← Home

Deceptive Proxy Tactics & Risks

Why many proxies are sold as-is, how that damages workflows, and what to ask for instead.

Proxy providers often skip categorisation

Many providers focus on raw capacity and marketing copy, instead of triage. They don't run thorough IP checks or bucket IPs into meaningful categories: clean / usable / risky / toxic. If they did, they could upsell genuinely clean IPs as premium, and assign the noisy ones to rotation-only tasks.

The right approach: test, categorize, discard bad ones. Our tests produce straightforward reasons explaining why an IP failed.

Headline findings from our tests

100–10,000 IPs Sample size per provider in our aggregated testing

Across providers we tested (sample sizes between 100 and 10,000 IPs per provider), results show stark differences in usable proxy quality,

Apart from rotation logic and promised sticky times not being respected, we frequently observed as little as 10% of IPs being fit for sticky sessions in some pools, essentially a guarantee that long-lived sessions and multi-account workflows will fail. Industry averages for residential pools commonly fell in the 30–60% usable range, rotating and datacenter pools were often worse.

Why categorisation matters, real examples

Public VPN detected
Proxy cluster, moderate anonymity
Shared ASN used by web tools
Unauthorized connection attempt detected
SSH Brute-Force attempts
Repeated failed password for root
Port scan attacks
Fail2ban action triggered
Multiple failed SSH logins
Invalid user admin login attempts

Important: a good IP today can become a bad IP tomorrow.

Sticky sessions, guarantees you actually need

Guaranteed sticky duration, IP remains the same for X minutes/hours.
Controlled rotation, when session rotates, it should rotate to same or similar IP (ASN/ISP/region), not a random location.

Almost no mainstream provider gives these guarantees, and that's why multi-accounting setups fail before anti-detect configs even matter.

Why providers unintentionally ruin setups

Acquisition teams pile on, resellers inject cheap upstream IPs. The result: mixed pools with dongles, mobile tunnels, misconfigured NATs, recycled datacenter ranges, all sold under the same label.

Fallout: entire account fabrics and marketing campaigns become brittle or banned, sometimes retroactively.

Concrete failure modes we detect

Too many hops, multi-hop chains that leak signals
IPv6 leakage
Dongle/mobile tether setups, inconsistent routing
Overly long routing (15+ hops)
Open-relay / email abuse on ASN

Why this matters before anti-detect configs

Most users get detected because of bad proxy signals long before browser configs are a factor. Fix the proxy first. For guidance on browser setup, see: Anti-detect setup →

Our team (operating the reviewfixer account on BHW) has advised clients on proxy selection and anti-detect configs, produced post-mortems, and reported reproducible issues to providers. BHW Thread

Our methodology (brief)

ASN / ownership lookups
Threat intel feeds (Spamhaus, AbuseIPDB, etc.)
Active port & SSH probes
Geo-consistency checks
Route length / hop analysis
Multi-hop chain stability
NAT / IP reuse detection
Mobile/dongle routing analysis
Hidden VPN / proxy detection
Latency and jitter profiling
Session persistence / stickiness testing
Reproducible logs & post-mortems

Signals are combined, a "clean" IP passes all thresholds, "damaged" IP has actionable reasons.


Run a sample test Contact support