Look at the connection, not just the IP address. A residential proxy relays traffic through a real home broadband address, so IP block-lists miss it. Prosopo checks three things on each request: the TCP handshake, which shows the operating system that really opened the connection and whether it matches the device the browser claims to be; live IP intelligence about the network the request comes from; and a catalogue of exit IPs from the proxy networks Prosopo rents and probes itself. A browser that says Windows arriving over a Linux network stack is a relay, whatever the IP address looks like.
Residential proxy detection
Residential proxy networks route bot traffic through real broadband IPs, hiding behind households the same way ordinary users do. Prosopo detects them by checking the TCP connection itself against the device the browser claims to be, alongside live IP intelligence and a catalogue of proxy exit IPs from networks we rent and probe ourselves.
What Prosopo catches that others miss
TCP-layer interrogation
We inspect the TCP handshake and kernel-level socket behaviour of the incoming connection. Residential proxy relays leave signatures the connecting client cannot spoof from JavaScript. Detection happens before your application ever sees the request.
Live IP intelligence
Every request is scored against IP reputation, the network it comes from, hosting-provider footprints and operator data for known proxy and VPN services.
We buy the proxies ourselves
Prosopo subscribes to the major residential proxy vendors, the same networks scalpers, scrapers and credential-stuffing tools rent from. We probe those networks continuously and enrol the exit IPs as they rotate.
Named block reason on every catch
When a proxied request is stopped, the verdict names what fired, for example Claims Windows, but the TCP stack is Linux or iPhone traffic arriving through a proxy tunnel. No black-box risk score.
How to detect residential proxies: the short answer
A residential proxy sends bot traffic through a real home broadband connection, so the IP address passes every block-list. What gives it away is the connection itself: the network stack that opened it often isn't the one the browser claims to run on, and the exit IP turns up in the proxy networks we rent and probe ourselves. Prosopo checks both on each request, alongside IP intelligence, and names the reason on every block.
The problem residential proxies create
A residential proxy vendor rents out bandwidth on real home broadband connections — the same IPs your ordinary customers browse from. Bot operators pay for access, and their traffic exits through those household IPs. To your logs it looks like a genuine visitor from a genuine ISP, in a genuine country, on a genuine device.
That defeats the usual defences. IP block-lists catch datacentre and VPN traffic; they don't catch residential proxies because the exit IP is a real subscriber. Behavioural CAPTCHAs that only inspect the browser are looking at the wrong layer — the browser really is Chrome on Windows, running from a real broadband address. The problem is what sits between the browser and your server.
Ticketing platforms see this at every drop. Scalper networks rent hundreds of thousands of residential IPs, rotate them per request, and get through checkout at the same rate as real fans. Credential-stuffing tools use the same pools to slip login attempts past rate-limiters. Scraper operators buy them to look like human traffic when they read your prices, listings or API.
How Prosopo detects them
Three signals, checked together:
The TCP connection. Every connection carries traces of the operating system that opened it: how many network hops the first packet allows, the order of its TCP options, its window scaling. A relay rewrites those to its own. When the browser says Windows but the connection was opened by a Linux host, or an iPhone's traffic arrives with the shape of a proxy tunnel, the request is coming through something in between. The client cannot change this from JavaScript.
Live IP intelligence. Every request is scored against IP reputation, the network it comes from, hosting-provider footprints and operator data for known proxy and VPN services.
We buy the proxies ourselves. Prosopo subscribes to the same residential proxy networks that scalpers and scrapers rent from. We probe those networks continuously, catalogue the exit IPs as they rotate, and feed that catalogue back into detection. When a scalper campaign lights up a new pool, its exit IPs are already in the data.
Any one alone can have an innocent explanation: an unusual client, a shared address, or a household that also sells its bandwidth. Two or three on the same request is a relay.
Every block shows its reason in the portal in plain words, for example Claims Windows, but the TCP stack is Linux, iPhone traffic arriving through a proxy tunnel or Connecting through an undeclared VPN or tunnel.
