HOW SITES DETECT PROXY USAGE

Method 1: ASN Blacklisting

The most common and crudest detection method. Every IP address belongs to an Autonomous System Number (ASN) — a network block owned by an organization. ASN reputation databases (MaxMind, IP2Location, ipinfo.io) classify ASNs by type: residential, business, datacenter, hosting, proxy, VPN, Tor.

Sites query these databases in real-time. AWS (AS16509), GCP (AS15169), Hetzner (AS24940), OVH (AS16276) are tagged as "hosting" — automatic high bot score. Known proxy provider ASNs are tagged "proxy" — instant block on many sites.

ASN Database Accuracy

Method 2: Velocity Analysis

Track requests per IP per time window. Normal human browsing: 5-20 page views per session, spaced 10-60 seconds apart, natural path through the site. Bot behavior: dozens of requests per minute, systematic URL patterns, no session depth.

Even with IP rotation, velocity analysis catches sequential rotation — seeing IPs 1, 2, 3, 4 each make one request per second is obviously a bot. Techniques that defeat basic velocity: randomized delays (1-5 seconds between requests), variable request depth per IP, session-based access patterns.

Velocity at CGNAT Scale

Mobile CGNAT means one public IP is shared by thousands of devices simultaneously. When a site sees 1000 requests from a T-Mobile IP in one minute, that's perfectly normal — thousands of T-Mobile users could be visiting simultaneously. The velocity signal is meaningless for carrier IPs. Sites know this and don't flag carrier IP velocity.

Method 3: Reverse DNS & WHOIS

Reverse DNS lookup: query the PTR record for the IP. The hostname often reveals the owner. Proxy hostname patterns: proxy.brightdata.com, rp.oxylabs.io, gate.residential.provider.com. One lookup reveals the proxy provider.

WHOIS lookup: query the IP's registration data. Proxy provider IPs are often registered to known proxy companies. Even "residential" providers sometimes register ASNs under corporate names that appear in detection databases.

Mobile Carrier Hostnames

T-Mobile reverse DNS: pool-72-xxx.wireless.att.net or similar carrier-standard patterns. AT&T: mobile-xxx.wireless.att.net. These hostnames confirm the IP is a carrier mobile connection — no proxy flag triggered.

Method 4: TLS/JA3 Fingerprinting

Your TLS ClientHello contains: supported cipher suites, TLS extensions, supported elliptic curves, and compression methods. These fields, combined in a specific order, create a unique fingerprint. Python requests library, Chrome on macOS, and Firefox on Android all produce different JA3 hashes.

Detection: your User-Agent says "Chrome 126 on Windows" but your JA3 hash matches Python requests. That's a mismatch — bot signal. Or: User-Agent says "iPhone Safari" but JA3 matches a server-side TLS library. Instant flag.

# Check your JA3 fingerprint
curl https://tls.peet.ws/api/all | python3 -c "
import json,sys
data = json.load(sys.stdin)
print('JA3:', data['tls']['ja3'])
print('JA3N:', data['tls']['ja3_hash'])
"

# Real Chrome on Linux: 
# JA3: 771,4865-4866-4867-49195-49199...
# Real mobile Safari:
# JA3: 771,4865-4866-4867-49195-49199... (different cipher order)

Method 5: Behavioral Anomalies

JavaScript-based detection collects behavioral signals invisibly. These don't require user interaction:

• Mouse entropy: Real users move mice unpredictably. Headless browsers show zero mouse movement. Stealth plugins inject random micro-movements.
• Scroll behavior: Humans scroll, pause, scroll more. Bots load full page then extract data.
• Interaction timing: Human click takes 100-300ms after page load. Bot clicks happen in milliseconds or never.
• Canvas/WebGL: Real GPU produces expected rendering. Headless virtualized GPU produces different output.
• Navigator properties: navigator.webdriver === true in headless Chrome. Stealth plugins fix this.
• Timezone consistency: IP says US/New_York, browser reports UTC+5:30. Mismatch = proxy user.

Combined Scoring: How Commercial Systems Work

Cloudflare, DataDome, PerimeterX don't rely on any single signal. They build a composite risk score: IP reputation (30% weight) + TLS fingerprint (25%) + behavioral signals (25%) + request pattern (20%). Score 0-100: above 70 = block or challenge.

The key insight: each signal alone is insufficient. A datacenter IP with perfect browser behavior scores 40 — blocked. A mobile IP with perfect browser behavior scores 8 — passes. A mobile IP with headless browser behavior scores 35 — challenged but probably passes.

Evasion by Proxy Type