Proxies are key when it comes to bot detection and fraud detection. They play a significant role in fraudulent activities and bot operations. In this blog post, we’ll dive into what proxies are, their types, their legitimate and illegitimate uses, the risks of blocking them, and methods for detecting proxy traffic.

What is a Proxy?

A proxy is an intermediary server that sits between a client (such as a user’s computer) and the destination server (such as a website). When a client requests data from a website, the request is routed through the proxy, which forwards it to the destination server. The server then sends the response back to the proxy, which relays it to the client. This process helps mask the client’s original IP address and can provide anonymity.

Types of Proxies

There are several types of proxies, each serving different purposes. The most common types include:

1. Residential Proxies

Definition: Residential proxies use IP addresses assigned by an Internet Service Provider (ISP) to real users. They appear as legitimate users from a home network.

Pros:

• Hard to detect and block because they look like real users

• More reliable for web scraping and accessing geo-restricted content

Cons:

• Expensive compared to other types

• Slower due to being routed through real user devices

2. Datacenter Proxies

Definition: Datacenter proxies originate from cloud services or data centers rather than ISPs, meaning they do not belong to real users.

Pros:

• Faster than residential proxies

• More affordable and easier to acquire

Cons:

• Easily detected and blocked by advanced anti-bot mechanisms

• Higher likelihood of being flagged as suspicious traffic

3. ISP Proxies (Static Residential Proxies)

Definition: These are a hybrid of residential and datacenter proxies, using ISP-assigned IPs but hosted on data center infrastructure.

Pros:

• Faster than regular residential proxies

• Harder to detect than datacenter proxies

Cons:

• More expensive than datacenter proxies

• Some websites may still identify and block them

4. Mobile Proxies

Definition: Mobile proxies route traffic through mobile networks using IPs assigned to mobile devices.

Pros:

• Extremely difficult to detect due to dynamic IP rotation

• Useful for bypassing website blocks and verification systems

Cons:

• Expensive and often rented per gigabyte

• Can be slower due to mobile network congestion

How Proxies Are Used by Fraudsters and Bots

While proxies have many legitimate applications, they are also commonly exploited for fraudulent activities, including:

• Ad Fraud: Fraudsters use proxies to click on ads repeatedly, draining advertisers’ budgets.

• Credential Stuffing: Bots use proxies to cycle through stolen credentials without triggering security alerts.

• Scraping & Data Harvesting: Web scrapers use proxies to collect large amounts of data without getting blocked.

• DDoS Attacks: Attackers use proxies to mask their identity when overwhelming a target with malicious traffic.

• Bypassing Bans & Restrictions: Users evade IP bans by switching proxies, allowing them to continue fraudulent activities.

In general, fraudsters and bots use proxies for two main purposes:

1. Gain anonymity by hiding their real IP address;

2. Avoid being detected by distributing their attack across thousands of different proxy IP addresses. Thus, they can bypass traditional detection techniques, such as geoblocking and IP-based rate limiting.

Is It Safe to Block Proxy IPs?

Blocking proxy IPs in your WAF may seem like a straightforward security measure, but it comes with potential downsides. In particular, you should be careful of shared IP addresses. Indeed, certain IP addresses such as mobile IPs and corporate IPs may be shared by thousands of users. Blocking these IP addresses could engender significant false positives.

In general, most residential proxy IP addresses are used both by legitimate human users and bots. Thus, blocking the whole IP address will affect your legitimate human users.

How to Detect Proxies

Detecting proxies requires a combination of techniques, including:

While certain free proxies expose their presence in the X-Forwarded-For header, most proxies used by bots can't be detected as easily. You can use non-deterministic approaches that rely on the connection timing and latency, as well as approaches that rely on the mismatch between the user-claimed user location and other information collected in JavaScript like the timezone and the preferred languages. However, none of these approaches are 100% correct and may also catch legitimate users behind a VPN. Another approach is to use a database of proxy IPs, such as the one we provide.

Conclusion

Proxies serve both legitimate and malicious purposes. While they provide privacy, security, and accessibility benefits, they are also widely used for fraud and automated attacks. Businesses must balance security with usability when deciding whether to block proxies. Instead of a blanket ban, implementing sophisticated detection methods and analyzing behavior can help mitigate risks while maintaining a positive user experience.

If you’re interested in data related to recent proxy activity for detection purposes, you can leverage our proxy detection database.