A datacenter proxy and a residential proxy run the same software, yet on protected sites one loses four requests in ten, the other about one in eighteen. The difference is where the exit IP lives. That is what the types of proxy servers sold today really differ on. Datacenter, residential, mobile and ISP (static residential) proxies all forward your request the same way, but each one hands the target a different kind of network.
Below we cover how each type works, what a target can read about it, how often it gets through, and what it costs per gigabyte or per IP. The older forward, reverse and transparent labels are here too, along with the legal lines for scraping. I ran the header and IP-type tests on a Fedora 45 VM in my homelab in October 2026, and read every price off the vendor pricing pages the same day.
1. How a proxy request travels
Every commercial proxy type uses the same two hops. Your client logs in to the gateway of the provider with a username and password, using HTTP CONNECT for HTTPS sites or SOCKS5. The gateway then forwards the request to an exit node from the pool you paid for. The target never sees your address or the gateway. It sees the exit IP, and from that IP it can look up the owning network (the ASN) and whether databases list it as hosting, consumer broadband or cellular. The diagram shows the four exit pools side by side:
Because the gateway is the same for all four, switching proxy types is usually a change of hostname, port or username flag, not a change in your code. So why is the price gap so large for what looks like the same product? You are renting a position on a network that is not yours, and a home connection or a SIM card is much harder to come by than a server rack.
The older names you still see in textbooks describe something else, namely who the proxy works for and how much it reveals:
- Forward proxy: sits in front of clients, like Squid
- Reverse proxy: sits in front of servers, like nginx
- Transparent proxy: passes your real address in a header
- Anonymous proxy: hides your address, admits it is a proxy
- Elite proxy: sends neither your address nor a proxy header
Datacenter, residential and mobile proxies are all forward proxies, and every serious provider runs them in elite mode. Section 6 shows what those header levels look like on the wire, because that is the one part of proxy detection you can test on your own machine.
2. Datacenter proxies: fast, cheap and easy to flag
A datacenter proxy exits from a server in a hosting or cloud network. Providers buy or lease blocks of addresses, put them on machines with gigabit uplinks, and sell them per IP or per gigabyte. They are the cheapest and fastest type. In the 2025 Proxyway benchmark the median datacenter response time was 0.29 seconds, against 0.93 seconds for residential pools. The weakness is that the owning network says “hosting” to anyone who asks, and ordinary visitors do not browse from a hosting network.
We checked how visible that is with the free ip-api.com lookup, which returns hosting, proxy and mobile flags for the calling address. We sent one request from the lab VM through Squid on a home fiber line:
curl -s -x http://127.0.0.1:3128 'http://ip-api.com/json/?fields=status,mobile,proxy,hosting'The home line came back clean on all three flags:
{"status":"success","mobile":false,"proxy":false,"hosting":false}We then ran the same curl without -x on a Hetzner server (AS24940), and only one flag changed:
{"status":"success","mobile":false,"proxy":false,"hosting":true}Neither address was flagged as a proxy, because neither is on a known proxy list. The Hetzner address is still marked as hosting from the first request, with no behaviour involved at all. A bot manager does not need to catch you doing anything wrong to treat that request with suspicion, and many sites simply serve a challenge to hosting ranges. That is the trade with datacenter proxies. They work well on targets with no bot protection, on APIs and on your own sites, and they are the first thing a protected target filters.
3. Residential proxies: home IPs rented by the gigabyte
A residential proxy exits from a real consumer connection: a laptop, a phone, a smart TV or a set-top box on a home broadband line. The IP belongs to an ISP such as Comcast or a national fiber operator, so the lookup above would return hosting: false, exactly like our home line did. Providers do not own these devices. They recruit them through bandwidth-sharing apps that pay users, and through SDKs that app developers bundle for a fee. Paying customers then send their traffic out through those devices.
Where a provider gets those devices is the question that matters most when you choose one, and it is no longer theoretical. Three takedowns in just over two years show why:
- 911 S5, May 2024: DOJ tied it to over 19 million IPs
- IPIDEA, January 2026: Google cut its device pool by millions
- NetNut, July 2026: FBI seized hundreds of its domains
The 911 S5 botnet grew through free VPN apps. Google said it saw more than 550 threat groups using IPIDEA exit nodes in a single week before it acted. NetNut was run by a NASDAQ-listed company, and researchers had linked it to the Popa botnet of at least two million devices. A provider that cannot tell you where its IPs come from can disappear overnight, and your traffic may have been riding on devices whose owners never agreed to it.
Residential pools rotate by default, so each request or each sticky session gets a different household. In the 2025 Proxyway tests the median provider passed 99.56% of requests at the infrastructure level, with a median response time just under one second. The cost is bandwidth: you pay per gigabyte, so a scraper that loads images, fonts and scripts burns through a plan many times faster than one that fetches only HTML.
