Behavior-based detection — catches rotating proxies IP lists miss

Residential Proxy Detection

Identify residential proxies and botnet exit nodes with behavior-based signals. Confidence scoring from 0–100, ISP/geo mismatch detection, and real-traffic-sourced updates catch what static IP lists cannot.

Get Free API Key Try Live Demo

0–100

Confidence score

Behavior

-based signals

Low FP

False positives

Live

Traffic signals

Overview

What is a Residential Proxy?

Residential proxies route traffic through real consumer IP addresses — often sourced from unsuspecting device owners via shady SDK deals or botnets. Unlike datacenter proxies, they appear as legitimate users in IP-based checks, making them the weapon of choice for ad fraud, sneaker bots, and account takeover attacks.

HostInfo's residential proxy detection goes beyond static IP blocklists. By analyzing behavioral signals — rotation patterns, geo/ISP mismatches, and traffic fingerprints — we catch proxies that static lists miss entirely, returning a calibrated confidence score so you can set your own risk threshold.

Detects rotating residential proxy pools
ISP and geo mismatch signals included
Calibrated 0–100 confidence score
Updated from live traffic analysis, not static lists

Sample Response

{
  "ip": "92.118.160.45",
  "residential_proxy": true,
  "confidence_score": 87,
  "behavior_signals": [
    "rotation_detected",
    "geo_mismatch"
  ],
  "isp_mismatch": true,
  "geo_mismatch": false
}

Capabilities

Key Features

Behavioral intelligence that catches what IP blocklists cannot.

Behavior-Based Detection

Rather than just matching IP blocklists, our engine analyzes behavioral patterns — rotation frequency, traffic volume anomalies, and fingerprint inconsistencies — to surface proxies no list has caught yet.

Confidence Scoring 0–100

Instead of a binary flag, receive a calibrated confidence score. Set your own threshold — block at 80+, challenge at 50+, or allow everything below 30. You control the trade-off.

ISP / Geo Mismatch Detection

Flags when the claimed ISP does not match the geographic location of the IP — a reliable signal that the connection is being relayed through a proxy pool node.

Catches Rotating Proxies

Residential proxy networks rotate IPs every few seconds to bypass blocklists. Our rotation detection signal identifies these IPs even when they haven't been seen before as proxies.

Live Traffic Signals

Detection is continuously updated from real traffic analysis across our network, not just from static lists. New proxy IPs are detected within minutes of their first observed abuse.

Low False Positive Rate

Multi-signal scoring ensures that legitimate users behind CGNATs or shared ISPs are not incorrectly flagged. Confidence scores let you tune sensitivity for your use case.

Reference

Data Fields

Every field returned by the Residential Proxy Detection API.

Field	Type	Description	Free	Pro	Max
residential_proxy	boolean	True if the IP is identified as a residential proxy exit node	✓	✓	✓
confidence_score	integer	Detection confidence from 0 (clean) to 100 (definite proxy)	✓	✓	✓
behavior_signals	array	List of triggered behavioral signals (e.g. "rotation_detected", "geo_mismatch")	—	✓	✓
last_seen_proxy	string	ISO 8601 timestamp of when this IP was last observed as a proxy	—	✓	✓
isp_mismatch	boolean	True if the registered ISP does not match the expected ISP for the IP block	—	✓	✓
geo_mismatch	boolean	True if geolocation of the IP does not match the claimed or expected region	—	—	✓

Try It Now

Live Demo

Enter any IP address to check for residential proxy signals.

Try:

// Click "Analyze" to check for residential proxy signals...

Applications

Use Cases

Where residential proxy detection makes the biggest impact.

📊

Ad Fraud Prevention

Click fraud operations rely heavily on residential proxy networks to simulate legitimate user traffic. Detect and exclude these IPs from attribution to protect ad spend and reporting accuracy.

🛒

E-Commerce Bot Protection

Sneaker bots, scalper tools, and inventory hoarding scripts use residential proxies to bypass rate limits. Flag high-confidence proxy traffic before checkout to enforce fair purchase policies.

🔐

Account Takeover Prevention

Credential stuffing attacks use residential proxies to avoid IP-based blocking. Combine our proxy score with login velocity and device fingerprinting for layered ATO defense.

Developer

API Example

Plug residential proxy scoring into your risk engine in minutes.

curl -X GET \
  "https://api.hostinfo.com/v1/ip/92.118.160.45/residential-proxy" \
  -H "Authorization: Bearer YOUR_API_KEY"

# Response:
{
  "ip": "92.118.160.45",
  "residential_proxy": true,
  "confidence_score": 87,
  "behavior_signals": ["rotation_detected", "geo_mismatch"],
  "isp_mismatch": true
}

const res = await fetch(
  'https://api.hostinfo.com/v1/ip/92.118.160.45/residential-proxy',
  { headers: { 'Authorization': 'Bearer YOUR_API_KEY' } }
);
const data = await res.json();
if (data.confidence_score > 70) {
  // High confidence proxy — block or challenge
  console.log('Proxy detected:', data.behavior_signals);
}

import requests

r = requests.get(
    "https://api.hostinfo.com/v1/ip/92.118.160.45/residential-proxy",
    headers={"Authorization": "Bearer YOUR_API_KEY"}
)
data = r.json()
score = data["confidence_score"]
if score > 70:
    print(f"Proxy score {score}: {data['behavior_signals']}")