What Is a Residential Proxy? How It Works and Where the IPs Come From

A residential proxy is a relay for your web traffic. It sends each request out through an IP address that an internet provider gave to a home or a small business. The website sees that address, the provider behind it and its city in place of yours. The addresses come from software running on ordinary devices. Some of that software pays people for spare bandwidth, some hides inside free apps, and some is malware.

Providers sell the traffic by the gigabyte. Across 60 providers whose price lists we recorded between July and October 2026, the smallest plan cost a median $3.65 per GB.

How does a residential proxy work?

A request passes at least two machines on its way to the website: the provider's gateway and an exit device in somebody's home. You point your program at the gateway once, with the address and login the provider gives you. The gateway picks an exit device, the device sends your request on, and the answer comes back the same way. The 2019 study that first measured these networks describes the gateway this way: it "forwards the client's requests to different residential hosts, which further send them to the target and get responses back".

In the network Google took apart in January 2026, IPIDEA, the exit device opened every connection itself. Google's report lists the steps:

1. On start, the device contacts one of a set of domains and receives a list of relay servers.
2. It asks a relay server for work at short intervals.
3. When a customer's request is waiting, the relay names the destination, and the device opens a second connection to collect the data.
4. The device connects to the destination and sends the data on "unmodified".

Large networks keep several layers of servers behind the gateway you see. The 2019 study found "hidden backend gateways" between customers and exits, and Google counted about 7,400 relay servers in IPIDEA's network. The study calls the whole design a back-connect proxy, which is why our guide to backconnect proxies covers the same ground.

How long one exit lasts. You choose. The gateway can pick a new exit for every request, keep one exit for a set time, or switch when you send a new session id. The 2019 study named these modes non-sticky, sticky and half-sticky. Exits also go offline, and a sticky gateway then moves you to the next one. In that study, 90% of exit addresses showed a short relaying time, which the authors put at 870 seconds.

Where the name lookup happens. Before a request can travel, the website's name has to be turned into an address. Some providers let you choose whether the exit device or the gateway does that lookup. The choice matters because the website's own name server can see who asked.

What the exit device can read. For an HTTPS site, your program asks the proxy for a tunnel with the CONNECT method. From then on the proxy does "blind forwarding of data, in both directions", says the HTTP standard, RFC 9110. The exit carries encrypted bytes it cannot read. Plain HTTP has no such cover and reaches the exit as readable text. When researchers tested five networks for the 2019 study, they encrypted their own test traffic "to prevent potential content inspection".

What does a website see when you use one?

A website sees one thing about the connection for certain: the exit address. From that address it can look up the network the address belongs to, the company that owns the network, and a rough location. The network carries a number of its own, the autonomous system number or ASN.

We ran two public name servers through our own IP lookup on October 12, 2026:

Neither address is a proxy, and neither sits in a home. Both are servers. The lookup still files the Comcast server as residential, because the label follows the owner of the network. A residential proxy rests on that rule. Its exit belongs to a consumer provider, so a site starts by treating it like any other customer of that provider.

Why sites are slow to block these addresses. Cloudflare studied traffic from residential proxy networks in 2024. It found that "4 out of 5 requests from these networks belong to direct and benign connections": the same home addresses mostly carry their owners' own browsing. Block-listing them "would result in blocking legitimate traffic", Cloudflare concluded. Its model compares direct and proxied requests and weighs behavior and latency. In June 2024 that model was flagging more than 17 million addresses an hour as part of residential proxy attacks. They sat in more than 45,000 networks across 237 countries and regions.

The address is one signal among several. A site also reads the software behind the connection. JA3 and JA4 fingerprints "identify TLS clients based on how they initiate connections", says Cloudflare's documentation. A scraper that sends a browser's name in its headers, yet opens TLS like a script, can be spotted through any exit. Our guide to JA3 and JA4 fingerprinting shows that check, and how websites detect proxies covers the others.

Which kinds of residential proxy are sold?

Providers sell three products under the residential name. They differ in where the address lives.

The static kind surprises many buyers. Bright Data's documentation describes its ISP proxies as "residential IPs bought or leased from Internet Service Providers (ISPs) for commercial use, rather than for use from private homes". The same page says they are "actually hosted on servers". Sites still class them with home addresses, for the reason the Comcast server above came back residential. The address stays yours for as long as you rent it. It also runs at server speed, which the documentation names as the point of the product.

