Residential proxy detection

The problem residential proxies create

A residential proxy vendor rents out bandwidth on real home broadband connections — the same IPs your ordinary customers browse from. Bot operators pay for access, and their traffic exits through those household IPs. To your logs it looks like a genuine visitor from a genuine ISP, in a genuine country, on a genuine device.

That defeats the usual defences. IP block-lists catch datacentre and VPN traffic; they don't catch residential proxies because the exit IP is a real subscriber. Behavioural CAPTCHAs that only inspect the browser are looking at the wrong layer — the browser really is Chrome on Windows, running from a real broadband address. The problem is what sits between the browser and your server.

Ticketing platforms see this at every drop. Scalper networks rent hundreds of thousands of residential IPs, rotate them per request, and get through checkout at the same rate as real fans. Credential-stuffing tools use the same pools to slip login attempts past rate-limiters. Scraper operators buy them to look like human traffic when they read your prices, listings or listings API.

How Prosopo detects them

Three signals in combination, each of them independently useful:

TCP-layer interrogation. Prosopo inspects the TCP handshake and low-level socket behaviour of the incoming connection. Residential proxy relays leave signatures the connecting client cannot spoof from JavaScript — kernel-level fingerprints of the operating system that actually opened the socket, timing patterns of the relay, and mismatches between the network stack and the browser-claimed device. This runs before your application code ever sees the request.

Live IP intelligence. Every request is scored against IP reputation, ASN and hosting-provider footprints, geolocation deltas against previous sessions from the same identity, and a catalogue of known proxy exit nodes. Fresh proxy pools show up in the scoring before customers file support tickets.

We buy the proxies ourselves. Prosopo subscribes to the same residential proxy networks that scalpers and scrapers rent from. We probe those networks continuously, catalogue the exit IPs as they rotate, and feed that catalogue back into the detection stack. When a scalper campaign lights up a new pool, the exit IPs are already in the data.

The three signals reinforce each other. A single TCP fingerprint anomaly may just be an unusual client. A single IP intelligence hit may be a false alarm. A single vendor-catalogue match may be a legitimate residential VPN user. Two or three of them lining up on the same request is a residential proxy.

Where it fits in the platform

Residential proxy detection runs inside the same decision engine as the rest of the Prosopo platform. It is available on:

• Procaptcha — the widget on your forms. Residential proxy signals feed into the same verdict that decides whether a visitor sees the invisible pass, an image challenge or a hard block.
• Prosopo Protect — the edge deployment in front of a whole site or JSON API. Residential proxy signals are enforced on every request, not just form submissions.

The feature is included on the Enterprise plan — see the "Residential proxy and real-device farm detection" line in the tier comparison. If you already run Procaptcha or Prosopo Protect on Free or Professional and need this signal turned on, get in touch.