Dragging Out Dragons: Slaying Hidden Threats in Residential Networks

Dragging Out Dragons: Slaying Hidden Threats in Residential Networks

Speaker: Christo Roberts

Conference: BSidesSF 2025 — April 26-27, 2025, San Francisco

YouTube: https://www.youtube.com/watch?v=GJoAdmwYpfQ

Reading time: 7 minutes

TL;DR

Residential and mobile IP proxies — services that route malicious traffic through ordinary home internet connections and cell phones — are far harder to detect than datacenter proxies and are increasingly exploited by everyone from nation-state actors to script kiddies. Christo Roberts, a technical consultant at Cloudflare, breaks down how these proxy networks operate, why mobile IPs are the most potent weapon in an attacker's arsenal, and what defenders can realistically do to detect and mitigate them.

Introduction

When a user looks up the cheapest flight on Kayak, finds a limited-edition sneaker drop, or streams geographically restricted content, the infrastructure that makes that possible often depends on a technology that is simultaneously one of the most effective tools available to cybercriminals: residential and mobile IP proxies. Unlike the datacenter IPs that security teams have long learned to block, these proxies route traffic through the same home broadband connections and mobile devices that ordinary users rely on every day — making malicious traffic nearly indistinguishable from legitimate browsing.

Roberts, presenting personal research independent of his employer Cloudflare, framed the talk around the BSidesSF 2025 theme of "Here Be Dragons." The dragons, in this case, are hidden threats lurking inside networks that defenders have largely overlooked. His goal: give both a gray-hat and white-hat view of the proxy landscape so that defenders can understand what they are up against and begin building detection strategies that actually work.

▶ Watch: Introduction and Talk Overview (00:00)

What Are Residential and Mobile IP Proxies — and Why Do They Matter?

The proxy ecosystem is not monolithic. Roberts identified roughly 25 distinct proxy types, including VPNs, Tor exit nodes, datacenter proxies, residential proxies, and mobile proxies. Datacenter proxies are fast and reliable but carry well-known IP reputations that anti-bot platforms detect easily. Tor and VPNs are slow and similarly flagged. Residential proxies, by contrast, use IP addresses assigned to actual home broadband connections, giving them a reputation that anti-fraud systems routinely treat as clean traffic.

Mobile proxies take this one step further. Because mobile devices constantly hop between cell towers and because carriers like T-Mobile use carrier-grade NAT (CGNAT) to share a single public IP address among thousands of simultaneous users, mobile IPs are extraordinarily dynamic. Blocking a mobile IP risks blocking thousands of legitimate users alongside the malicious actor — a false-positive risk that most organizations refuse to accept. That asymmetry makes mobile proxies the most valuable tool in the proxy ecosystem.

▶ Watch: How IP Addresses and Proxies Work (10:01)

The commercial market around residential proxies took off around 2017 when Bright Data (then Luminati) was acquired for $200 million, establishing the model of "ethically sourced" bandwidth reselling. Today, dozens of proxy providers allow customers to pay for access to pools of residential and mobile IPs — priced on a per-gigabyte basis — sourced from users who voluntarily install software to resell their unused bandwidth. Residential IPs trade at a notable premium over datacenter equivalents, reflecting their superior evasion capability.

The Threat Landscape: From Script Kiddies to State Actors

Roberts walked through the full spectrum of proxy users, deliberately avoiding the binary black-hat/white-hat framing. Legitimate use cases include travel fare aggregation (think Expedia or Google Flights pricing engines), ad verification, SEO monitoring, and brand protection — all industries that depend on the ability to query websites from multiple geographic locations without being rate-limited.

At the gray end of the spectrum sit sneaker bots — automated buyers that compete with humans for limited-edition drops — and ticket scalping operations that use residential IPs to bypass per-user purchase limits. Further into the dark sits account takeover (ATO) tooling: automated credential-stuffing campaigns that use rotating residential IPs to distribute requests so broadly that traditional IP-rate limiting becomes useless.

▶ Watch: Use Cases and Threat Actors (06:00)

Roberts highlighted an unexpected corner of the ecosystem: proxy farms. These are purpose-built racks of Android smartphones, each loaded with a SIM card and proxy software, generating authentic mobile IP traffic at scale. Operators have even been documented driving vehicles loaded with phones around cities to keep the mobile IPs cycling through different cell towers — adding an additional layer of IP rotation and geographic diversity.

