Residential vs Datacenter Proxies: Why One Is Almost Invisible

Buy a proxy and you are buying one thing: an address that is not yours, sitting between you and whatever you connect to. Every proxy does that. What separates the cheap ones from the expensive ones is where that address came from.

A datacenter proxy runs on a rented server. A residential proxy runs on somebody's home connection. To you they are the same API call. To the site receiving the traffic they are not comparable, and the proxy software is not the reason.

What a proxy actually changes#

A proxy terminates your connection and opens a fresh one of its own. The destination's socket is connected to the proxy, so the address it records is the proxy's. Yours never reaches it at the network layer.

Two mechanisms cover most of what is deployed. An HTTP proxy handles plain requests directly, and for anything encrypted it uses the CONNECT method, which asks the proxy to open a tunnel and then, as the MDN reference puts it, blindly forward data in both directions until the tunnel closes. The proxy moves the bytes without reading them. The alternative is SOCKS, defined in RFC 1928 as SOCKS Protocol Version 5, a framework covering both the TCP and UDP domains with a negotiated choice of authentication method.

A proxy can also volunteer where the request came from. The standardised way is the Forwarded header from RFC 7239, a Standards Track document with for, by, host and proto parameters, which replaced the ad hoc X-Forwarded-For family by putting the related values in one correlated field. Both are cooperative. A proxy sold on anonymity omits them, so a missing forwarding header is evidence of nothing.

That leaves the address as the only thing the receiving server gets for free, so every classification question collapses into one: who does this address belong to?

Where a datacenter address comes from#

A hosting company or cloud provider receives address space from a regional internet registry and announces it from its own autonomous system. Both halves are public: the registry records the allocation, the routing table records which AS originates the prefix. For the mechanics of that layer, ASN explained is the primer.

So a datacenter address answers "who is this" with the name of a business that sells servers. Look up a proxy exit on a large cloud and you get that cloud, plainly, in the organisation field. Our ASN explorer shows the organisation and the prefixes it announces; the IP lookup gives the AS behind a single address.

That signal is unusually stable. Address space changes hands rarely, so a range in a hosting network this year is very likely to still be there next year, and a classification list built on it ages well.

The compensation is why people buy them: cheap, fast, effectively free bandwidth, and the same address for as long as you keep paying. Where the destination does not care who is asking, that is the right product.

Where a residential address comes from#

A residential proxy exits through a consumer connection. The address was allocated to a broadband ISP, assigned to a subscriber, and sits in the same pool as the ISP's ordinary customers. Nothing about it is disguised, because there is nothing to disguise.

The operator cannot buy those addresses in blocks. No registry will allocate you a slice of somebody else's subscriber pool. The only route to that exit capacity is getting software onto consumer devices, and providers describe their supply in exactly those terms: peer or bandwidth-sharing programs, where a participant runs a client, an app embedding a partner's SDK, or a browser extension, and carries other people's traffic in return for payment or for the app being free.

The trade-offs invert at every point. Bandwidth is expensive because somebody's home line is paying for it, latency is worse and less predictable, and an exit vanishes when the device sleeps or the app closes, so a fixed address is either impossible or a premium feature. Pricing is per gigabyte, and the gap against a rented server is large.

People pay it for one reason. The address survives inspection, because the inspection is asking a question the address answers honestly.

Mobile proxies and the CGNAT problem#

A third category gets folded into "residential" in most catalogues and behaves differently enough to separate out. A mobile proxy exits through a cellular carrier.

Mobile networks routinely place subscribers behind carrier-grade NAT, and that addressing has its own reserved block. RFC 6598 set aside 100.64.0.0/10 as Shared Address Space, to number the interfaces connecting carrier-grade NAT devices to customer premises equipment. The RFC is explicit that this is not globally routable and that packets carrying those addresses must not be forwarded across service provider boundaries. It is deliberately distinct from the RFC 1918 private ranges, being meant for the provider's network rather than yours.

What reaches the public internet is the carrier's address on the outside of that translation, and many subscribers can be sharing it at once. That changes the economics of blocking. Refusing a hosting address costs a defender nothing. Refusing a busy carrier address can mean refusing a crowd of unrelated phone users, and abuse teams know it. Mobile exits are priced accordingly.

