, use IAS, DoubleVerify, or HUMAN Security to filter residential proxy traffic from ad reporting to prevent invalid traffic (IVT) from inflating metrics.
7. Take legal action against commercial proxy operators: Work with legal counsel to send cease-and-desist notices to commercial residential proxy services that are harvesting your data or abusing your platform.

Hola VPN Botnet (2015): Hola VPN, with tens of millions of users, was revealed to sell users' idle bandwidth through its commercial arm Luminati (now Bright Data) as a residential proxy network — without clearly disclosing this to users. Security researchers at RSA used Hola's network to conduct denial-of-service attacks at scale, demonstrating the abuse potential of unwitting residential proxy participants.

Sneaker Bot Residential Proxy Market (2019–present): Commercial sneaker bot operators (MEK, Kodai, Wrath, NSB) pay for residential proxy subscriptions from providers like Bright Data, Smartproxy, and Oxylabs to bypass Nike, Adidas, and StockX bot protection. These bots generated an estimated $1.6 billion in excess profit for scalpers in 2021 alone, according to Distil Networks research.