What is a residential proxy network?¶
The practical answer¶
A residential proxy network routes traffic through consumer internet connections or devices that appear to be ordinary residential users.
The key evidential caution¶
The dangerous assumption is that a residential IP address proves the offender was physically present at that address.
It may not.
The traffic may pass through:
Key points¶
- consenting proxy users
- compromised devices
- bundled software
- malware
- commercial residential-proxy services
- mobile or broadband connections
What investigators should establish¶
Investigators should establish:
Key points¶
- which proxy service or software was involved
- whether the device owner consented
- what account purchased access
- which exit address was used
- the exact time
- what provider and proxy records exist
- whether the same customer used other exits
A residential address may make traffic appear local or ordinary.
It can also rotate rapidly between many households.
The subscriber may be an innocent intermediary.
Evidential limits¶
Do not rely on geolocation or subscriber records alone to identify the offender.
Provider account, payment, login and session records may be more useful.
Residential-proxy providers may allocate the same exit to several customers over time. Precise timestamps, ports, session identifiers and customer records are therefore essential. A subscriber record without matching proxy-session evidence may identify only the household whose connection was used as an exit.
The exit device itself may contain proxy software, malware or configuration showing participation. That evidence can establish the mechanism without proving that the device owner knew it was being used.
Where available, compare the proxy-session time with authentication, payment and control-panel activity. That may link the exit address to a customer account without treating the residential subscriber as the operator.
Operational takeaway¶
Treat residential proxy IPs as exit infrastructure, and separate the household subscriber, proxy service, customer account and actual controller.