The hardest addresses to spot, and how we find them anyway

What it is

Every other category on this site can be recognised from the outside. A datacentre publishes its ranges, a VPN answers on a VPN port, Tor lists its own relays. A residential proxy has none of those tells: the ASN is a consumer ISP, the geography is a suburb, and the machine at the end is a phone or a router belonging to somebody who installed a free app.

That is exactly why it is the category worth paying for, and why anyone claiming to detect it should have to say how.

How we actually know

We buy access to the networks and enumerate them from the inside. A request is routed through the provider and we record the address it comes out of. Repeat that often enough and the exit pool maps itself, one confirmed address at a time. Which networks we buy from, and how many, is the one thing on this page we do not publish.

There is no inference in this. An address flagged as a residential proxy is one we have personally been given as an exit by the network selling it, which is a different kind of evidence from a heuristic that thinks a connection looks suspicious.

What to read in the response

What this flag does not mean

This only covers the providers we subscribe to, and a pool of that size is never fully enumerated. A residential proxy from a network we do not buy looks like an ordinary home connection, because that is what it is. Treat the flag as high confidence when it is true and as no information when it is false.

We also do not sweep the addresses around a confirmed one. For VPN and proxy operators that sweep pays, since they buy contiguous blocks and one hit points at many more. A residential proxy's neighbours are ordinary subscribers, so scanning them would spend 254 test slots to find nothing and would queue 254 innocent households behind the addresses a customer is waiting on.

Wiring it up

// residential_proxy is high confidence when true and silent when false, so it
// belongs on the refuse side of a rule rather than on the allow side.
if (check.residential_proxy) return refuse();

// Absence of the flag is not evidence of a clean connection. Whatever you would
// have done without this API is still the right default here.
return yourExistingRules(check);

What happens on an address nobody has seen

An address the database holds nothing on answers 404, not a low score. That is deliberate: there is no country, no operator and no ASN to return either, so a result would be a row of nulls dressed up as an answer. Treat it as no opinion rather than as clean, and decide for your own case whether to let the request through. The address goes into the scan queue and usually resolves within minutes, and the call is free on a paid plan.

Every field, every error code and the exact billing rules are in the documentation. Endpoints

The other detections, explained the same way

• Tor
• Datacentre ranges