# Residential Proxies: Why Your Blocklist Keeps Missing the Bots

Source: https://botbulwark.com/blog/2026-11-10-residential-proxies-blocklist-missing-bots.html

[Home](../index.md) / [Blog](index.md)


**Short answer:** A residential proxy borrows a real home's IP address, so your blocklist sees a customer, not a botnet. Four out of five requests from residential proxy IPs are ordinary traffic from real households, which is why blocking the address blocks the household. The defense moved to per-request signals: latency, TLS fingerprint, and behavior.

## The address stopped being the signal

A residential proxy routes someone else's traffic through an IP address that an ISP assigned to a household device: a phone, a router, a smart TV. The session behind it can belong to anyone: a scraper, a credential stuffing bot, or a fraud ring renting that connection by the gigabyte. The traffic inherits the reputation of a legitimate household, and the standard checks wave it through. IP reputation was the cheapest signal bot defense ever had, and residential proxies broke it by borrowing the reputation instead of faking it.

The scale is what makes the blocklist useless. Cloudflare's bot management model classifies more than 17 million unique IPs per hour as participating in residential proxy attacks, across more than 45,000 ASNs in 237 countries and regions. A credential stuffing run can spread thousands of login attempts across thousands of addresses, each of which appears once, politely, and never again. Per-IP thresholds see nothing worth flagging, because there is nothing to flag on any single IP. [Rate limiting alone never stops a distributed attack](https://botbulwark.com/blog/2026-11-07-rate-limiting-alone-fails-bots.md) for exactly this reason: the limit is per address, and the attack has unlimited addresses.

## Why blocking the IP blocks the household

The device hosting a proxy exit node keeps being someone's actual device. The software routes third-party traffic in the background while the owner streams, shops, and reads the news on the same connection. Cloudflare put a number on this while training its detection models: four out of five requests from residential proxy IPs came from legitimate, direct connections, not proxied ones. A reputation system that flags the IP and blocks everything from it gets exactly one decision right in five.

The FBI's March 2026 public service announcement documented five ways devices end up in a residential proxy network: SDKs embedded in free apps, free VPNs with buried terms, compromised IoT hardware, malware in pirated content, and bandwidth-sharing schemes that pay users for their connection. The same announcement lists eleven criminal uses, from credential stuffing to account takeover with geo-matched IPs. The household did not sign up to host a botnet. It installed a free app, and the app brought the botnet with it. [Headless browsers get spotted the same way](https://botbulwark.com/blog/2026-11-06-headless-browsers-bot-detection.md): not by where they come from, but by how they behave once they arrive.

## What Cloudflare measures instead

Cloudflare's current bot management model, v8, classifies residential proxy traffic on a per-request basis, combining network latency signatures with behavioral features, precisely so it can avoid blocklisting IPs. A proxied request has to traverse more hops than a direct one, and Cloudflare found it could characterize residential proxy traffic with a high true positive rate on latency alone. The extra hop is physically detectable and you cannot remove it. The model analyzes an average of over 46 million HTTP requests per second, and the latency signal works because physics does not care about your proxy subscription.

The second layer is fingerprinting, and it is the layer most scrapers fail. Every TLS client announces which cipher suites it supports, which extensions it sends, and in what order, so a request from a scripting library can be classified before a single header is inspected. Then come the consistency checks: a German IP with a US-English browser locale and a New York timezone is a contradiction, and filling a form in 80 milliseconds is not human. A premium residential IP cannot fix any of those, which is why teams sometimes see premium residential IPs lose to plain datacenter IPs whose requests are otherwise consistent.

## The defense that actually works

Stop defending the address and start defending the request. Score each request on latency, TLS fingerprint, browser consistency, and behavior over the session, and challenge or block on the score, not on the IP. Keep the IP reputation list, but use it as one vote among several, never as the verdict. And measure the false positive rate on real customers, because a defense that blocks one household in five is a defense your support team will disable within a week. [Behavioral signals work where CAPTCHAs do not](https://botbulwark.com/blog/2026-11-08-bot-detection-without-captcha-behavioral-signals.md), and the reason is the same: the bot can rent a clean IP, but it cannot rent a human's timing.

## Frequently asked questions

### What is a residential proxy?

A residential proxy routes traffic through an IP address assigned by an ISP to a household device, such as a phone or router. The traffic inherits the reputation of a real home, so IP-based blocklists see a customer instead of a bot.

### Why can't I just block residential proxy IPs?

Because four out of five requests from those IPs are legitimate traffic from the household itself. Blocking the address blocks real customers, and the proxy exit nodes churn as apps open and close, so any static list decays the day it ships.

### How does Cloudflare detect residential proxy traffic?

Its v8 bot management model classifies traffic per request, using latency signatures, since a proxied request traverses an extra hop, plus behavioral features and TLS fingerprinting. It explicitly avoids IP blocklisting to keep legitimate residential users unblocked.

### Do premium residential proxies beat detection?

No. They fix the IP reputation layer, which is the layer sites used to rely on most. Modern systems also judge TLS and browser fingerprints, request timing, and whether the browser's settings match the exit location, and a premium IP fixes none of those.

[Get a free bot-traffic audit](mailto:hello@botbulwark.com?subject=Free%20free%20bot-traffic%20audit)