Basic bot protection usually starts with the IP address: if a visit comes from a hosting network or a known VPN, it is a server, not a person. Against cheap bots this works great. But fraud found an answer long ago: residential and mobile proxies. The request goes out through the address of a real home subscriber or a phone on a carrier network, and a network filter sees an ordinary user. The click is counted, the money is charged, and no lead ever arrives.
This article covers what these proxies are, where they come from, why they pass IP checks and which signals still give them away. The general background on network signals is in VPN, proxy and data center IP detection; here we focus on the case that is hardest to filter.
What a residential proxy is
A proxy is a middleman a program sends its requests through, so that the website sees the middleman's address instead of its own. Proxies differ by where that middleman lives.
- A data center proxy runs in a data center. Its address belongs to a hosting network, and that shows up in the ASN, the number of the autonomous system the IP belongs to. These visits get filtered out with almost no mistakes.
- A residential proxy sends the request through a home subscriber's address: a regular ISP, a regular apartment. Most often it is a device with an app or browser extension whose terms of service include a line about «sharing unused bandwidth». Sometimes it is an infected router or TV box.
- A mobile proxy works through a carrier SIM card: a modem or phone sitting in a «farm» that traffic is pushed through. The site sees a carrier mobile address, the same kind millions of ordinary smartphones have.
For an IP filter this difference is fundamental. A server address is almost certainly not a person. A residential or mobile address is almost always a person, and only sometimes is someone else's software running through it.
Who pushes ad traffic through proxies
Proxy networks are sold openly, and people use them for many reasons. What matters to an advertiser is that part of this traffic ends up in their campaigns:
- Click bots on pay-per-click placements. The owner of a site or zone wants the ads clicked. A bot on a server gets filtered immediately, so more advanced schemes route it through residential addresses in the right country. For how these schemes work, see the article on click farms.
- Competitor click fraud. Anyone trying to burn someone else's search ad budget knows that clicks from a single address get noticed fast. Rotating residential addresses turns every click into a «new visitor». More on this scheme in competitor click fraud.
- Fake leads. If an affiliate is paid per lead, they need leads from the right country. A script fills in the form, and the proxy supplies a local address.
- Data collection. Price scrapers, monitoring services and spy tools follow ad links through residential addresses so they do not get blocked. There may be no ill intent against you, but the click is still paid for.
Why they pass simple IP filters
An IP filter essentially asks a visit one question: «Whose address is this?» For a residential proxy the honest answer is «a home ISP in the right country». From there everything works against the advertiser:
- The ASN is clean. The network belongs to an ISP or mobile carrier, not a hosting company. Data center blocking does not touch it.
- The geo matches. A proxy network lets the buyer pick a country and even a city, so the geo filter is passed.
- The address is fresh. Rotation changes the IP on every request or every few minutes. A per-IP click cap never fires, and an IP blacklist cannot keep up with rotation.
- Reputation is blurred. Yesterday a real person sat behind that address, tomorrow it will be someone else. IP reputation databases flag some of these addresses, but late and not all of them.
- A mobile address cannot be blocked. Hundreds of subscribers go online through one carrier address (CGNAT). Blocking it hits random real people.
The takeaway is simple: by IP alone you cannot tell a residential proxy from a human. Detection works through contradictions between what the network says and what the browser, the clock and the behavior say.
How residential and mobile proxies are detected: the signals
None of the signals below proves a proxy on its own. A strong conclusion comes from three or four signals that line up on one visit or one traffic source.
A flag in proxy databases
Commercial IP databases flag addresses that have been seen in proxy networks: through scanning, honeypots and reports from other services. A «residential proxy» flag is the most direct signal, but also the least complete: the database always lags behind rotation, and an address may have been in the network only briefly. That is why the flag is used as a penalty in the trust score, not as a block.
ASN and network type versus the claimed device
The ASN is useful for residential traffic too, once you compare it with the device. A carrier mobile address paired with a desktop browser on a wide screen is odd. A home ISP in a small town paired with a «phone» whose browser fingerprint looks like an emulator is odd too. Every mismatch like this is a reason to lower trust.
Time zone and language
This is the most useful signal against proxies. The IP says «Germany», while the browser reports the time zone Asia/Ho_Chi_Minh, a Vietnamese system language and a non-German keyboard layout. A proxy swaps the address, but it does not change the settings of the device behind it. Of course, a tourist or an expat produces a similar picture, which is why this signal is weighed together with the rest.