ISP proxies are sold both dedicated to one customer and shared. Oxylabs, for one, lists Dedicated ISP Proxies and ISP Proxies as separate products. The trade-offs between the rotating and static kinds are in rotating vs static residential proxies. Sessions are explained in sticky vs rotating sessions, and the carrier kind in what a mobile proxy is.

Each kind has its own comparison. ISP vs residential proxies sets the static kind against the rotating one, with real prices, and the best ISP proxies compares eleven sellers per IP. Mobile vs residential proxies does the same for carrier addresses. What sellers mean by a private or dedicated residential proxy is in private residential proxies.

Where do residential proxy IPs come from?

A rotating exit is usually a phone, a computer, a TV box or a router that belongs to someone else. Providers recruit those devices in four ways, and each of them is on the public record.

Apps that pay for bandwidth

Cisco Talos called these apps "proxyware" in 2021. Their users "share a percentage of their bandwidth with other internet users for a fee", and the provider "sells access to this network". Talos named five such apps, Honeygain, Nanowire, Peer2Profit and PacketStream among them. It also found malware that installed such apps on victims' computers to collect the payouts. The pay per gigabyte is small. In August 2026, Honeygain published a rate of $0.10 per GB and Pawns $0.20 per GB. Our data study of the other end of a residential proxy follows that gap.

Code kits inside other apps

A proxy SDK is a library that an app maker adds to an app. The app keeps working as before, and the device also becomes an exit node. A 2021 study found four providers offering such kits to app makers, at "$50K per month per 1M MAU", or monthly active users. It counted 1,701 Android app files with a proxy SDK inside, most of them on Google Play, with at least 300 million installations between them. One SDK "stealthily relays traffic without showing any notifications".

Google found the same model at IPIDEA, which paid developers "usually on a per-download basis". It tied more than 600 Android apps and 3,075 Windows files to IPIDEA's servers. Many of those apps "did not disclose that they enrolled devices" into the network, Google wrote. Cloudflare had reported the channel in 2024 as well: proxy SDKs placed in "popular browser extensions and mobile applications".

A free VPN in exchange

Luminati, which the 2019 study counted among the most prominent providers, grew this way. In 2017, joining Luminati's network meant installing the free Hola client. Its members "can get their traffic relayed by other members at the cost of proxying others' traffic", the 2019 study reports. US patent records show that Luminati Networks Ltd. renamed itself Bright Data Ltd. in March 2021. Cloudflare still listed free VPN partnerships as a source of residential IPs in 2024.

Malware and backdoors

Some devices join without anyone's choice. The 911 S5 botnet "compromised approximately 19 million IP addresses", according to the US Treasury. It sold access to them as a residential proxy service, often to criminals, and the Treasury sanctioned its operator in May 2024. The same notice names him as the registered subscriber of two VPN services, MaskVPN and DewVPN.

In June 2025 the FBI warned about TV streaming boxes, projectors, car infotainment units and digital picture frames. Some arrive with malicious software installed "prior to the users purchase", and others pick it up during setup. Infected devices can end up in "residential proxy services known to be used for malicious activity", the FBI wrote.

Commercial networks were part of the picture too. The 2019 study profiled the devices behind the exits of five commercial networks and found 237,029 IoT systems, "such as web camera, DVR, and printer". It concluded that none of the five was "a completely consent-based anonymity system". Our account of what happened to 911 S5 tells that case in full.

Why can one pool carry many brand names?

A brand name says little about the pool behind it. The 2019 study bought access to five networks and found two linked pairs. IAPS Security "was just a reseller of Luminati's service", and "Geosurf and Proxies Online actually share the same infrastructure".

Google found the same pattern on a larger scale in 2026. It named 13 "ostensibly independent" proxy and VPN brands controlled by the people behind IPIDEA, among them 922 Proxy, ABC Proxy, PIA S5 Proxy and IP 2 World. It also wrote that "proxy operators share pools of devices using reseller agreements". The result is "significant overlaps" between the exit nodes of different networks. In a single week of January 2026, Google saw more than 550 threat groups use IPIDEA's exits, including groups from China, North Korea, Iran and Russia.

We map these ties in inside the IPIDEA cluster and in who owns your proxy provider.

How much does a residential proxy cost?

Rotating residential is billed per gigabyte of traffic. Static ISP proxies are billed per address. Our price records show the split: 1,175 per-GB residential prices from 82 providers, against 299 per-IP prices for ISP proxies.

