Anatomy of a Residential Proxy Network: Who Is Really Behind That IP?

Jonathan Tomek · July 20, 2026 · proxy networks threat intelligence

Somewhere right now, a smart TV, a free-VPN user's phone, or a "passive income" app on a laptop is quietly relaying someone else's traffic. To every website on the receiving end, that traffic looks like it comes from a regular household connection — because it does. The person paying for the relay is somewhere else entirely.

That is the residential proxy economy, and it is one of the most underestimated pieces of adversary infrastructure on the internet. I have spent years mapping these networks — this post covers how they are built, why they defeat most IP-based trust decisions, and what actually works against them.

VPNs, proxies, and the gray zone between

The categories blur together in practice, but the trust model is what matters:

Network type	Exit point	Who consented?
Commercial VPN	Provider's datacenter	Provider (disclosed)
Datacenter proxy	Hosting/cloud IP space	Provider (disclosed)
Residential proxy	Someone's home connection	Often nobody who understood the question
Mobile proxy	A carrier-NAT phone IP	Same as above, with better reputation

Datacenter exits are easy to flag — ASN and allocation data give them away. Residential and mobile exits are the valuable inventory precisely because they inherit the reputation of real households and carrier NAT pools. That reputation is the product being sold.

How devices get recruited

Residential proxy networks do not hack their way to millions of exit nodes. They mostly acquire them, through a few well-worn channels:

Free VPN clients. The app gives you a tunnel out; buried in the terms, you give the operator a tunnel in. Your device becomes sellable inventory.
Bandwidth-sharing SDKs. Monetization kits embedded in otherwise ordinary apps and browser extensions, sometimes several licensing layers away from the developer who shipped them.
"Passive income" apps that pay users pennies per gigabyte to share their connection, then resell that bandwidth at a steep markup.
Malware and compromised devices — the involuntary tier, increasingly laundered through the same resale marketplaces as the "consensual" supply.

The result is a supply chain where the exit node's owner rarely understands what they agreed to, and the buyer two markets downstream never has to ask.

What it looks like from the defender's side

The frustrating part for defenders: a single residential exit is almost indistinguishable from a legitimate customer. The signal lives in the aggregate. An illustrative slice of what enriched flow logs tend to show:

ip=203.0.113.24  asn=residential-isp  sessions=412/hr  ua_families=37
tls_profiles=14  geo_claimed=US  hour_pattern=flat  ttl_variance=high

One household presenting fourteen TLS stacks and thirty-seven user-agent families in an hour is not a family sharing a router. It is an exit node. The tells that hold up at scale:

Session diversity vs. address type — behavioral variety no single household produces.
Round-the-clock flatness — real residential traffic has a circadian rhythm; rented bandwidth does not.
Network/transport mismatch — TTLs, TCP options, and TLS fingerprints that disagree with the claimed device or geography.
IP churn choreography — clients rotating through addresses with a cadence only an orchestrated pool exhibits.

Why this matters

If your fraud, abuse, or access decisions weight "residential IP in the right country" as trust, you are trusting exactly the thing this economy manufactures. That is how promotional contests get drained by bots — as CNBC covered in research I led — and it is the substrate under credential stuffing, ad fraud, scalping, and content-licensing evasion. Proxy networks are not a niche fraud problem; they are a trust infrastructure problem.

What actually works

No single blocklist fixes this — the inventory turns over too fast. What holds up is layered measurement: IP intelligence that distinguishes address type (residential, mobile, hosting) from address behavior, session-level fingerprinting that catches the network/transport mismatches above, and longitudinal tracking of the proxy operators themselves — their SDKs, marketplaces, and rotation infrastructure — rather than their momentary exits.

That operator-level view is the research MadX is building in the open. This post is the first in a series; the next installment digs into the data.