4. Mobile proxies: one carrier IP shared by many phones
A mobile proxy exits from a 4G or 5G connection. That is either a real handset in a peer-to-peer pool or a USB modem in a rack of SIM cards (a “dongle farm”). What makes it different is carrier-grade NAT. Mobile operators do not have enough IPv4 addresses to give every phone its own, so they put subscribers on private addresses and translate many of them to a few public IPs. RFC 6598 reserved 100.64.0.0/10 for exactly this. A target that blocks one mobile IP risks blocking a crowd of real customers on the same carrier, so most sites are careful about it, and that caution is what you pay for.
The same sharing cuts both ways. A mobile IP carries the reputation of everybody behind it, and you cannot pick it the way you pick a datacenter address. On a dedicated modem you rotate by toggling airplane mode or reconnecting, so the carrier hands out a new address. That takes seconds and does not guarantee a different IP. IPRoyal describes its dedicated mobile product plainly as renting a phone with a SIM card. The Proxyway report noted that large providers stay away from dongle farms because of scaling, reliability and, above all, ethical and regulatory concerns.
5. ISP proxies: datacenter speed on residential addresses
ISP proxies, also sold as static residential proxies, sit between the other types. The servers live in a datacenter, but the IP ranges are registered to a consumer ISP, so a lookup by ASN says “residential” while the latency says “datacenter”. They are sold per IP per month rather than per gigabyte, and they do not rotate, which suits account management and long sessions where an address that changes every few minutes would itself look odd.
The weak spot is the paperwork. Proxyway found that IP databases such as IP2Location classify an address by the organisation that owns the block. For ISP proxies that is often an IP broker rather than the ISP named in the ASN. Of the nine providers it tested, only NetNut (100%) and Rayobyte (88%) scored well on matching ASN and organisation records; the other seven were at 57% or below. When those records disagree, a careful bot manager can tell the IP is not a normal home line, and the proxy behaves more like a datacenter address than the label promises.
6. What the target sees: headers before IP type
Before any IP lookup, a badly configured proxy gives itself away in the request headers. You can check this on any Fedora or RHEL box with Squid and a tiny origin server that prints the headers it receives. Install and start Squid first:
sudo dnf install -y squid
sudo systemctl enable --now squidThe origin is a short Python script. Create it:
vim ~/echo.pyPaste this, which is the exact script we ran on proxy01:
from http.server import BaseHTTPRequestHandler, HTTPServer
class Echo(BaseHTTPRequestHandler):
def do_GET(self):
body = f"client_ip: {self.client_address[0]}\n" + "".join(
f"{k}: {v}\n" for k, v in self.headers.items()
)
self.send_response(200)
self.send_header("Content-Type", "text/plain")
self.end_headers()
self.wfile.write(body.encode())
def log_message(self, *a):
pass
HTTPServer(("0.0.0.0", 8080), Echo).serve_forever()Start it in the background, then send a request through Squid to the VM’s own LAN address (ours was 192.168.1.120; use yours):
nohup python3 ~/echo.py >/dev/null 2>&1 &
curl -s -x http://127.0.0.1:3128 http://192.168.1.120:8080/With the stock Fedora configuration, the origin saw a Via header naming the proxy and its version. It also saw an X-Forwarded-For header carrying the client address, which is the textbook transparent proxy. Two directives at the end of the config hide both (on Squid 7; the via directive is not available in Squid 8):
sudo vim /etc/squid/squid.confAdd these two lines at the bottom of the file:
forwarded_for delete
via offReload Squid and repeat the request:
sudo systemctl reload squid
curl -s -x http://127.0.0.1:3128 http://192.168.1.120:8080/Both runs are in the capture below. The first request carries Via: 1.1 proxy01 (squid/7.7) and X-Forwarded-For: 127.0.0.1; after the reload, both lines are gone and the origin sees only the proxy’s own address:
There is a middle setting too. With forwarded_for off instead of delete, Squid 7.7 still sent X-Forwarded-For: unknown, which hides the address but tells the origin a proxy is in the path: the anonymous level from section 1. Two more things came out of the lab. The default squid.conf on Fedora only allows requests from localhost, so our first attempt from the LAN address got TCP_DENIED/403 until we used the loopback client. And for HTTPS the proxy never sees the headers at all, because the access log only records the tunnel:
1793413447.333 811 127.0.0.1 TCP_TUNNEL/200 7017 CONNECT ip-api.com:443 - HIER_DIRECT/208.95.112.1 -
1793413448.695 1355 127.0.0.1 TCP_TUNNEL/200 6022 CONNECT www.fedoraproject.org:443 - HIER_DIRECT/152.2.23.104 -So on HTTPS, which is most of the web, header leaks are not where you get caught. The target judges you on the exit IP and on the TLS and browser fingerprint of the client, which no proxy type changes. If you want the full Squid setup rather than this test, our guides to Squid on Rocky Linux 10 and Squid on Ubuntu 26.04 cover ACLs and authentication.
