How to Detect Residential Proxies in 2026

A residential proxy defeats an IP check by construction. The address belongs to a real household, the ISP is one your customers use, and no reputation database has an opinion on it because the pool rotates the address before complaints accumulate. Behind that address the operator runs the same machine, the same browser profile and the same script for every attempt. This playbook is about detecting the machine once the address has stopped identifying anyone: how the attack is assembled, why reputation returns green, which fields in a /v1/evaluate verdict still move, and what each rung of the response needs before it fires. It is the hub for the residential-proxy posts in our fraud playbooks.

How a residential proxy attack is run

The stack has four parts, none hard to buy; we name tools and list prices because a team that has never priced them overestimates the effort on the other side.

1. Rent a pool. Residential bandwidth is sold by the gigabyte with geographic targeting included. On 2026-08-29 Oxylabs listed $6/GB on a 5 GB starter plan down to $2.50/GB at 1 TB; Decodo listed $4/GB pay as you go and a 3-day trial of 100 MB; IPRoyal listed $7.00/GB falling to $1.75/GB in bulk, with traffic that does not expire.
2. Pin the exit for as long as the action takes. Sticky sessions hold one address across a multi-page checkout or a signup with email verification: up to 24 hours at Oxylabs, up to 7 days at IPRoyal (both checked 2026-08-29). Per-request rotation is the other mode, for spreading attempts thin.
3. Put a browser profile in front of it. One antidetect profile per account (Kameleo, GoLogin, Multilogin, AdsPower, Dolphin Anty) with its own cookie jar and spoofed fingerprint, or an automation framework with stealth patches; which still trips a verdict is the subject of our antidetect browser hub.
4. Run the action and rotate. Signup, checkout, bonus claim, login attempt; any CAPTCHA goes to a solver farm at the prices in our CAPTCHA farm economics post; then the exit changes and the next attempt begins.

It enters your stack at the endpoint your customers use, from a consumer ASN, with a current Chrome user agent and a normal TLS handshake. Nothing in the request says proxy.

Where the pools come from, by class

Sourcing decides how an exit behaves under observation; the supply chain in full is in what a residential proxy is and where the addresses come from.

Why IP reputation misses residential proxies

Reputation data is real and useful, and structurally behind. Addresses are cycled to dilute complaints and spread velocity thin; by the time a database has enough reports to flag one, it has been rested and another household carries the traffic. Our own classification ties exits to named pools when it can; the operator's business is making sure most exits are not there yet.

The second failure is a misreading: network.residential: true means neither network.datacenter nor network.proxy fired — the exit looks like consumer access, which is what the pool pays for. It describes the route, not the person. The third is the reflex fix: blocking residential ASNs blocks consumer internet, and a stale denylist entry blocks a household that left the pool weeks ago; why datacenter ranges can be handled decisively and residential ones cannot is in residential versus datacenter proxies.

Test whether your stack sees it

An afternoon, nothing beyond a trial, against your own site and accounts; read the trial's terms first.

1. Take a trial from any pool above; Decodo offered 3 days and 100 MB on 2026-08-29, more than a signup flow needs.
2. Route an ordinary browser through an exit in your main market and complete the action that matters: signup, checkout, bonus claim.
3. Open whatever records the session on your side; no signal means the IP layer was your only control, and it just failed.
4. Repeat with the same browser and a different exit. Does anything on your side link the two sessions? That link is the rest of this post.

The tells that survive rotation

Three things do not rotate with the address: the machine, the story the browser tells about itself, and the operator's rate. Each row is one measurement, the field it appears in, and the weight the evidence justifies on its own; the ladder below is how they combine. The first row is the network layer's whole contribution — exits already tied to a pool, named in network.service when known — and the rest is what still moves when that row is silent.

Device continuity: the test and the limit

device.visitor_id is derived from the browser and machine, not the connection, and holds across cookie clears and private windows. In our harness run of 2026-08-12 (WKWebView profiles against the homepage scanner's keyless /api/device-intel path, which reports the same identity as visitorId) a profile kept one id across three runs with the storage jar wiped each time, timesSeen counting 1, 2, 3; two profiles with different screen sizes collapsed into one id; patching canvas and WebGL readback inside the engine did not move it. One stack behind a thousand exits is still a handful of devices; device.linked_accounts — the distinct accounts a device has touched under your key — is the multi-accounting signal, and the SQL is in our multi-accounting playbook.

The limit, from the same run: early on, each spoofed profile minted its own stable id; after some thirty sightings from one machine, no JS-level change minted a new one at all. What fired on every spoofed profile and never on the baseline was the tampering flag one layer up: continuity catches the operator who rotates exits, integrity the one who also rotates profiles — the argument in device fingerprinting versus IP intelligence.

The browser's clock against the exit: the test and the trap

Send the visitor's IANA timezone as tz (the client SDK sends it as sentinel_tz; on your own, Intl.DateTimeFormat().resolvedOptions().timeZone, no permission prompt) and the verdict adds a timezone block: reported, country, matches_ip, checked. A home-line exit whose browser clock belongs to another country is the shape of a residential proxy the network layer missed; the engine adds timezone_mismatch and escalates allow to review, never to block.

The limit: an operator who sets the profile's timezone to the exit country passes by construction; our harness grew a --tz= flag for that after a third-party checker caught a profile claiming America/New_York behind an Estonian exit our device layer had passed. It catches the careless profile; travelers land here legitimately, so it is a step-up, never a block.

Velocity on the device: the test and the limit

Count signups, checkouts and login attempts per visitor_id and per account, never per IP; the address is the measurement the pool exists to defeat. The test: run the self-test twice through different exits and confirm the counter reads 2. The limit: once a device is counted, the operator's next move is a different machine, a virtual machine or an emulator, which carry their own reason codes (virtual_machine, emulator_detected).

