Why IP reputation stopped working: residential proxies
What changed
Five years ago, the bot problem had an address. Bots ran from datacenters, and datacenter IP ranges were public. A defender could block the range, rate limit the ASN, and move on. The model worked because the attacker's infrastructure looked different from a shopper's infrastructure. That difference is gone.
A residential proxy network routes requests through real devices on real home connections: phones, laptops, routers, smart TVs. The traffic carries a residential IP, a plausible user agent, and a history that looks human, because the connection is human, just borrowed. The bot is a thousand different IPs, not one, and each one looks like a shopper.
The scale is what makes it decisive. CHEQ's research on residential proxies explains the mechanism: the network rents or borrows connections at a scale that makes per-IP limits meaningless. A rate limit keyed to one IP address sees a thousand shoppers. A blocklist keyed to datacenter ranges sees nothing at all.
Why the old defences fail, one by one
IP blocking fails first, because there is no blockable range. Residential IPs are the same ranges real customers use. Blocking them blocks the customer, and the bot rotates to the next address before the block lands.
Rate limiting fails second, because the limit is per address and the bot has thousands of addresses. A limit of ten requests per minute per IP allows ten thousand requests per minute across a thousand IPs. The bot stays under every limit while exceeding all of them.
Geographic checks fail third. A residential proxy in the same city as the target's customers passes every geo check, because the IP genuinely is in that city. The traffic is local, residential, and plausible, and the only thing wrong with it is the intent behind it.
Even device fingerprinting struggles, because the bot can run a real browser on a real residential connection. The fingerprint is a real browser. The behaviour is the only layer left that can tell the difference, and behaviour is expensive to fake at scale.
What works now
Behavioural scoring is the replacement. Instead of asking where the request comes from, ask what it does: how fast it moves through the funnel, whether the mouse moves like a hand or a script, whether the session reads the page or goes straight to the action. A shopper pauses. A bot does not. That difference survives every proxy.
Challenge the grey zone instead of blocking it. A residential IP with odd behaviour gets a challenge, not a block, because it might be a real customer on a shared connection. The challenge costs a bot time and money, and it costs a real customer a second. That asymmetry is the whole defence.
And watch the account, not the address. A login that succeeds from a new device, a payout change minutes later, a burst of listings: the sequence is the signal, and it survives any proxy network, because the proxy changes the address but not the sequence. IP reputation died. Behaviour and sequence are what replaced it.
Keep reading: Why do bots love your search bar more than your homepage?, Credential stuffing: why a 0.1 percent success rate is a disaster, and Why bots read your robots.txt before they attack cover the nearby cases in this series.
Frequently asked questions
What is a residential proxy?
A residential proxy routes internet traffic through a real household connection, such as a home broadband line or a phone, instead of a datacenter server. The request carries a residential IP address, so it looks like an ordinary shopper rather than a bot running in a server farm.
Why do residential proxies defeat IP blocking?
Because the IPs are the same ranges real customers use, and the bot rotates through thousands of them. Blocking one residential IP blocks a real household, and the bot moves to the next address. There is no blockable range, because the range is the internet's residential space.
Are residential proxies illegal?
The proxy service itself is usually legal, but using it to scrape against a site's terms, to stuff credentials, or to commit fraud is not. The legality turns on what the traffic does, not on the proxy. A legitimate use is testing a site from different locations. A botnet is not.
How do you stop bots that use residential proxies?
By scoring behaviour instead of addresses: mouse movement, timing, scroll patterns, and the sequence of actions in a session. A shopper pauses and reads. A bot goes straight to the action. Challenge the grey zone instead of blocking it, and watch account-level sequences like login, payout change, and listing burst.