Residential Proxy Primer

A residential proxy routes traffic through an IP Address assigned to a physical location using devices at that location, such as cell-phones and laptops. The proxied traffic will inherit the connectivity of that physical location, which provides a high amount of diversity in IP Addresses type and blends the proxied traffic in with legitimate user traffic. These qualities make residential proxies very difficult to identify and the tool of choice for bypassing website restrictions while still remaining anonymous.

Some of the advertised “legitimate” use cases for residential proxies are:

• Bypassing geographic restrictions (such as regional content)
• SEO analysis
• Website scraping
• Ad verification
• Website performance testing
• Defeating rate-limits
• Anonymity or security

Some of the illegitimate things residential proxies are frequently used for:

• Click fraud
• Account creation campaigns
• Account takeover campaigns
• Purchase fraud
• Spam
• Fake reviews
• Fake social media content
• Influence campaigns (boosting content popularity)
• Denial of Inventory Attacks
• Denial of Service Attacks
• And much, much more…

It’s not a VPN

Generally, a VPN service operates IP Addresses in data centers around the world. Subscribers to the VPN service can connect in to any of these IP Addresses and use them to hide their “true” IP Address. IP Addresses for VPN services are:

• Located in a data centers, not a geographic location with users (frequently called “virtual” IPs)
• Easier to identify and fingerprint
• Dedicated to the VPN service, so all traffic is attributed to that service

Detections & Mitigation

Spur develops tools to track and attribute traffic for both VPNs and residential proxies. IP Address analysis can be useful for identifying traffic from VPNs and also discovering patterns that implicate residential proxy usage. Our IP Context API and data feeds provide service level attribution.

Residential proxies require a different approach to detection and mitigation. Because residential proxies mix their traffic with legitimate traffic at a physical location, an IP Address is insufficient to determine whether or not a connection is being proxied. We suggest using monocle (beta). Our Community Edition is free to use.