Browser integrity: route on the flag, not the score

In the same run the scanner's browserTampering flag, which device.antidetect and the antidetect_browser reason are built from, fired on all three spoofed profiles and never on the baseline. tamperingScore (device.tampering_score in a verdict) read 0.0029 on every profile, spoofed and unspoofed alike. Route on the boolean and its reason code; do not build a threshold on the score until it discriminates. The same pattern on a commercial tool is in our Kameleo and Undetectable live test. The limit, also measured: canvas noise alone passed the flag, so it is a plausibility check on values it can contradict, not hook detection.

Where the check goes

Server-side, after the form and its client token arrive, before the action commits. Three optional fields separate a network-only verdict from the one this post is about: fingerprintEventId (no device block without it), accountId (no linked_accounts without it) and tz. Ship it in shadow mode: log the verdict, change nothing, read the reasons for a week, then wire the decision. Placement per framework, timeouts and the fail-open path are in our Express middleware guide.

// POST /signup — after the form arrives, before the account exists.
const SIGNUPS_PER_DEVICE_PER_HOUR = 3;   // your number, from your own logs

app.post('/signup', async (req, res) => {
  const pendingId = newUserId();          // the id you are about to create
  const r = await fetch('https://maskbreak.com/v1/evaluate', {
    method: 'POST',
    headers: {
      Authorization: 'Bearer sk_test_YOUR_KEY',   // sk_test_ while you shadow
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      token: req.body.monocle,                  // hidden input the client SDK fills
      fingerprintEventId: req.body.sentinel_fp, // no device block without it
      accountId: pendingId,                     // hashed server-side; unlocks linked_accounts
      email: req.body.email,                    // adds email.disposable
      tz: req.body.sentinel_tz                  // adds the timezone block
    })
  });
  const v = await r.json();

  // The address is the one field the operator controls cheaply.
  // Everything worth counting hangs off the device instead.
  const id = v.device?.visitor_id;
  if (id) {
    await db.query(
      `INSERT INTO device_events (visitor_id, account_id, action,
         decision, risk_score, reasons, seen_at)
       VALUES ($1, $2, $3, $4, $5, $6, now())`,
      [id, pendingId, 'signup', v.decision, v.risk_score, v.reasons]
    );
  }
  const perHour = id ? await db.countEvents(id, 'signup', '1 hour') : 0;

  if (v.decision === 'block' || perHour > SIGNUPS_PER_DEVICE_PER_HOUR) {
    return res.status(403).json({ error: 'Signup unavailable.' });
  }
  const clockDisagrees = v.timezone?.checked && v.timezone.matches_ip === false;
  if (v.decision === 'review' || clockDisagrees || v.device?.times_seen === 1) {
    return res.status(202).json({ next: 'verify_email' });   // step-up, not a wall
  }
  // allow: create the account
});

With that table in place the questions are ordinary SQL: accounts per device today, devices per account, how many of either in the last hour. Persist reasons and risk_score on every row; weeks later they tell you which combination predicted fraud and which predicted a family.

To exercise the block path without a browser, send the deterministic token through the public sandbox key; nothing is billed or stored and the response carries "test": true.

curl -s -X POST https://maskbreak.com/v1/evaluate \
  -H "Authorization: Bearer sk_test_sandbox" \
  -H "Content-Type: application/json" \
  -d '{"token": "test_proxy"}'

That is abridged from the sandbox response of 2026-08-29 — every value shown is as returned. test_clean returns the opposite shape: decision: allow, residential: true, empty reasons. Neither carries a device block, because a test token has no browser behind it.

Response ladder

Residential proxy detection is a correlation problem, and correlation produces confidence, not certainty. The response carries that shape: three rungs, each with the evidence it needs, and nothing jumping a rung on a single soft signal.

An exit tied to a pool is a hard block by default; if corporate egress in your traffic is named as a proxy, a dashboard rule can move that signal to review for your key — the response then reports decision_source: "rules" with the engine's call kept in engine_decision. Route on decision, sort on risk_score: the score orders a review queue, not a second decision (our post on risk score thresholds).

What it costs you

The operator pays per attempt, by the gigabyte, at the list prices above; you pay per miss with the bonus, trial, chargeback or referral reward, and per false positive with a customer. That asymmetry is why the attack exists.

Worked model. Inputs stated, nothing measured: assume a signup flow moves 300 KB through the proxy, page, assets and API calls included. At Decodo's pay-as-you-go $4/GB (checked 2026-08-29) that is $0.0012 of bandwidth per attempt; at PacketStream's $1.00/GB (checked 2026-08-29) it is $0.0003, so a thousand attempts cost between thirty cents and $1.20 in bandwidth, plus the solver fee for any CAPTCHA, usually the larger line. A sticky ISP address for a month is $1.20 to $1.60 at Oxylabs (checked 2026-08-29). While the reward per fake account exceeds the cost per attempt, the attack pays — until the device is counted, the one cost the operator cannot rent by the gigabyte. The product-side view is on our multi-accounting page; the network-side capability is on the proxy detection page.

Checklist

• Counters and history keyed on device.visitor_id, not the IP; a per-IP rule is a rule against a CGNAT city.
• fingerprintEventId, accountId and tz on every evaluate, or the device block, linked_accounts and the timezone block never appear.
• network.residential read as a route, never a clearance; timezone.matches_ip read only when timezone.checked is true.
• Routing on device.antidetect and antidetect_browser; no threshold on tampering_score.
• Step-up on mixed evidence; block when independent layers agree or the engine already says block.
• reasons, risk_score and decision persisted on every event, shadow mode before enforcement.
• No blanket rule on residential ASNs, no denylist you cannot expire; the self-test once a quarter through a different pool.