Why a residential IP is not enough cover
The whole selling point of a residential proxy is that the exit IP belongs to a real ISP customer, so it inherits that customer’s clean reputation and a residential ASN. Against a system that only checks "is this a datacenter IP?", that works — which is exactly why scrapers pay a premium for residential over datacenter proxies.
Modern detection does not stop at IP type. It asks a harder question: "does this connection behave like one person on one home connection, or like an exit node serving many sessions?" The IP reputation is real, but the usage pattern around it is not, and that is what gives the proxy away.
The signals that expose a proxy pool
Per-IP velocity and concurrency. A genuine home connection runs a handful of sessions. A proxy exit relaying traffic for many customers shows hundreds of concurrent connections, many cookie jars, or many distinct browser fingerprints from one IP in a short window. That fan-out is the strongest single tell, and rotation cannot fix it — it is a property of the gateway, not the IP.
Pool-level statistics. Anti-bot vendors with network-wide visibility (Cloudflare, Akamai) watch for the signature of a pool: a sudden spike of requests to one sensitive endpoint arriving from a large, diverse set of residential ASNs at once. No organic event produces that distribution; a rotating proxy campaign does. ML models are trained directly on this cross-IP pattern.
Latency and round-trip analysis. Routing through a proxy adds hops and delay. JA4L and similar timing probes compare the measured RTT against what the claimed geolocation should yield — an IP that geolocates to Berlin but answers with São Paulo latency is routed through somewhere else.
Reputation and exit feeds. Commercial services (Spur, IPQS, IP2Proxy) continuously map proxy-exit IPs by buying access to the pools and recording which IPs serve traffic. Many exit nodes also have a proxy port open, which active scanning detects.
Coherence checks layered on top
Once an IP is suspected of being a proxy exit, vendors cross-check it against the rest of the request the same way lie detection checks a fingerprint. The IP’s geolocation should agree with the browser’s timezone, the Accept-Language header, and the locale reported by JS. A residential IP in Japan paired with Europe/London and en-US is incoherent — the proxy was bolted onto a profile generated elsewhere.
This is why buying clean residential IPs is necessary but not sufficient: the entire identity around the IP — timezone, language, fingerprint, and request cadence — has to be consistent with a real person living behind that IP.
How to avoid tripping it
Keep per-IP velocity low. Treat each exit IP like one human: limited concurrency, human-scale request spacing, and sticky sessions so one identity stays on one IP rather than hopping mid-session.
Match geo to identity. Align the proxy’s geolocation with the browser timezone, language, and locale. Mobile proxies raise the cost of detection further because carrier-grade NAT puts thousands of real users behind one IP, so high concurrency is expected and velocity heuristics are weaker.
Use clean, well-sourced pools. Cheap pools recycle IPs that already sit in every exit feed. A managed scraping API folds proxy quality, rotation discipline, and fingerprint coherence together so the proxy and the browser identity are consistent by construction rather than assembled by hand.