Where it fits in the platform
Residential proxy detection runs in both Prosopo products:
- Procaptcha — the widget on your forms. Residential proxy signals feed into the same verdict that decides whether a visitor sees the invisible pass, an image challenge or a hard block.
- Prosopo Protect (Enterprise and Custom) — on your forms, API and whole site. Residential proxy signals are enforced on every request, not just form submissions.
The feature is included from the Professional plan upwards — see the "Residential proxy and device farm detection" line in the plan comparison. On the Free plan? Upgrade to Professional to turn it on.
See what's reaching your site
A Bot Exposure Assessment is a 30-minute call with an engineer. We look at your traffic, show where your current setup leaves gaps, and agree how a trial would be judged. Nothing to install first.
Questions
Something else? Ask an engineer.
How do you detect residential proxies?
How can companies detect bots hiding behind residential IP addresses?
By checking what sits between the browser and the server. The bot's browser and IP both look like a real customer's, but a relay changes how the network connection behaves, and that can be measured before the request reaches your application. Prosopo combines that with IP intelligence and its own catalogue of residential proxy exit IPs, and names the signal behind every block.
Is there residential proxy detection for fraud and trust and safety teams?
Prosopo runs residential proxy detection inline on your forms, login, API and whole site rather than as a separate IP lookup. Every block names the signal that fired, such as 'Claims Windows, but the TCP stack is Linux', and any decision can be looked up by its request ID, so fraud and trust and safety teams can see why a session was stopped. It is included from the Professional plan, and on every request with Prosopo Protect.
Why can't reCAPTCHA or hCaptcha catch residential proxies?
Both were designed for cross-site behavioural profiling of end users, not network-layer interrogation. A residential proxy relays traffic from a genuine home broadband IP with a normal browser fingerprint, so it looks like a real user to a widget that only inspects the browser side. Prosopo's residential-proxy detection runs on the connection itself — TCP handshake, socket behaviour, IP intelligence — signals a JavaScript widget cannot see.
Is this the same as a VPN or datacentre-IP block?
No. VPN and datacentre IPs are trivial to catch with a public block-list. Residential proxies deliberately route through real home broadband to defeat those lists. The harder problem is the one this page describes.
Which plan includes residential proxy detection?
Residential proxy detection is included from the Professional plan upwards. If a ticketing platform, scalper-heavy checkout or high-value signup flow is on the roadmap, it is worth turning on.
More from Prosopo
- Access Control — the Customer-Authored Layer Access Control is the customer-authored rules layer of the Prosopo platform — layered on top of the named-detector library that catches the bulk of bots by default.
- Accessible CAPTCHA: verification that does not lock people out An accessible CAPTCHA alternative. Invisible for most users, proof of work rather than an image challenge as the first escalation, image challenges disableable per site, keyboard and screen reader support.
- Enterprise Bot Protection — the Prosopo Platform Enterprise bot protection from Prosopo. A widget for your forms (Procaptcha), or protection at the edge that learns your site's normal traffic (Prosopo Protect), with one dashboard for both. Every block comes with a reason, in plain words, rather than a black-box score.
- Invisible CAPTCHA Prosopo's Invisible CAPTCHA is the invisible-first mode of Procaptcha — real users see nothing, and every block on a suspected bot comes with a reason you can read.
- Procaptcha: the GDPR-compliant CAPTCHA widget Procaptcha is Prosopo's CAPTCHA widget — a drop-in reCAPTCHA and hCaptcha replacement, cookieless by default, GDPR-compliant, free for the first 10,000 requests a month.
- Prosopo Protect — Site-Wide and API Bot Protection Site-wide, API and form bot protection from Prosopo, sold as the Enterprise and Custom plans. Add it as a script tag on your forms, an edge worker (Cloudflare Workers or AWS Lambda@Edge), or both. Access Rules on every request, allow/block/challenge verdicts, branded interstitials on HTML pages, clean HTTP status + header on JSON APIs.