Where our residential IPs come from
A residential proxy is only as defensible as its supply chain, and this is the question worth asking any provider before the price list. Our residential capacity comes from partner applications where participation is disclosed and opted into: people are told their connection may be shared, they are compensated for it, and they can leave at any time. We do not recruit peers through bundled installers or software that hides what it is doing.
This matters commercially, not just ethically. Pools assembled without consent get dismantled as soon as the deception surfaces, and your success rate goes with them. Addresses from covert networks also accumulate abuse reports, so they arrive at your target already carrying a poor reputation. Independent research in 2026 found that a substantial share of exit nodes in the weakly-verified segment of this market were running on malware-infected devices — we wrote up what that research measured because the same supply problem is what separates a stable pool from a cheap one.
If you need this documented for a vendor review or procurement questionnaire, ask us and we will route it to the right team.
Rotating or sticky: choosing a session strategy
Both modes run on the same pool and the same credentials; what changes is how long an address stays with you.
Rotate per request when each fetch is independent — product pages, search results, bulk listing collection. Spreading requests across many addresses keeps any single IP well under the rate limit that would flag it.
Hold a sticky session whenever the target carries state. Logins, carts, checkouts and multi-step forms all bind a session cookie to the address that created it; if the IP changes mid-flow the site treats it as hijacked and drops you back to the start. That failure is routinely misread as an unreliable proxy when it is the target enforcing its own session rules.
Pick the shortest sticky window that completes your flow — longer windows concentrate more traffic on one address, which is exactly what rate limiting looks for. How rotation works and when to use a sticky session cover the mechanics.
Authentication: whitelisting or username and password
Both methods work on every plan and you can switch at any time.
IP whitelisting registers the public address your traffic originates from, and requests from it pass without credentials. It suits a fixed server or an office with a static IP, and it is the only option for tools that provide no credential fields. It breaks the moment your address changes — home connections, laptops that move between networks, and containers that get a new address on restart all mean re-whitelisting before anything works again.
Username and password travels with the request, so it survives network changes and works from anywhere, including ephemeral cloud workers. Unless a tool forces your hand, this is the one to choose.
If you have credentials configured and still see a 407, that is an authentication failure rather than a proxy fault — the 407 walkthrough isolates it.
What actually drives your bill
Rotating residential capacity is billed on traffic, so your cost is decided by the bytes you move rather than the number of requests you make. For a typical web page the HTML you parse is a small fraction of the transfer; images, fonts and JavaScript bundles are usually the overwhelming majority. If you are extracting text, you are paying for the rest and discarding it.
Four changes reliably cut consumption without losing data: block images, media, fonts and stylesheets in headless browsers; send Accept-Encoding: gzip, deflate, br so HTML arrives compressed; store an ETag or Last-Modified value and make conditional requests, so unchanged pages return an empty 304; and prefer a JSON endpoint over a rendered page wherever the target exposes one.
Check consumption after the first hour of any new job rather than at the end of the month. Reducing bandwidth has the detail.
When a residential proxy is the wrong tool
The most common and most expensive mistake in this market is buying residential bandwidth for targets that would have accepted a datacenter IP without complaint.
Residential exits route through consumer connections, so they are slower than datacenter capacity and billed by traffic rather than per IP. If your target does not fingerprint aggressively — internal tools, uptime checks, documentation, most public APIs — datacenter proxies are faster and cheaper, and we would rather tell you that than sell you the wrong thing.
If you need the same address to persist across days, because the target ties an account or dashboard to a known IP, rotation is actively working against you and ISP proxies are the right product. If your target is a mobile app API or mobile-specific ad placement, mobile proxies are the only accurate option.
Unsure? Run a few hundred real requests against your actual target on the cheaper option and compare success rates. That settles it faster than any specification sheet — choosing a proxy type walks through the decision.
The three failures we see most
A 429, or a slow collapse in success rate. That is rate limiting, not blocking. Slow down, add jitter so requests are not evenly spaced, and back off exponentially after errors. Rotating harder does not help and burns more of your pool.
A 403 or a challenge page on a freshly rotated IP. The address was not the problem. Modern anti-bot systems score your TLS handshake, your HTTP/2 frame settings and your browser environment alongside the IP, and a clean residential address paired with a standard HTTP library's fingerprint is an obvious mismatch. Changing provider almost never fixes this; the five detection layers explains which ones a proxy can and cannot address.
A 200 that contains a challenge page. The most damaging of the three, because if you are not validating the response body you are recording blocks as successes and your metrics are quietly lying to you. Check for a marker you expect on a real page before counting a fetch as good.
Our five-step test separates a proxy problem from a target problem in a couple of minutes, and support is staffed 24/7 if it turns out to be ours.
Acceptable use
The pool stays healthy only while the traffic on it is legitimate, so our policy is narrower than "anything that is technically possible". A proxy changes the network path, not the rules: a robots.txt disallow is a refusal whether or not anyone enforces it, and using our capacity specifically to circumvent an explicit refusal is outside our terms. The same applies to targets and activities set out in our acceptable use rules.
What we log, and for how long, is documented in our logging policy. HTTPS traffic passes through an encrypted tunnel that we forward without reading.