Perhaps the most alarming development Roberts described is proxy jacking: a technique where an attacker compromises an organization's network — as documented by Roberts's former Akamai colleague Alan — seals the backdoors against competing attackers, and then silently resells the organization's IP addresses as residential proxy bandwidth. In one documented case, an architectural firm in Libya was used as an unwitting proxy node for years without knowing it, generating passive income for the attacker throughout.

Detection Techniques: A Layered Approach

Roberts organized the defensive side of the talk into three tiers: do-it-yourself signals, intermediate tooling, and enterprise anti-bot platforms.

DIY signals worth monitoring include:

• Proxy header leakage — Headers like X-Forwarded-For sometimes slip through misconfigured proxy setups and reveal the true origin IP.
• Geolocation mismatch — If a browser reports its location (via navigator.geolocation) as San Francisco but the request IP resolves to Berlin, that mismatch is a meaningful signal.
• WebRTC and DNS leak detection — Challenging the browser to reveal its true IP through WebRTC or DNS requests can expose a proxy that the HTTP layer has hidden.
• Anti-detect browser fingerprinting — Sophisticated attackers use tools that spoof browser fingerprints to match the proxy's apparent geography. Detecting inconsistencies in timezone, language headers, and GPU renderer strings can surface these tools.

▶ Watch: Detection Strategies and Tools (26:03)

Roberts demoed a live detection service that instantly flagged his VPN connection with a 100% VPN score and a 20% proxy score, illustrating how commercial IP intelligence tools can score individual connections in real time. He noted that these intermediate tools are significantly more affordable than enterprise anti-bot platforms and stay current with emerging proxy techniques.

At the enterprise level, Roberts described Cloudflare's own ML-based approach, which combines three complementary signals: network integrity (characteristics of the IP and network path), session integrity (behavioral patterns during the session), and Turnstile (a CAPTCHA-free JavaScript challenge that validates browser authenticity during sensitive actions like checkout). Turnstile is available free of charge and does not require a site to be hosted on Cloudflare's CDN.

The AI-Era Implications

Roberts closed with a broader observation about why this topic matters specifically in 2025: the rapid expansion of AI-driven web scraping. Large language model training pipelines require vast quantities of web data, and proxy networks are a primary tool for sourcing that data at scale while evading the rate limits and bot detection systems that individual websites deploy. As AI workloads continue to drive demand for scraping infrastructure, the residential and mobile proxy market will only grow — and the cat-and-mouse game between proxy operators and defenders will intensify.

The talk was explicitly framed as a "101 and 201" introduction rather than a definitive solution. Roberts was candid about the limits of any single detection approach: proxy providers actively research and document bypass techniques for honeypots, and machine learning models require high-quality labeled data at scale that most organizations cannot assemble independently. His closing message was practical: layer your signals, aim for progress over perfection, and know when to escalate to professional anti-bot vendors.

Notable Quotes

"It's pretty hard to near impossible to spoof an IP address, and that's why these proxy tools exist." — ▶ 12:01

"Mobile is by far the strongest because of their overall reputation and never wanting to have false positives." — ▶ 18:02

"You're never gonna be perfect, you're always gonna have false positives, so aim for progress over perfection." — ▶ 32:03

Key Takeaways

• Mobile IP proxies are the hardest to detect because mobile networks share IPs across thousands of legitimate users via carrier-grade NAT, making IP-based blocking a false-positive minefield.
• The proxy ecosystem spans a wide spectrum, from legitimate travel fare aggregation and SEO monitoring to credential stuffing, sneaker botting, and DDoS-for-hire operations.
• Proxy jacking is a real and underreported threat — attackers can silently monetize a compromised network for years by reselling its IP addresses as residential proxy bandwidth.
• No single detection signal is sufficient; effective defense requires layering geolocation mismatch detection, browser fingerprinting consistency checks, behavioral session analysis, and IP reputation scoring.
• AI-driven web scraping is accelerating proxy market growth, making this an increasingly critical area for any organization running a public-facing web presence.