proxy & network identity
the network is the other half of a fingerprint: not what the browser presents, but where it exits. four classes, datacenter, isp, residential, mobile, each with a different default trust and a different tell. below: the class taxonomy joined to the proxy band the benchmark scores, the providers that sell each pool, and what gives each class away to the five-vector coherence check (ip/asn, timezone, accept-language, webrtc, dns).
forensic reference · as of 2026-06-16 · class tells confirmed · provider pool sizes and success rates are vendor-published, treat as speculative
the class taxonomy · trust ladder
datacenter
- trust
- lowest
- class
- datacenter
ip space on a cloud / hosting asn (aws, gcp, azure, digitalocean, linode, vultr). cheap, fast, effectively unlimited, and the first pool every scraper reaches for.
primary tell: the asn itself: a hosting asn appears on public datacenter blocklists, the rdns resolves to the provider, and there is no carrier behind it. no eyeballs live here, so any traffic reads as automation by default.
typical cost (2026, speculative): ~$0.5 to $2 / gb, or a few dollars per dedicated ip per month
lowest trust by construction. datadome and similar weight a hosting asn heavily in the ip-reputation component of the score (the guide cites a 25 to 30 percent-ish weight, speculative). fine for unauthenticated, low-value targets; flagged on sight by anything with an asn-reputation feed.
isp (static residential)
- trust
- high
- class
- isp
a residential ip leased on a known consumer-isp asn (e.g. comcast as7015). residential-trust ip space, but rented as a stable, static exit instead of a rotating pool.
primary tell: the asn reads residential, so it clears the datacenter blocklists; the tell is that the SAME ip sits behind sustained, machine-paced traffic that a real home connection would not generate. stability is the feature and the giveaway.
typical cost (2026, speculative): ~$2 to $15 per ip per month
the best of both: residential trust plus a static ip, so session trust accumulates instead of resetting every request. this is the class net-echo carries as its own `isp` label between datacenter and rotating residential. the trap is volume: a residential ip serving thousands of sessions stops looking residential.
residential (rotating)
- trust
- high
- class
- residential
real consumer devices reached through p2p / sdk pools (bandwidth resold from apps that bundled an sdk). every request can exit from a different real home ip.
primary tell: rotation itself: an exit ip that changes mid-session breaks the trust a detector accumulates across requests, and the pool's reputation is only as good as its worst member. one flagged peer taints the address you land on.
typical cost (2026, speculative): ~$3 to $10 / gb
high per-ip trust (these are genuine eyeball addresses) undercut by rotation. mid-session ip changes break the multi-request trust accumulation akamai and perimeterx rely on, so the same property that defeats simple ip blocks defeats the operator's own session. pool reputation varies wildly by provider.
mobile (4g / 5g)
- trust
- highest
- class
- mobile
carrier ip space behind cgnat: thousands of real phones share a handful of public addresses, all on a mobile-carrier asn.
primary tell: high address churn from cgnat sharing, but a carrier asn that detectors are loath to block, because blocking it would cut off real subscribers behind the same nat. the shared-nat churn is the cost, the carrier asn is the trust.
typical cost (2026, speculative): ~$5 to $30 / gb
highest trust by default. a carrier asn plus the collateral-damage problem (blocking one cgnat ip blocks every real subscriber on it) makes detectors reluctant to act, so mobile exits ride on borrowed reputation. the churn that protects you also makes the exit geo and timezone harder to keep coherent.
provider roster · who sells the pools
bright data
official ↗the broadest roster: all four classes plus a managed unblocking layer that targets the hard vendors (f5 shape among them). the size is the point and the risk, a pool that large is sourced widely, so peer reputation varies and a flagged peer taints the exit you land on.
- pool
- 72M+ ips (claimed) · speculative · as of 2026-06-16
- success
- 98.44% success (vendor-published) · speculative · as of 2026-06-16
- also a managed api
- bright-data
oxylabs
official ↗the other full-roster heavyweight, marketed on a very large residential pool and an oxycopilot ai layer over the api. same caveat as any large residential pool: per-ip trust is real, but pool reputation is only as good as the worst peer in it.
- pool
- 102M+ ips (claimed) · speculative · as of 2026-06-16
- also a managed api
- oxylabs
decodo (ex-smartproxy)
official ↗the rebrand of smartproxy, positioned as the affordable mid-tier across datacenter, residential and mobile. no isp/static tier in the headline roster, so session-stability cases lean on the others.
