How do residential proxy networks make bot traffic look like neighbourhood traffic?
Where the exit nodes come from
The supply side is ordinary devices. Free VPN apps, bundled software, and SDKs tucked into unrelated apps pay for bandwidth or offer a service in exchange for routing other people traffic through the device. The householder gets a free app. The network gets an exit node with a clean, ordinary address.
Networks pool hundreds of thousands of these nodes and sell access by the gigabyte. A bot operator buys a slice, and every request can leave from a different street, a different city, a different provider. Rotating per request is a pricing option, not a technical feat.
Why the old defences fold
IP reputation lists were built on data centre ranges and addresses with abusive histories. A fresh household address has no history, and it may serve a genuine customer an hour after it served a bot. Block it and you block the customer. Rate limits per address fail the same way: one request per address is no limit at all when addresses are disposable.
Geolocation gets shaky too. The traffic is genuinely in the country it claims, because the phone it exits from is there. What is fake is not the location. It is the intent behind the session.
Signals that survive the proxy
Behaviour is harder to rotate than addresses. Session rhythm, the order pages are requested, mouse and touch patterns on the web, and the ratio of browsing to buying all persist across address changes. So do account level facts: age of the account, its order history, whether its details keep shifting.
Providers also leak. Proxy exit nodes often present inconsistent timezones, languages, or TLS fingerprints against the household story their address tells. Any single mismatch is weak. A stack of mismatches across one session is a workable signal, and it is how serious detection earns its keep now.
There is a useful test for any vendor pitch in this space: ask what their signal does when the address is a genuine customer address, because with residential proxies it usually is. A pitch that still leans on address scoring has not understood its own problem.
What this means for a smaller store
You will not out build the proxy networks, and you do not need to. Reserve the strong challenges for the moments that carry money: login from a new context, checkout of a hyped product, gift card balance checks in bulk. Let ordinary browsing through lightly observed, because taxing every visit to fight bots is how stores end up fighting their own customers instead.
Keep reading: How do bots exploit mobile app APIs that the website never exposes?, Scrapers stealing prices: signs your catalogue is being copied, and Fake account signups: stopping bulk registrations without blocking buyers cover the nearby cases in this series.
Frequently asked questions
What is a residential proxy in plain terms?
A service that routes internet requests through real household devices, so the request appears to come from a home connection instead of a data centre. Bot operators rent that cover to defeat IP based blocking and rate limits.
Are the householders part of the fraud?
Usually they installed a free app or SDK that included proxy routing in its terms, often without understanding it. Their connection gets used, sometimes heavily. The fraud belongs to the operator renting the network, not to the phone owner whose bandwidth carries it.
Why not just block known proxy addresses?
The addresses are also genuine customer addresses, and the pool rotates constantly. Blocking them creates false refusals for real shoppers while the bot operator simply draws the next address from the pool.
What detection works when IP reputation fails?
Behavioural signals across the session, account history, and consistency checks between the claimed context and the technical fingerprints. Combined, they identify the pattern of abuse rather than the address it arrived from, which is the part the operator cannot rotate cheaply.