How detection works, and where it stops#

Almost every practical proxy detection scheme is doing one of three things, and the first two are set membership rather than inference.

Tor is the clean case. The project publishes its list of exit relays, so checking whether an address is a Tor exit is a lookup against a published file. No guesswork, no probability.

Known VPN and hosting operators are the second case. They run their own autonomous systems or lease from a fairly small set of hosting and transit networks, so a curated list of AS numbers covers a lot of ground and stays accurate for years. Our own list carries categories along those lines: cloud, hosting, CDN, VPN and transit. That is the machinery behind most "you appear to be using a VPN" messages, and how VPN detection works goes through it.

Residential proxies defeat both, structurally rather than by clever evasion. There is no autonomous system to add to a list, because the autonomous system belongs to a consumer ISP whose other customers are ordinary users you cannot afford to block. The address is genuinely allocated to a home. Every question an address lookup is capable of asking returns the truthful answer, and the truthful answer is "residential".

What is left is behavioural and lives outside the address entirely: request rate, whether the timing looks human, and whether the client's claimed identity matches the shape of its TLS handshake, the territory covered in JA3 and JA4. Those signals need the traffic itself. No lookup tool, ours included, can produce them from an address alone.

What our own classifier will and will not tell you#

Worth being precise about our own tools here, since the honest limits are the useful part.

The VPN and proxy check returns one of four verdicts: Tor exit, VPN or datacenter, residential, or unknown. With it you get a confidence level and the signals behind it: the AS number, the organisation name, our category for that AS, the country, and whether the address is on the Tor Project's published exit list.

The residential verdict is reached by exclusion. It means the autonomous system is not on our datacenter and VPN list, so the address is likely an ISP or a non-VPN business connection. The tool reports medium confidence and says as much in the methodology line it returns.

Follow that through and the conclusion is unavoidable: a residential proxy exit comes back as residential. That is not a defect in the check, it is the accurate answer to the question an address lookup can ask. A tool claiming otherwise would be dressing a guess as a finding.

The IP infrastructure classifier uses the same signals for a slightly different question. It reports a network classification of datacenter, residential or unknown, the Tor status, and a level of clean, caution or unknown. Datacenter infrastructure gets caution, on the basis that it carries more automated traffic per request than a home line. Residential gets clean. Addresses on our curated list of well-known public infrastructure, root name servers and public resolvers among them, are not marked down for datacenter hosting.

Neither endpoint reports an abuse score, and that is a choice rather than a gap. The widely used abuse feeds are licensed for non-commercial use only, and this site carries ads, so we do not query them. You get an infrastructure classification from sources we can stand behind instead. Our post on what IP reputation is covers what the scored feeds do differently.

The consent question#

Renting a server raises no questions about anyone else. Routing traffic through a stranger's home connection does, and the market has argued about it for years.

The arrangements sit on a wide spectrum. At the clear end, someone installs a client whose only purpose is sharing bandwidth, understands the deal, and is paid for it. At the murky end, the sharing is a clause in the terms of an app that does something else, and the person tapping accept has no idea other people's requests will leave their router. Same mechanism, different consent.

Two practical points follow. If you are buying, ask about sourcing and disclosure directly; a provider that will not describe how it recruits peers has told you something. If you are running an app that offers to pay for your connection, the traffic leaving your line is attributed to your address, and whatever it does arrives at your ISP with your name on it.

Reading an address in front of you#

Start with the autonomous system and the organisation name. A cloud, a hosting company or a named VPN operator settles it: the connection came from infrastructure, and you can treat it as such.

A consumer ISP means the address-level work is finished. It does not mean the visitor is a person rather than a proxy, and it does not mean they are trustworthy. It means the address is a household line, and anything further has to come from behaviour.

Working a list rather than a single address, the ordering matters more than the individual verdicts, and our guide to triaging IP addresses in a log covers how to rank them. From the other side, deciding what to route your own traffic through, how to hide your IP address compares the options without the marketing.

One habit is worth keeping through all of it. "Residential" is a statement about who owns the address, never a statement about who is using it.