7. Detection rates by proxy type
The most useful public numbers come from the annual Proxy Market Research by Proxyway. For the 2025 edition it ran the same scrapers at one request per second through each pool against Amazon, Google and Instagram (datacenter and ISP pools on Amazon and Google only). A request only counted as a success if it returned a 200 with the expected page size and title. The medians across providers, per type:
Read the bottom bar first. Shared datacenter proxies failed on about four requests in ten against protected targets. On Google, one tested datacenter pool had every single request blocked. Residential, mobile and ISP pools all landed between 89% and 95%, with the caveat that the ISP figure leaves out Instagram, so the expensive types are close to each other and far from datacenter. Mobile did not beat residential here, which surprises people who buy mobile for its reputation. On these targets, IP quality was rarely the bottleneck once the address was not a hosting one.
Read these numbers with their limits in mind:
- Medians across 8 to 12 providers per type
- One request per second, far below most production scrapers
- Three large targets, not every site on the web
Your own scraper, its fingerprint and its request rate will move the result more than the proxy type does. A small store with no bot manager will let a datacenter IP through as happily as a residential one. The wider pressure is real though. The 2025 Imperva Bad Bot Report put automated traffic at 51% of all web traffic and bad bots at 37%, which is why more sites score IP type at all.
8. What each proxy type costs
The table lists the entry price for each type as shown on the public pricing pages on October 31, 2026. Residential and mobile are billed per gigabyte, datacenter per IP or per gigabyte, and ISP per IP per month. Compare within a column, not across a row:
| Provider | Residential | Datacenter | Mobile | ISP (static) |
|---|---|---|---|---|
| Bright Data | $8/GB pay as you go ($4/GB with a promo code) | $0.60/GB, or $1.40/IP for 10 shared IPs | not listed on the pricing page | $1.80/IP for 10 shared IPs |
| Decodo | $4/GB pay as you go, $3.75/GB on the 3 GB plan | $0.60/GB on the 10 GB plan | not read | not read |
| IPRoyal | $7/GB at 1 GB subscription ($7.35 pay as you go), down to $1.75/GB at 10 TB | from $1.39 per proxy | $6.80/GB rotating (2 GB), or $130/month dedicated | from $1.80 per proxy |
| SOAX | $5/GB on Sandbox, $3/GB on the $200 Builder plan (top-tier countries) | not listed | same rate as residential | not listed |
| Webshare | from $3.50/GB | $2.99/month for 100 proxies | not offered | $6/month for 20 proxies |
The cheap headline numbers on these pages almost always need volume. The $1.75/GB at IPRoyal needs a 10 TB plan and the $2/GB at Decodo needs 1 TB. The $4/GB residential rate at Bright Data needs a coupon, so a small project pays the first price in each cell. Oxylabs publishes one subscription with tiers instead of per-type rates, so it is not in the table. The NetNut pricing page showed only the FBI seizure notice when we checked.
As a sanity check, the 2025 Proxyway medians were $4/GB for residential at 5 GB and $8/GB for mobile at 1 GB. Datacenter came in at $0.60/GB at 50 GB, and 10 ISP proxies at $3.58 per IP. That lines up with what the pages show now.
The cost that matters is per successful page, not per gigabyte. A datacenter gigabyte at $0.60 that succeeds 60% of the time still costs far less than a residential gigabyte at $4 that succeeds 94% of the time. That only holds while retries are cheap and the target does not ban the IP block. Once retries trigger blocks or CAPTCHAs, the residential plan wins on cost as well.
9. Choose between the types of proxy servers by target
Start from the site you need to reach and how it reacts, not from the price list. Does it challenge hosting ranges, or does it not care? In our experience the target decides the type in a few clear cases:
- No bot protection, your own sites or public APIs: datacenter
- Large retail, search or social sites: rotating residential
- Logged-in accounts that need one stable address: ISP (static)
- Mobile-only apps or carrier-specific ad checks: mobile
- Testing from many countries on a budget: residential with country targeting
A mixed setup is common and sensible. Send everything through datacenter first, and fall back to residential only for the requests that come back blocked. Many providers sell all four types from one account and gateway, which makes that fallback a change of port. If you only need the traffic of your own machine to leave through a proxy, for package downloads or a corporate gateway, that is a different job. Our guides to setting a system-wide proxy on Ubuntu and Debian or on Rocky Linux, RHEL and Fedora cover it.
