The Outlier Lab

IP Reputation and Proxy Detection

What the network egress of an event reveals about its origin: connection type, anonymizers and proxies, hosting vs residential, prior abuse, and consistency with the customer.

What it measures

AttributeExamplesTypical read
Connection typeResidential broadband, mobile carrier, hosting/datacenter, business, educationHosting egress on a consumer action is unusual; mobile carrier IPs are heavily shared
AnonymizationCommercial VPN, open or residential proxy, anonymity network exit, privacy relayEach has a different benign population and a different abuse rate
Abuse historyPrior attacks seen by intel feeds or by you (stuffing, carding, sign-up spam)Short half-life; IPs rotate
Ownership and geoNetwork operator, country/region, IP geolocation confidenceInput to Geolocation and Impossible Travel
Internal historyAccounts, devices and cards seen from this IP or subnet; outcome historyYour best data, and nobody can sell it to you

Why it matters

IP is the first signal available at every endpoint, before login, before device collection completes, and before any identity is known. That makes it the workhorse for volume attacks and an important context feature for targeted ones:

  • In volume attacks, Credential Stuffing and Card Testing waves often concentrate on a small set of networks, or rotate across a huge residential pool. Either shape is visible in aggregate. See Rate Limiting and Throttling.
  • In targeted ATO before cash-out, a login and payout change from an anonymizer on an account that has always used one home ISP is meaningful context for Payout Redirection and Real-Time Payment Rail Fraud.
  • At onboarding, applications whose IP geography contradicts the stated address feed Synthetic Identity Fraud and Money Mules detection. FinCEN's 2024 deepfake alert lists device or geographic data inconsistent with identity documents among its red flags, and access from an IP inconsistent with the profile.
  • In rewards and promos, the pattern is many accounts from one subnet redeeming the same offer (Multi-Accounting).

How to collect it

  • Buy IP intelligence (geolocation, connection type, anonymizer classification, abuse scoring) from specialized providers. Expect coverage and accuracy to vary, especially for residential proxies and mobile carriers; back-test on your labeled traffic. See Vendor Selection and Evaluation.
  • Build your own IP and subnet history: accounts, devices, instruments and outcomes per IP over time. Join it to Velocity Signals.
  • Capture the true client IP. Behind CDNs and load balancers the client IP sits in forwarding headers, and many logging bugs come from recording the edge node's address instead.
  • Record IPv6 at the prefix level as well as the full address. Individual IPv6 addresses rotate within a customer's allocation.

How to use it

  • Read connection type in context. Hosting egress on a consumer mobile app's login is suspicious. The same egress on an enterprise customer's desktop session, behind a corporate VPN, is normal.
  • Compare against the customer's own baseline. A customer's long-run network history (one home ISP, one carrier) is stable, and deviation from it is more informative than any absolute reputation score.
  • Look at aggregates before individual events. Volume attacks show up first in per-subnet or per-network aggregates: failure rates, distinct accounts, distinct cards.
  • Stack it with device and behavior signals. An anonymizer plus a recognized, long-tenured device is usually a privacy-minded customer. An anonymizer plus a new device plus a payout change is not.

Strengths and limitations

Strengths: universal and early; cheap; excellent for population-level attack detection.

Limitations:

  • Residential proxies have eroded IP reputation as an identity signal. Traffic routed through compromised or enrolled consumer devices looks like an ordinary household. The FBI's March 2026 PSA notes that residential proxies can make fraudulent logins look local and routine, helping ATO avoid bank fraud alerts. A CSA research note (August 2026) concludes IP reputation alone is no longer reliable.
  • IPs are shared (carrier-grade NAT, corporate egress) and reassigned, so reputation decays fast.
  • Anonymization classification lags reality, and new egress pools appear continuously.
  • IP geolocation is approximate and may describe the network's registration rather than the user.

Compensating controls: device-anchored signals, behavioral layers, and step-up at money-movement points rather than at the network edge.

What's changed recently

  • Industrialized residential proxy supply. The FBI warned in June 2025 that a botnet of millions of infected streaming devices, projectors, infotainment systems and similar products feeds residential proxy services used for criminal activity. A March 2026 PSA lists fake account creation, brute-force attacks, ATO, illegal purchases and bypassing purchase limits among the uses of residential proxies. In July 2026 the FBI seized hundreds of domains tied to one large residential proxy provider. CSA reports that demand moved to other providers after an earlier disruption, rather than disappearing.
  • Browser-level IP masking. Chrome began rolling out IP Protection in Incognito in 2025. It proxies third-party requests to domains on a masked-domain list through a two-hop proxy that preserves coarse location. First-party requests keep the real IP, so the direct effect on a site's own risk checks is limited. Even so, expect more legitimate traffic to reach you through privacy proxies. Google offers delayed, sampled "probabilistic reveal tokens" for anti-fraud use.

False positives and fairness

  • Privacy-conscious customers and VPN users, including people on employer VPNs, journalists, domestic-violence survivors and people in sensitive jobs.
  • Carrier-grade NAT puts thousands of mobile customers behind a few addresses. Volume rules keyed on mobile carrier IPs will over-fire.
  • Travelers and expats on hotel, airport and roaming networks.
  • Households and dormitories with many legitimate accounts on one IP.
  • Unwitting proxy exits. A legitimate customer whose own smart TV is a proxy exit node may inherit a bad reputation on their home IP. CSA notes that consent to proxy SDKs is often a single buried prompt.
  • Lower-income and rural customers are more likely to use shared or mobile-only connectivity.

Privacy and compliance considerations

  • IP addresses are personal information under most US state privacy laws, and IP geolocation can approach precise location in some cases. Use for fraud prevention is generally a recognized purpose, but disclose it and minimize retention. See Privacy and Data Use in Fraud Prevention.
  • NIST SP 800-63A-4 requires identity services to analyze remote proofing channels for high-risk indicators such as blocklisted proxies and IP addresses, which supports doing this in onboarding flows.
  • Avoid using country-level IP blocks as a proxy for national origin in decisions on regulated products. Check fair-lending and UDAAP exposure with counsel.

Mechanisms it helps detect

Credential Stuffing · Card Testing · Fake Account Creation (Bots) · Account Takeover (ATO) · Card-Not-Present Fraud · Multi-Accounting · Payout Redirection · Synthetic Identity Fraud · Money Mules

Sources and further reading