Detect Residential Proxies: 5 Techniques + Free Detection API (2026)

Residential proxies have evolved into the primary vector for sophisticated credential stuffing, ad fraud, and scalping attacks. Unlike datacenter IPs, which are easily blocked via ASN filtering, residential proxies route traffic through legitimate ISP connections (Comcast, Verizon, Vodafone), making simple blacklists ineffective.

To mitigate this, security engineers must move beyond static lists and analyze the characteristics of the connection itself. This guide walks through six detection methods — each with a working code sketch — and the trade-offs that decide which proxy types you can realistically flag. For the broader landscape of who sells these pools and the hosting networks behind them, see the proxy IP ranges directory and the breakdown of residential vs. datacenter vs. mobile proxies.

How do you detect a residential proxy?

There is no single silver-bullet signal. A residential proxy is designed to look exactly like a real user, so detection works by stacking independent, individually-noisy signals into a weighted risk score. In practice a residential proxy fails two or three of the following checks at once — even though any one check, on its own, produces false positives:

1. ASN / organization — is the IP on a hosting network rather than a consumer ISP?
2. TCP/IP stack fingerprint — does the OS implied by the packets match the claimed User-Agent?
3. Latency — does the TCP round-trip time match the IP's claimed geolocation?
4. TLS/JA3 fingerprint — do many "distinct" residential IPs share one rare client fingerprint?
5. Behavioral velocity — is one account/device rotating across many residential IPs?
6. Open ports — is the device exposing SOCKS/proxy ports to the internet?

The rest of this article covers each in turn.

1. ASN and Organization Classification (the cheap first filter)

Before any deep inspection, classify the IP's ASN. Datacenter proxies announce from hosting ASNs and are range-flaggable; genuine residential IPs sit on consumer ISPs. This one lookup routes the IP down the right detection path and catches the laziest (and most common) proxy type — datacenter — for almost no cost.

# Classify the IP's ASN: consumer ISP vs. hosting/proxy network.
HOSTING_KEYWORDS = ("hosting", "datacenter", "data center", "cloud",
                    "vps", "server", "colo", "llc")

def classify_asn(ip):
    org = asn_lookup(ip).org.lower()          # e.g. "AS14061 DigitalOcean"
    if any(k in org for k in HOSTING_KEYWORDS):
        return {"type": "datacenter", "risk": 0.8}   # range-flaggable, block-safe
    return {"type": "residential", "risk": 0.2}      # needs behavioral signals below

Maintain your own list of known hosting ASNs, or lean on a curated one — the high-risk ASN directory and datacenter IP ranges track the networks that host the bulk of datacenter and rotating proxy pools.

2. TCP/IP Stack Fingerprinting

Residential proxies often involve a mismatch between the Application Layer (HTTP headers) and the Transport Layer (TCP packets). A common scenario involves a proxy node (e.g., a compromised IoT device or a mobile phone) tunneling traffic from a script running on a Linux server.

While the request headers might claim the user is on Windows 10, the TCP Initial Sequence Number (ISN), Window Size, and Options order might match a Linux kernel.

Implementation Strategy: Use passive OS fingerprinting (p0f) to compare the claimed User-Agent against the TCP signature.

# Conceptual Python logic for detection
def detect_os_mismatch(request):
    user_agent = request.headers.get('User-Agent')
    tcp_packet = request.stream.tcp_packet

    # Derive OS from TCP Window Size and MSS
    estimated_os = analyze_tcp_fingerprint(tcp_packet)
    claimed_os = parse_user_agent(user_agent)

    if claimed_os == "Windows" and estimated_os == "Linux":
        return {
            "risk_score": 0.9,
            "reason": "TCP/User-Agent Mismatch (Likely Proxy Tunnel)"
        }
    return {"risk_score": 0.0}

3. Latency Triangulation

Residential proxies introduce extra network hops. Traffic routes from the attacker → gateway → residential exit node → your server, which creates measurable timing anomalies compared to a direct residential connection.

Technique: Measure the Round Trip Time (RTT) during the TCP handshake and compare it against the physical distance implied by the IP's claimed geolocation. If the IP belongs to a residential ISP in New York, but the TCP RTT is consistently >300ms, the traffic is likely being tunneled from overseas.

# Compare geo-claimed location against measured TCP round-trip time.
# A "New York residential" IP with a 320ms handshake is being tunnelled.
KM_PER_MS = 100  # rough round-trip fiber budget

def latency_mismatch(ip, tcp_rtt_ms):
    geo = geoip_lookup(ip)                          # claimed location
    expected_ms = distance_km(geo, nearest_edge_pop(geo)) / KM_PER_MS
    if tcp_rtt_ms > max(40, expected_ms) * 2.5:
        return {"risk": 0.7, "reason": "RTT far exceeds geo distance"}
    return {"risk": 0.0}

4. Open Port Scanning (Nmap/Masscan)

Many residential proxies are compromised devices (routers, IoT) with specific ports exposed to the internet to facilitate the proxy network.

Scanning incoming IP addresses for common proxy ports is an aggressive but effective filter. Look for:

• SOCKS5: 1080
• HTTP Proxy: 3128, 8080
• MikroTik/RouterOS: 8291

Note: Port scanning can be resource-intensive and may flag false positives on legitimate users hosting services. Use with caution, out of the request path, and only as one input to the score.

// Go snippet: specific port check with strict timeout
func checkProxyPort(ip string, port int) bool {
    address := fmt.Sprintf("%s:%d", ip, port)
    conn, err := net.DialTimeout("tcp", address, 2*time.Second)
    if err != nil {
        return false
    }
    conn.Close()
    return true
}

5. TLS Fingerprinting (JA3/JA4)

While an attacker can rotate IP addresses every request, they often fail to rotate their TLS client configuration.

