Residential proxy

Every visit carries an IP address, and filters use it to judge whether the visitor is a home user, a mobile user or a server. A residential proxy network lets a customer send traffic out through thousands of real home or mobile connections, sometimes from devices whose owners agreed in return for a free app, sometimes from infected devices.

Proxies have legitimate uses, such as price monitoring and ad verification. In fraud they are the standard way to defeat IP-based checks: a bot running in a data center exits through a family's broadband in the target country and passes as tier 1 traffic. The MRC standards list invalid proxy traffic under SIVT.

For search feeds this is why IP reputation alone is no longer enough. Signs that proxies are in use: a mismatch between the IP's location and the device's time zone or language, connection timing that suggests an extra hop, one "household" producing an impossible number of distinct devices, and addresses that rotate on every request.

Detection therefore leans on device fingerprinting, behaviour and outcome data, not just address lists.

Think of it like this

It is a criminal posting letters through a re-mailing service in a quiet suburb, so every envelope carries a respectable local postmark.