A residential proxy is an intermediary that relays a customer's internet traffic through a device sitting on an ordinary home broadband connection, so the request arrives at its destination carrying an address issued by a consumer internet service provider rather than one registered to a data centre. The device in the middle, typically a phone, computer, streaming box or smart television owned by an unrelated person, is known as an exit node. The server at the far end sees a household.

The arrangement exists because an IP address, the numeric label identifying a device on a network, still functions as a crude trust signal. Data centre ranges are published, easy to classify and routinely blocked by websites, advertising verification vendors and platform defences. Consumer ranges are not. Routing through one converts traffic that would be filtered into traffic that looks like a person at home. The same infrastructure serves price monitoring, ad verification, fraud and mass scraping without changing shape.

How a request travels

Customers never contact the exit node. Traffic enters at a gateway, sold as a backconnect entry point or super proxy, over an HTTP CONNECT tunnel or the SOCKS5 protocol, and authentication doubles as configuration. Providers encode targeting instructions inside the username string, so one credential can specify a country using ISO 3166-1 alpha-2 codes, a city, or a particular autonomous system number, the identifier assigned to each network operator. The gateway selects a matching node, forwards the request and returns the response along the same path.

Two session modes cover most work. Rotating mode issues a fresh address for every request, which suits stateless collection at volume. Sticky mode pins one address to a session for a defined period, commonly one minute to two hours, preserving continuity for anything involving a login. Rotation is a setting, not a property of the network.

Bandwidth, not addresses, is the billing unit. A survey of ten providers' published rates on August 13, 2026 by the scraping tool operator Serpent API found advertised prices between $0.49 and $4.90 per gigabyte, with minimum plan sizes pushing the effective cost for a five gigabyte buyer to between $1 and $40. Static residential addresses are sold per address per month instead, and mobile addresses from carrier ranges cost the most.

Where the addresses come from

Three supply routes feed the same pools, differing mainly in whether the householder knows.

The first is paid software development kit placement: developers embed proxy code and the user meets a consent screen. Research by the security firm Spur, published on June 22, 2026, found proxy components in 2,058 of 6,038 LG and Samsung smart television applications, roughly a third. On LG's webOS store the figure reached 1,213 of 2,851 applications tested, close to 43 percent, against more than a quarter on Samsung's Tizen. Bright Data, the Israeli company that grew out of the free VPN service Hola, accounted for a majority of the kits identified on both platforms. A Pac-Man game promoted in Samsung's Editor's Choice section offered players a choice between watching advertisements and letting the television carry strangers' traffic. Once accepted, the tunnel kept running after the game was closed and stopped only when the application was deleted.

The second is bundling inside consumer utilities, where proxy duty pays for a free product. The third is malware, skipping consent entirely.

Origin and evolution

The commercial model dates to 2014, when Luminati Networks began selling access to the user base of Hola, a free VPN, as exit nodes. It surfaced publicly in May 2015 after 8chan administrator Fredrick Brennan traced a flood of requests that crashed his site to the network. Hola's owners, Brennan wrote, had realised "they basically have a 9 million IP strong botnet on their hands", according to The Register. Hola amended its FAQ to disclose the exit-node arrangement. Luminati was sold to the London investment fund EMK Capital in 2017 and later renamed Bright Data.

Standards caught up in the same period. The Media Rating Council, which accredits media measurement in the United States, issued its Invalid Traffic Detection and Filtration Guidelines addendum on October 27, 2015, placing invalid proxy traffic in the Sophisticated Invalid Traffic category and defining it as originating from "an intermediary proxy device that exists to manipulate traffic counts". An update became final on June 25, 2020.

Criminal supply scaled faster than the standards. The United States Justice Department dismantled 911 S5 in May 2024, a service built from malware hidden inside free VPN applications that covered more than 19 million unique addresses across over 190 countries, 613,841 of them in the United States. Administrator YunHe Wang was arrested in Singapore on May 24, 2024.

The pattern repeated on connected devices. BADBOX 2.0 compromised more than 10 million off-brand Android devices and sold proxy access at $13.64 per five gigabytes while generating five billion fraudulent ad requests a week at peak. Google filed suit in New York on July 11, 2025 against 25 unnamed defendants under racketeering statutes, and a default judgment with a permanent injunction followed on September 18, 2025.

Why it matters to media buyers

Residential exit points break the assumption underneath most fraud filtering, that origin predicts legitimacy. HUMAN Security announced on July 7, 2026 the disruption of NewsJunkie, a connected television scheme whose more evasive variant paired residential addresses with forged device information, reaching nearly two billion invalid bid requests a day per seller at its peak. IAB Europe's programmatic CTV guide drew the same lesson from BADBOX 2.0: classic ad tech signals cannot carry media quality alone when proxy tactics make abusive traffic resemble ordinary viewing.

Verification depends on the signal that proxies degrade. Vendors check addresses against databases of data centre ranges and known proxy networks, a method whose resolution falls as unrelated parties share exit points. Google gave AdSense publishers a toggle on June 1, 2026 to share full rather than truncated addresses with demand partners precisely because truncation costs detection resolution. The underlying signal was already thin: Stanford researchers found that 5 percent of addresses send 55 percent of web requests and that 44 percent of client addresses carry two or more user agents. An Adalytics investigation covered in March 2025 found pre-bid systems missing browser, device and address credentialsfrom some of the largest buying platforms.

