Residential Proxies Undergo Scrutiny

Residential proxies, once considered the gold standard for anonymous illicit activity, are losing their status as a singular, reliable bypass for fraud detection. As financial institutions bolster their security stacks, threat actors are abandoning simplistic tools in favor of complex identity-simulation strategies that blend IP data with browser fingerprints and device behaviors.

The Shift Toward Clean IP Pools

In underground forums, a distinct shift is occurring: cybercriminals no longer view residential proxies as a monolith of trust. Instead, they are categorizing them into “clean” and “dirty” pools based on their history of use. The core concern for attackers is whether an IP address has previously been flagged by payment processors or banks, as repeated abuse leads to higher fraud scores and eventual blocking of the entire address range.

• Flare researchers analyzed 2,889 unique underground posts across 545 discussion threads.
• Data collection spanned a period of two years.
• The FBI and industry partners seized hundreds of domains associated with the NetNut proxy platform and the Popa botnet.
• Criminal networks connected to the Popa botnet utilized at least two million compromised devices.

Refining the Digital Persona

Modern carding techniques require more than just a matching country code. Attackers are now attempting to achieve geographic consistency that aligns an IP address with a victim's specific billing ZIP code, local time zone, and language settings. This granular level of detail is intended to mirror the legitimate browsing patterns of a standard consumer, yet it remains a significant hurdle for those trying to bypass modern security controls.

“Clean” has replaced “residential”

— According to research findings from Flare.

The Infrastructure of Detection

The reliance on residential proxies is increasingly just one layer in a broader, more fragile identity-simulation stack. When proxies fail to account for device fingerprints or contradictory browser profiles, the entire fraudulent session is at risk of detection. Consequently, many actors are actively seeking out providers that offer “finance enabled” or “bank compatible” IPs that have not yet been burned by prior illicit traffic.

Implications for Security Teams

The evolving behavior of these actors signals a growing burden for security organizations. Because criminals are now forced to spend significant resources curating infrastructure that survives fraud filters, the cost of committing financial fraud is steadily rising. For defenders, the key takeaway is that an IP address, even one originating from a residential provider, should never be treated as an absolute indicator of a legitimate user. Instead, security teams must prioritize session consistency—evaluating account age, payment history, and behavioral patterns—to identify the clusters of synthetic identities attempting to mimic authentic traffic.