The same browser fingerprint on different addresses
A bot farm changes addresses faster than it changes devices. If one and the same fingerprint (model, browser version, screen resolution, font set, GPU) arrives from twenty different home addresses within an hour, that is not twenty people. How fingerprints are collected and where they get spoofed is covered in headless browsers and browser fingerprinting.
Frequency from one range
Rotation changes the specific address, but not always the network. A proxy provider draws addresses from the same pools, and the log shows a burst: twenty clicks in ten minutes from one /24 subnet of one ISP, each from a new IP. A real audience is spread across many networks and neighborhoods. Grouping by subnet and ASN reveals what grouping by address hides.
On-page behavior
A human scrolls unevenly, lingers on images, misses the button. A script, even with simulated mouse movement, moves too smoothly, leaves too fast or, the other way round, stays on the page for exactly the configured number of seconds. A behavior check does not depend on the address, which is exactly why it catches proxy traffic that passed every network check.
No click ID and an odd funnel
A visit from a paid link almost always carries the platform's click ID (gclid, fbclid and the like). If the ID is missing or repeats across different visits, take a closer look. At the stats level, proxy traffic gives itself away with clicks that never convert, and with fake leads, with leads that never pick up the phone and never get approved. How to tie a click to a conversion is explained in click ID and SubID.
Why signals must be added up, not applied one by one
Every signal has its own false positives:
| Signal | Who triggers it besides a bot |
|---|---|
| Time zone does not match the country | a traveler, an expat, someone with wrong settings |
| One mobile address across many visits | ordinary subscribers of one carrier behind CGNAT |
| «Residential proxy» flag | a real person with a proxy SDK app on their device |
| Burst from one subnet | an office, a university, a dorm |
| No click ID | a forwarded link, a visit from bookmarks |
If you block on any one of them, the filter will cut off buyers. If each one adds a penalty and the decision is made on the total, the errors of individual signals cancel each other out. That is how mature systems work: an anti-fraud system builds a trust score, not a list of bans. For why network and browser checks complement each other, see JavaScript check or IP blocking.
What proxy traffic costs an advertiser
The losses come in several parts, and the click price is only the first of them.
- Paid clicks. A simple calculation: if you get 10,000 clicks a week at $0.40 and 8% of them are visits with proxy signals and not a single conversion, $320 went down the drain.
- Broken optimization. Automated bidding learns from who clicks. If many of those clicks are proxy bots, the algorithm keeps buying similar traffic, and the share of junk grows on its own.
- Handling fake leads. A fake lead costs more than the affiliate payout: the call center spends time on it, the CRM records it, and it gets clawed back at reconciliation.
- Wrong conclusions about your setups. A campaign with proxy traffic looks like «lots of clicks, low CR». You kill a creative or a geo when the real problem is the source.
To see the loss in dollars rather than by gut feeling, you need spend, clicks and conversions together for every source. How to do that and which numbers to watch is covered in how much budget is lost to bots and how to calculate ROI.
How to protect your budget: practical steps
- Cut data center proxies hard. Data centers and hosting networks almost never bring buyers in ad traffic. This is a cheap and reliable first layer.
- Residential and mobile get a penalty, not a block. A proxy flag, a time zone mismatch and a repeated fingerprint add to the score, and the decision is made on the total.
- Turn on browser and behavior checks. This layer does not depend on the IP. Without it you are nearly defenseless against residential proxies.
- Group the log by subnet and ASN, not just by address. Bursts from one range only show up that way.
- Look at the source, not the single visit. If one placement or zone has several times the share of suspicious visits compared with the rest, turn it off in the ad account itself: the filter protects your funnel, but the click is already paid for.
- Ask for refunds. Ad platforms refund proven invalid traffic, and a log with a reason for every click is your strongest argument.
How this looks in ArtisanClo
ArtisanClo filters out data center, VPN and proxy traffic, and for residential and mobile addresses it uses proxy network signals as part of the trust score, together with the browser check, time zone, language and behavior. Every click in the log shows the reason code behind the decision: you can open a visit and see exactly which signal fired. The built-in tracker counts spend, conversions, profit and ROI by campaign, so you can see how much money went on junk traffic and which source it came from. The full list of checks is on the features page.
Bottom line
Residential and mobile proxies are the main reason IP blocking stopped being enough protection. The address on such a visit is honest: a home ISP or mobile carrier in the right country. What gives it away are contradictions: the wrong time zone and language, the same fingerprint on different addresses, clicks arriving in bursts from one range, mechanical behavior, no conversions. No single signal proves a bot, but their sum almost always does. Cut data center proxies right away, penalize residential and mobile ones, add a browser check and count money by source, and proxy traffic stops being an invisible line in your spend.