We took the latest price list of each of 60 providers, captured from their own pricing pages between July 20 and October 12, 2026:

The median provider asks $3.65 per GB on its smallest plan, and the middle half ask between $2.50 and $5.90. Volume lowers the rate: on the largest published plan, the median is $1.00 per GB. The person whose line carries the traffic gets $0.10 to $0.20 per GB, going by the rates two sharing apps publish. Early prices moved fast: in 2017 one provider, Proxies Online, raised its price from $3 to $25 per GB within six months, the 2019 study reports.

Our residential proxy price study and our list of the cheapest residential proxies go through the sellers, and pay-as-you-go plans covers plan types and expiry rules.

What does a residential proxy leave unchanged?

• Your software. Headers, cookies and the TLS fingerprint pass through the exit as your program sent them, and each of them can identify it.
• Your accounts. A login ties every request to one account, whatever address it arrives from.
• What the provider sees. The gateway learns the host name of every connection, because the CONNECT request names the host and port, even when the content is encrypted.
• Plain HTTP. Unencrypted requests reach the exit device as readable text.
• The rules. A new address changes what a site sees. The site's terms and the law apply as before.

Are residential proxies legal?

The public cases went after networks that took devices without their owners' consent, and after crimes their customers committed. The US Treasury sanctioned the operator of 911 S5 in May 2024. Its users had filed "tens of thousands of fraudulent applications" for pandemic relief programs, and the losses to the US government ran to billions of dollars. Google took legal action against IPIDEA's control domains in January 2026. Laws differ by country, and this summary of public records is no legal advice.

For the industry as a whole, Google set out the standard it expects. Claims of ethical sourcing "must be backed by transparent, auditable proof of user consent".

How can you tell whether an IP is residential?

Look the address up. Our IP lookup shows the network number, its owner and whether the address is datacenter or residential. The proxy checker runs the same test through a proxy you paste in. The answer describes the network, as the Comcast example shows, so a static ISP proxy reads as residential too. What a residential IP address is explains the network types behind that label, and how to check if an IP is residential compares five ways to test one.

What are residential proxies used for, and do you need one?

They are used where a site judges visitors by their address: web scraping of defended sites, price checks from another country, ad checks, and survey research that has to come from the right country. Many sites, APIs and open data sets do not judge the address, and a datacenter proxy may be all you need there. Where a site turns datacenter addresses away, a residential exit is the usual next step. If free residential proxies tempt you, read what we found about them first. For one device on a home address, a residential VPN is the other option; residential VPN vs residential proxy compares the two.

Our residential proxies cost $0.50 for a single gigabyte, falling to $0.44/GB at 2,000 GB+. Residential Premium, which adds state, city, network and device targeting, costs $1.49/GB for one GB and $1.00/GB at 1,000 GB+. The pricing page lists every plan.

Sources

• Xianghang Mi and others, "Resident Evil: Understanding Residential IP Proxy as a Dark Service", IEEE Symposium on Security and Privacy, May 2019.
• Google Threat Intelligence Group, "No Place Like Home Network: Disrupting the World's Largest Residential Proxy Network", January 28, 2026.
• US Department of the Treasury, "Treasury Sanctions a Cybercrime Network Associated with the 911 S5 Botnet", May 28, 2024.
• Federal Bureau of Investigation, Internet Crime Complaint Center, "Home Internet Connected Devices Facilitate Criminal Activity", alert I-060525-PSA, June 5, 2025.
• Cloudflare, "Using machine learning to detect bot attacks that leverage residential proxies", June 24, 2024.
• Cloudflare developer documentation, "JA3/JA4 fingerprint", updated May 6, 2026.
• Cisco Talos, "Proxyware abuse", August 31, 2021.
• Xianghang Mi and others, "Your Phone is My Proxy: Detecting and Understanding Mobile Proxy Networks", Network and Distributed System Security Symposium, February 2021.
• IETF, RFC 9110, "HTTP Semantics", June 2022, section 9.3.6.
• Bright Data documentation, "Introduction to ISP proxies", read October 12, 2026.
• Oxylabs product pages, read October 12, 2026.
• US Patent and Trademark Office assignment records for Luminati Networks Ltd. and Bright Data Ltd., recorded March 31, 2021.
• HProxy price records: the residential price lists of 60 providers, captured July 20 to October 12, 2026. HProxy IP lookup, October 12, 2026.