10. The legal lines for scraping through proxies
A proxy changes where a request comes from, not whether you are allowed to make it. The law that applies depends on what you collect and how you got to it, and the main lines in the US and EU come from a handful of cases. This is a summary for engineers, not legal advice:
- Van Buren v. United States (US Supreme Court, June 2021): you “exceed authorized access” under the CFAA only by entering parts of a system that are off limits to you, not by misusing data you were allowed to see.
- hiQ Labs v. LinkedIn (Ninth Circuit, April 2022): after Van Buren, the court again upheld an injunction letting hiQ scrape public LinkedIn profiles, finding serious questions whether the CFAA reaches public pages; the district court later found hiQ had breached LinkedIn’s User Agreement.
- Meta v. Bright Data (N.D. Cal., January 2024): Meta’s terms did not bar logged-off scraping of public data, because a visitor who never logs in does not “use” the service under those terms.
- Ryanair v. PR Aviation (EU Court of Justice, January 2015): a site can restrict reuse of its data through contract terms even when the data has no database right, subject to national law.
Put together, the practical lines are clear enough. Scraping public pages without logging in carries the least risk in the US. Once you create accounts and accept terms, you are bound by them, and rotating proxies to dodge a ban on those accounts reads badly in front of a judge. Personal data is a separate question. If the pages hold names, profiles or contact details of people in the EU, the GDPR applies to what you store, however public the page was.
Finally, the proxy network itself can be the legal problem, as the 911 S5, IPIDEA and NetNut takedowns showed. Ask a provider how it gets consent from the device owners before you ask about price.
Tools in this space
These are the providers and tools you will meet when you shop for each type. The list is alphabetical, it is not a ranking, and we did not run traffic through any of the commercial networks for this page:
- Bright Data: sells datacenter, ISP, residential and mobile proxies plus scraping APIs from one account, with pay-as-you-go and monthly plans.
- Decodo (formerly Smartproxy): residential pool advertised at 115 million IPs, with datacenter, ISP and mobile products and per-gigabyte plans from 3 GB.
- IPRoyal: residential traffic that does not expire, sourced partly through its Pawns bandwidth-sharing app, plus per-proxy datacenter and ISP plans and dedicated mobile modems.
- Oxylabs: enterprise-focused provider with all four proxy types and scraper APIs, sold as one subscription with usage tiers.
- SOAX: one per-gigabyte rate across residential and mobile, priced by country tier on credit plans.
- Squid: open-source forward proxy we used in the lab; run it on your own VPS and you have a datacenter proxy of your own.
- Webshare: per-proxy datacenter plans with a free tier of 10 proxies, plus static and rotating residential.
Whichever provider you pick, test it against your own target with a small plan before you buy volume, and log the success rate per type the way Proxyway does. A proxy is also only one layer of what a site sees. If you rotate exit IPs but keep one browser profile, the profile ties the requests back together, which is the job antidetect browsers such as MoreLogin take on. If all you want is to move your own traffic to another network, a WireGuard server on Fedora on a cheap VPS does that without renting anyone’s home connection.
Sources
Every number and claim above that is not from our lab comes from these:
- Proxyway, Proxy Market Research 2025 (success rates on Amazon, Google and Instagram, response times, median prices, ISP proxy ASN findings, provider views on mobile dongle farms): proxyway.com
- Imperva 2025 Bad Bot Report (51% automated traffic, 37% bad bots): imperva.com
- Squid directives
forwarded_forandvia(including “not available in the v8 version of Squid”): forwarded_for, via - RFC 6598, IANA-Reserved IPv4 Prefix for Shared Address Space (carrier-grade NAT): rfc-editor.org
- US Department of Justice, 911 S5 botnet dismantled, May 29, 2024 (19 million IPs): justice.gov
- Google Threat Intelligence Group, disrupting the IPIDEA residential proxy network, January 2026: cloud.google.com
- KrebsOnSecurity, FBI seizes NetNut proxy platform and Popa botnet, July 2026: krebsonsecurity.com
- Van Buren v. United States, 593 U.S. 374 (2021): supremecourt.gov
- hiQ Labs v. LinkedIn, No. 17-16783 (9th Cir. April 18, 2022): ca9.uscourts.gov; Meta v. Bright Data summary judgment of January 23, 2024, as summarised by Farella Braun + Martel: fbm.com
- Ryanair v. PR Aviation, Case C-30/14, judgment of January 15, 2015: EUR-Lex
- Prices from each provider’s pricing page, read October 31, 2026: Bright Data, Decodo, IPRoyal, SOAX, Webshare
Lab results (the ip-api.com flags, the Squid headers and the access log lines) come from our own runs on October 31, 2026, with Squid 7.7 and curl 8.21.0 on Fedora 45; the Hetzner and home addresses themselves are left out.