JA3 hashes the fields in the ClientHello packet (SSL version, cipher suites, extensions). If you see hundreds of distinct residential IPs sharing the exact same, rare JA3 hash within a short timeframe, you are looking at a botnet or a proxy network driven by a single scraping tool.

# Cluster requests by JA3 hash. Many "distinct residential" IPs sharing
# one rare JA3 fingerprint = one client behind a rotating proxy pool.
from collections import defaultdict

ja3_to_ips = defaultdict(set)

def record(ip, ja3_hash):
    ja3_to_ips[ja3_hash].add(ip)
    fanout = len(ja3_to_ips[ja3_hash])
    if fanout > 50:  # 50+ residential IPs, one client config
        return {"risk": 0.85,
                "reason": f"JA3 {ja3_hash[:8]} fans out to {fanout} residential IPs"}
    return {"risk": 0.0}

6. Behavioral and Velocity Signals

This is the signal that actually catches residential and mobile proxies, because it survives IP rotation. Proxy pools rotate exit nodes but the attacker behind them reuses accounts, devices, and request cadence. Track velocity against a stable identifier (account, device fingerprint, session) rather than against the IP.

# Residential proxy pools rotate IPs but reuse accounts and devices.
# Track velocity per stable identifier, not per IP.
def velocity_risk(account_id, device_hash, window):
    ips = distinct_ips(account_id, window)           # rotating exit nodes
    if len(ips) > 8 and same_device(device_hash, window):
        return {"risk": 0.9,
                "reason": f"{len(ips)} IPs / one device in {window} — proxy rotation"}
    return {"risk": 0.0}

Behavioral scoring is also how you handle multi-hop setups where the exit node hides the origin — see detecting proxy chains and multi-hop anonymity for the layered case.

Residential vs. datacenter vs. mobile — which proxies can you actually block?

The honest answer is that detectability varies enormously by proxy type, and your response has to match. Datacenter proxies are cheap and easy to catch on ASN/range alone. Residential and mobile proxies are expensive for the attacker but rotate across real consumer IPs, so a static blocklist is stale the moment it ships — the only durable signal is behavioral. The table below (and the fuller residential vs. datacenter vs. mobile proxies breakdown) summarizes the trade-off.

The Build vs. Buy Decision

Building an internal database of residential proxies requires maintaining scanners, honeypots, JA3 clustering pipelines, and real-time latency analyzers. This consumes significant engineering resources and bandwidth, and the data decays daily as pools rotate.

For most engineering teams, the most performant solution is integrating a specialized IP intelligence API that aggregates these signals and returns a verdict in <20ms.

Integration Example (Node.js)

const axios = require('axios');

async function checkIP(ipAddress) {
  try {
    const response = await axios.get(`https://api.ipasis.com/v1/${ipAddress}`, {
      headers: { 'X-API-Key': process.env.IPASIS_KEY }
    });

    const { is_proxy, proxy_type, risk_score } = response.data;

    if (is_proxy && proxy_type === 'residential') {
      console.log(`Blocking request from ${ipAddress}: Residential Proxy Detected`);
      return false;
    }
    return true;

  } catch (error) {
    console.error("IP Lookup Failed", error);
    // Fail open or closed depending on security posture
    return true;
  }
}

FAQ

Q: How do you detect a residential proxy? A: No single signal is definitive. Combine ASN/organization classification (is the IP on a hosting network?), TCP/IP and TLS fingerprint consistency, latency versus claimed geolocation, and behavioral velocity across rotating IPs. Score them together — a residential proxy typically fails two or three of these at once, even though each individual check is noisy.

Q: Can you block residential proxies? A: Not with a static IP or ASN blocklist. Residential proxies rotate across millions of real consumer ISP IPs, and blocking the ASN (Comcast, Vodafone) blocks legitimate customers. The workable approach is risk-based: flag on behavior and reputation, then apply step-up friction (velocity limits, verification, review) rather than a hard block.

Q: Is there a residential proxy detection API? A: Yes. Instead of running your own scanners, honeypots, and latency probes, an IP intelligence API aggregates these signals and returns a proxy verdict in <20ms. IPASIS returns is_proxy, proxy_type, and a risk score on a single REST call — see the Node.js example above.

Q: How can I tell if an IP is a proxy? A: Look it up. Check the ASN/organization, whether the IP appears in known proxy ranges, its reputation history, and whether it is making automated-grade requests. You can check any IP instantly with the IP scan tool, or programmatically via the API.

Q: Why do residential proxies bypass CAPTCHAs so easily? A: Because they look like legitimate users to Google/Cloudflare. The IP reputation is high because a real human uses that IP for Netflix/Facebook when the proxy isn't active.

Q: Can I block specific ASNs? A: For datacenter proxies, yes — they announce from hosting ASNs. For residential ASNs (like Comcast), no: you'd block legitimate customers. Filter at the IP, reputation, or behavioral level instead.

Q: What is the false positive rate for TCP fingerprinting? A: Moderate. NATs and enterprise firewalls can alter packets. This signal should be used as part of a weighted risk score, not a binary block.

Secure Your Perimeter with IPASIS

Don't let residential proxies drain your resources or scrape your proprietary data. IPASIS provides enterprise-grade IP intelligence with industry-leading accuracy in detecting VPNs, residential proxies, and Tor nodes.

Get your free API key today and stop anonymous traffic at the gate.