- also a managed api
- decodo
zyte (smart proxy manager)
official ↗the company behind scrapy. sells proxy access as a smart-proxy-manager that auto-unblocks, so the proxy and the unblocking logic ship together rather than as separate pools.
- success
- ~93% autoextract success (vendor-published) · speculative · as of 2026-06-16
- also a managed api
- zyte
scraperapi
official ↗a simpler proxy-plus-js-render api with a free tier: hand it a url, it picks the pool and renders. datacenter and residential only, aimed at volume scraping rather than the hardest gates.
- also a managed api
- scraperapi
scrapingbee
official ↗a rest-first proxy + render api with a free tier, in the same simple-managed-api bracket as scraperapi. datacenter and residential pools behind a single endpoint.
- also a managed api
- scrapingbee
adjacent · not yet profiled
- iproyal [residential · mobile] residential + mobile, named in the guide as an adjacent vendor. verify before profiling.
- nodemaven [residential · mobile] residential + mobile, adjacent. verify before profiling.
- soax [residential · mobile] residential + mobile, adjacent. verify before profiling.
free / diy pools (swiftshadow, aws-api-gateway rotation) are tooling, not providers, and carry poor ip reputation that fails reputation gates. they are not in this roster on purpose.
the tells · class against the five-vector coherence check
a detector does not read the exit ip alone, it cross-checks five vectors and flags the one that disagrees with the rest. the proxy moves the http path; keeping every other vector coherent with the new exit is the hard part.
ip / asn
reads: the exit ip's owning asn and its reputation class (hosting vs consumer-isp vs carrier), plus rdns.
tell: a hosting asn on a request claiming to be a home user; an asn on a public datacenter blocklist.
timezone
reads: the browser's intl / date timezone offset against the geoip of the exit ip.
tell: an exit ip geolocating to one country while the browser reports a timezone from another. rotation makes this drift mid-session.
accept-language
reads: the accept-language header and navigator.languages against the exit geo.
tell: en-us on an exit that geolocates to a non-english region, or a locale that never matches the claimed country.
webrtc
reads: the ice candidates webrtc surfaces, which can reveal the true local / public ip behind a proxy.
tell: a webrtc-leaked ip that does not match the http exit ip: the proxy moved the http path but not the rtc path.
dns
reads: where dns resolution physically happens and the resolver's geo, versus the claimed exit geo.
tell: dns resolving from a different region than the exit ip (a dns leak), exposing the real upstream behind the proxy.
datacenter · across the five vectors
- ip / asn
- fails immediately: hosting asn, datacenter rdns, on public blocklists.
- timezone
- geoip is precise (the dc location), so a mismatched browser tz is glaring.
- webrtc
- rtc ip often leaks the real host unless explicitly suppressed.
- dns
- resolver geo usually matches the dc, reinforcing the hosting verdict.
isp (static residential) · across the five vectors
- ip / asn
- passes the asn check (reads residential); volume on a static ip is the tell instead.
- timezone
- stable geo makes tz easy to keep coherent, the upside of staying put.
- accept-language
- coherent as long as the locale is pinned to the static exit's region.
residential (rotating) · across the five vectors
- ip / asn
- passes per-ip, but rotation churns the asn and pool reputation varies.
- timezone
- rotation drifts the exit geo mid-session, so a fixed browser tz desyncs.
- accept-language
- a fixed locale across a rotating multi-country pool reads as inconsistent.
- webrtc
- consumer rtc candidates can still expose the true device behind the pool peer.
mobile (4g / 5g) · across the five vectors
- ip / asn
- highest trust: carrier asn detectors avoid blocking due to cgnat collateral.
- timezone
- cgnat churn makes a stable exit geo hard, so tz coherence takes work.
- dns
- carrier resolvers usually align with the exit, a coherence advantage.
your exit · live verdict
the live "your exit" overlay (classify your own ip's asn against this taxonomy via classifyAsn()) is not wired into this console yet. the verdict it would pin here, datacenter / isp / residential / mobile / unknown, already runs on the network details tool, which fetches the server's net-echo of your request.
go deeper
- → network details the combined transport view this drills down from, with a live self-probe of your own connection's exit.
- → bot economy the $/gb these proxy classes cost, folded into the per-1k-accounts cost of attack.