Residential proxy networks: why the worst bot traffic has a home address

How a home connection becomes inventory

The pitch to the device owner is small money or a free service: install this app, share unused bandwidth, earn credits. The SDK doing the sharing is also bundled into third party apps, where the person whose phone or TV box becomes an exit node may have agreed to terms they never read. Investigations of large networks, including the BADBOX reporting on compromised Android devices, showed supply can also come from hardware that shipped with the capability already inside.

For the buyer, the product is rotation. A credential stuffing run can attempt each login from a different residential address, a handful of attempts per address per day, staying under every per IP rate limit ever written. The traffic is distributed until it resembles weather: everywhere, low intensity, and impossible to block by address without blocking the town the addresses live in.

Why IP reputation fails here

Reputation systems score addresses on history, and a residential address has a good one: a family browsed from it this morning. The bot session inherits that score for the minutes it borrows the connection. Blocklists built on data centre ranges, the reliable tool of a decade ago, simply do not contain these addresses, and adding them means blocking real customers who share the same provider pools.

Geography stops helping too. A store's traffic from a city should mostly behave like that city's shoppers: local times, local language settings, plausible session depth. Proxy buyers rent exits by city, so the address is right while everything attached to it is wrong. The signal moves from where the traffic claims to be to how the session behaves once it arrives.

Signals that survive the borrowed address

Session behaviour is the durable layer: navigation that never loads images or fonts the way a real browser does, timing regularity across supposedly unrelated households, identical device fingerprints appearing from dozens of addresses in an hour, and journeys that go straight to login, search, or price endpoints with no browsing in between. One household acting oddly is a person. Five hundred households acting oddly in the same way is a network.

Account level data cuts deeper. Credential stuffing through residential proxies still has to test credentials, and the failure pattern at the account layer, valid usernames with wrong passwords at rates no human population produces, does not care what address carried the attempt. Defences that join the network view to the account view catch what either view misses alone.

Stop spending on IP blocklists as the primary control and say so internally, because the budget conversation matters. Put rate limits on behaviour and accounts rather than addresses: attempts per account, per credential pair pattern, per session fingerprint. Step up verification on the actions worth stealing, login, gift card balance, loyalty redemption, and let ordinary browsing run light. Friction placed on value beats friction placed on traffic.

What to do if your store is the target

Preserve the evidence when you find it. Proxy providers operate in a grey market, but the apps supplying bandwidth and the services reselling it have been named in enforcement actions and platform removals. Logs that show the pattern, timestamps, fingerprints, target endpoints, are what a provider complaint, a platform report, or a chargeback defence is built from. A chart in a slide deck is not.

Frequently asked questions