Publishers see it from the other side. The donor database PatronView recorded unique addresses climbing from about 18,000 a day to 124,000 on July 31, 2026, concentrated on American consumer connections and passing every geographic and infrastructure filter, with nothing about the site changed.

Detection and its limits

Because an exit node is a real household address on a consumer network, registry data cannot classify it. Detection works behaviourally instead: counting unrelated user agents behind a single address, spotting implausible movement between locations, and comparing the geolocation of the originating address against local signals from the device. United States patent 10,834,090 on proxy server detection describes matching an address against the client's reported time zone and preferred language.

The confounder is address sharing. Carrier-grade translation already places many households behind one public address, and IPv4 scarcity strengthens that incentive, so strict blocking punishes bystanders. Native controls fare no better: a Madrid agency demonstrated in 2026 that Google Ads exclusion lists can be defeated by separating the address that harvests a click identifier from the one that spends it.

The industry dispute is about consent quality rather than legality. Spur's Trevor Sutter argued that a single prompt buried inside a television application substitutes poorly for transparency and ongoing control, and that whoever taps accept may be a minor. Bright Data, in a statement given to KrebsOnSecurity, said its network rests on consent and vetting: "Every peer opts in through a dedicated screen and receives value in return", adding that its practices had passed a second independent PwC audit.

Platform holders took the narrower position, with LG senior vice president John Taylor saying "a residential proxy network is not an intended use for LG smart TVs" and promising suspension for developers who do not comply. Courts are being asked about the customers. Reddit sued Perplexity AI alongside proxy suppliers Oxylabs and AWMProxy on October 22, 2025 over alleged circumvention of technological controls, noting that one defendant advertises more than 62,000 addresses in New York alone.

Not the same as

A data centre proxy relays through server hardware in a hosting facility. It is faster and cheaper, and trivially classified by its autonomous system.

A VPN encrypts a user's own traffic to a chosen server. Direction is the difference: VPN customers take an address for themselves, proxy customers take other people's connections.

A static residential or ISP proxy holds an address registered to an internet service provider but hosted on server hardware, combining consumer reputation with data centre stability.

A programmatic proxy concerns account access and campaign management inside advertising platforms. It shares the word and nothing else.

Recent developments

Enforcement has moved to the operating system layer. LG Electronics USA said on July 21, 2026 it would suspend non-compliant webOS applications, and Samsung followed on August 3, 2026 with restrictions on new registrations carrying proxy functionality, a policy ban and a retrospective sweep of the Tizen catalogue, with no completion date attached. Amazon bars the category outright and Roku prohibits the Bright Data kit.

Litigation continues. Judge Paul Engelmayer allowed Reddit's claims to proceed in late July 2026, and related scraping cases remain active in two districts. Filtration, meanwhile, still rests on the client-supplied signals a proxy exists to make unremarkable, the measurement problem set out in Explaining invalid traffic.

Timeline

  • 2014: Luminati Networks begins selling access to Hola VPN users as exit nodes, the first large commercial residential proxy network.
  • May 2015: 8chan administrator Fredrick Brennan traces a site-crashing traffic flood to the Luminati network; Hola amends its FAQ to disclose the arrangement.
  • October 27, 2015: The Media Rating Council issues its invalid traffic addendum, classifying invalid proxy traffic as Sophisticated Invalid Traffic.
  • 2017: Luminati is sold to EMK Capital and later renamed Bright Data.
  • June 25, 2020: The updated MRC invalid traffic guidelines become final.
  • May 24, 2024: YunHe Wang is arrested in Singapore; the Justice Department dismantles the 911 S5 proxy service covering 19 million addresses.
  • July 11, 2025: Google sues 25 unnamed defendants over BADBOX 2.0, which sold proxy access to more than 10 million compromised devices.
  • September 18, 2025: A default judgment and permanent injunction are entered in the BADBOX 2.0 case.
  • October 22, 2025: Reddit sues Perplexity AI, Oxylabs, AWMProxy and SerpApi over alleged circumvention of scraping controls.
  • June 22, 2026: Spur publishes research finding proxy kits in 2,058 of 6,038 smart television applications tested.
  • July 7, 2026: HUMAN Security discloses NewsJunkie, a CTV fraud scheme routing through residential addresses.
  • July 21, 2026: LG Electronics USA says it will suspend webOS applications retaining proxy functionality.
  • August 3, 2026: Samsung restricts new Tizen registrations containing proxy code and bans the kits by policy.

Summary

Who: Commercial providers such as Bright Data and Oxylabs operate the networks; application developers supply the nodes; scrapers, verification firms, fraud operators and platform abuse teams buy the traffic. Householders own the connections.

What: A residential proxy relays a customer's requests through a consumer device so they arrive carrying an internet service provider address rather than a data centre one. Gateways handle authentication and targeting, with rotating or sticky sessions billed by the gigabyte.

When: Commercially since 2014, publicly contested since May 2015, and a named category in measurement standards since the MRC addendum of October 27, 2015.

Where: Everywhere addresses are read as identity, including programmatic bid requests, connected television supply, search results pages, retail price data and platform login checks.

Why: Origin still governs trust online. Because consumer addresses are the hardest to classify and the most expensive to block without collateral damage, they are worth paying for, and the same routing that supports legitimate data collection makes invalid traffic difficult to see.