I keep getting flagged even on stuff I thought was "clean"... not
just datacenter IPs, even some residential ones get caught within a day
or two. Starting to think it's not just IP reputation lists anymore.
Is it mostly TLS/JA3 fingerprinting, timing patterns, WebRTC leaks, or
something else entirely? And once an IP/fingerprint combo gets burned,
does rotating the IP alone fix it or does the fingerprint itself follow
you around somehow? Trying to figure out if I'm solving the wrong
problem by just buying "cleaner" proxies instead of fixing whatever's
actually leaking.
Hacking / Opsec
How are sites actually detecting proxy/VPN traffic now?
Started by dimaash · Jul 22, 2026
Proxies won’t get detected as quick if
you’re on clean IPs, which not all providers have - also depending on
platform it might be advisable to use mobile/4g proxies.
VPNs simply get flagged because you're using the same ISPs as a bunch of
other users, and the IPs have been flagged. VPNs don’t rotate IPs
nearly as often.
you’re on clean IPs, which not all providers have - also depending on
platform it might be advisable to use mobile/4g proxies.
VPNs simply get flagged because you're using the same ISPs as a bunch of
other users, and the IPs have been flagged. VPNs don’t rotate IPs
nearly as often.
It's rarely just one thing. IP
reputation still matters, but JA3/JA4 fingerprinting is the silent
killer right now. Your TLS handshake leaks your real browser or tool
even through a "clean" residential proxy. Cloudflare and Akamai have
gotten aggressive with this.
If you're using Python requests or curl, your JA3 hash is screaming
"bot" even with the cleanest IP. You need to either spoof the TLS
fingerprint at the library level or use something like
undetected-chromedriver that mimics real browsers.
Also, timing patterns. If your requests come at perfectly regular
intervals, even residential IPs get flagged. Add random jitter between
2-5 seconds. WebRTC leaks are still a problem if you're in a browser.
Rotating IP alone won't fix it. You need to fix the fingerprint first,
then rotate IPs. Otherwise you're just burning clean proxies.
I've built automation that handles all of this: JA3 spoofing, timing
randomization, and proxy rotation. If you need help setting it up, let
me know.
reputation still matters, but JA3/JA4 fingerprinting is the silent
killer right now. Your TLS handshake leaks your real browser or tool
even through a "clean" residential proxy. Cloudflare and Akamai have
gotten aggressive with this.
If you're using Python requests or curl, your JA3 hash is screaming
"bot" even with the cleanest IP. You need to either spoof the TLS
fingerprint at the library level or use something like
undetected-chromedriver that mimics real browsers.
Also, timing patterns. If your requests come at perfectly regular
intervals, even residential IPs get flagged. Add random jitter between
2-5 seconds. WebRTC leaks are still a problem if you're in a browser.
Rotating IP alone won't fix it. You need to fix the fingerprint first,
then rotate IPs. Otherwise you're just burning clean proxies.
I've built automation that handles all of this: JA3 spoofing, timing
randomization, and proxy rotation. If you need help setting it up, let
me know.
I’d like to ask a question, too. How can we prevent web automation tools from being flagged as bots?
By generating a unique fingerprint for
each running thread (if you’re multi-threading). Basically means every
action needs to be followed by some kind of randomization.
You also need to make sure that (again if multi-threading/accounting)
each thread is running isolated, having unique IPs are one aspect of it.
each running thread (if you’re multi-threading). Basically means every
action needs to be followed by some kind of randomization.
You also need to make sure that (again if multi-threading/accounting)
each thread is running isolated, having unique IPs are one aspect of it.
VPN's are detected by exit IP address
lookup. If you connect to the internet via a VPN, go to browserleaks.com
and it will show you what websites see. Proton shows up as Proton
(duh). Mullvad shows up as various, including forged networks. But don't
rely on that as there are list of all exits that some sites use.
As for proxies, look up their T&C. Rent a proxy and test the leaks and whether it's been used before and compromised.
lookup. If you connect to the internet via a VPN, go to browserleaks.com
and it will show you what websites see. Proton shows up as Proton
(duh). Mullvad shows up as various, including forged networks. But don't
rely on that as there are list of all exits that some sites use.
As for proxies, look up their T&C. Rent a proxy and test the leaks and whether it's been used before and compromised.