Automated traffic passed human traffic for the first time in 2024, reaching 51% of all web requests, and 21% of bot attacks now arrive through residential proxies rather than datacenter ranges. Both figures come from the 2025 Imperva Bad Bot Report. That second number is why the datacenter vs residential proxies question keeps getting asked, and why it has quietly acquired a third answer.
The short version: a datacenter proxy is an IP on a rented server. A residential proxy relays your traffic through a consumer device on a home ISP line. A real device is neither, because on Archonum the browser runs on the smartphone that owns the IP, so no relay exists. These are not three grades of the same product. They differ in what physically originates the request, and that difference is what a detection system reads.
What is a datacenter proxy, and what does it actually cost?
A datacenter proxy is an IP address on a server rented from a hosting provider. Your code opens a connection to the proxy, the proxy forwards it, and the target sees an address belonging to a commercial hosting ASN.
Sourcing is trivial. The provider buys or leases IPv4 blocks and announces them. Nothing about the supply chain is contested, which is a large part of the appeal.
Cost is the strongest argument. Webshare’s published pricing, checked August 2026, lists shared datacenter proxies from $0.0299 per proxy per month down to $0.0179 at volume, with bandwidth sold as an account-level allowance of 250 GB on standard plans and unlimited on higher tiers. Rotating residential on the same price list runs $1.40 to $3.50 per GB. For a 500 GB crawl that is the difference between a rounding error and several hundred dollars.
What detection sees is the ASN. IPinfo builds its hosting and anonymizer classifications through active measurement, using a probe network that connects to services, analyzes handshakes and verifies exit-node behavior. Hosting ranges are the easiest category in that set. A site that wants to exclude datacenter traffic can do it with a list lookup, before any fingerprinting logic runs.
What is a residential proxy, and where do the IPs come from?
A residential proxy relays your request through a consumer device on a home ISP connection. The target sees a residential ASN. Your code still runs wherever you deployed it.
Sourcing is the part worth reading carefully, because the models differ more than the marketing suggests.
The documented legitimate model is SDK monetization. Bright Data’s trust center, last revised July 2024, describes an explicit opt-in: an app publisher embeds the SDK, the user agrees through a consent screen, and in exchange the app drops ads or unlocks a paid feature. Bright Data states the SDK collects no end-user data, offers two-click opt-out, and monitors device resources before using them.
The illegitimate end is unambiguous. In May 2024 the US Department of Justice announced the takedown of 911 S5, a residential proxy service assembled from roughly 19 million IP addresses across 190+ countries by bundling backdoor software into free VPN apps (ProxyGate, Mask VPN, Dew VPN) and into pirated software installers. Its administrator was arrested in Singapore on 24 May 2024.
Between those poles sits a large gray middle. The foundational measurement is still Mi et al., Resident Evil: Understanding Residential IP Proxy as a Dark Service, IEEE Symposium on Security and Privacy 2019. Infiltrating five commercial providers, the authors collected 6,183,876 unique residential proxy IPs spanning 238 countries. Of the 547,497 hosts they could identify by device type, 237,029 turned out to be IoT systems: web cameras, DVRs, printers. Their conclusion was carefully balanced. Some hosts had genuinely volunteered. Others had been recruited through stealthy compromise.
Consent quality remains contested in 2026. Include Security published research in June 2026 on Bright Data’s SDK inside connected-TV apps, noting that the consent notice was navigated by TV remote arrow keys and that the SDK shipped with a 200 GB default monthly WiFi allowance. Opt-in is a real mechanism. Whether a user pressing right-arrow on a TV remote has meaningfully exercised it is a fair question, and one your legal team may ask before your engineering team does.
After 911 S5, asking a provider exactly how its pool was built is normal diligence rather than a hostile question. Ask for the consent mechanism, the opt-out path, and what share of the pool comes from SDK partners versus resold upstream supply. A provider that will not answer in writing has answered.
What detection sees is an ordinary consumer ASN, which is exactly why residential proxies work, and why IPinfo notes that catching them needs a separate dataset from its standard VPN and proxy detection. The IP passes. Everything above the IP is unchanged: the browser is still whatever you ran in your own cloud, with whatever fingerprint that produces.
What is a real device, and why is it not a proxy?
A real device is not a proxy, because there is no relay in the path. On Archonum, Chrome runs on the smartphone that owns the IP. The network is 250,000+ real consumer smartphone nodes across 175+ countries, and the distance from device to target is one network hop.
No server holds the browser session and no proxy carries its traffic outward, so there is no split between the fingerprint and the exit address to reconcile.
This is also where the mobile proxies vs residential proxies comparison gets muddled, so precision helps. A mobile proxy routes your traffic through a SIM-equipped device on a carrier network. You get a carrier IP, usually behind CGNAT and therefore shared with many real subscribers, which makes it expensive for a site to block. That is a real advantage. But a mobile proxy is still a proxy: the browser runs on your infrastructure and the phone is the relay. Real devices remove the relay.
What detection sees is a consistent stack. Cloudflare’s bot-score documentation describes machine learning over request headers, session characteristics and browser signals, heuristics matched against known malicious fingerprints, and JavaScript detections aimed specifically at headless browsers. A real handset gives a truthful answer at every one of those layers because there is nothing synthetic underneath to contradict. We covered the fingerprint mechanics in why real devices beat emulators.
Cost is the honest counterweight. Archonum’s published plans start at $24.99 per month, with browser runtime at $0.09 to $0.12 per hour and bandwidth at $4.00 to $5.00 per GB. Per gigabyte that sits above residential and well above datacenter.
How do datacenter proxies, residential proxies and real devices compare?
Across the dimensions that decide the buying question: origin, price, and what a detector reads first.
| Dimension | Datacenter proxy | Residential proxy | Real device |
|---|---|---|---|
| What originates the request | Rented server | Your server, relayed via a home device | The smartphone itself |
| Where the browser runs | Your infrastructure | Your infrastructure | On the device that owns the IP |
| How IPs are sourced | Leased IPv4 blocks | SDK opt-in, or worse; varies by provider | Consumer handsets in the network |
| Network hops to target | 2+ | 2+ | 1 |
| Typical published price | $0.02 to $0.03 per proxy/month | $1.40 to $3.50 per GB | $4.00 to $5.00 per GB plus runtime |
| What detection reads first | Hosting ASN, caught by list lookup | Consumer ASN, passes IP checks | Consumer ASN, passes IP checks |
| Fingerprint consistency | Whatever your stack emits | Whatever your stack emits | Genuine handset, nothing to reconcile |
| Supply-chain scrutiny | Low | High, diligence required | Low |
| Best at | Volume against open targets | Geographic spread, plain HTTP fetching | Logged-in, fingerprinted, session-bound work |
Which should you actually pick?
Public APIs, open data portals, your own staging environments, sites with no bot management in front of them. At roughly two cents per proxy per month against $1.40 and up per gigabyte, nothing else is close on cost, and paying residential rates to fetch a public JSON endpoint is wasted money. Datacenter wins this outright.
Regional price and availability checks, SERP collection, catalog scraping where the response is HTML rather than a rendered application. Do your diligence on the provider first. After 911 S5, asking exactly how a pool was built is a normal procurement question rather than a hostile one.
Logged-in accounts, checkout and booking flows, anything behind Cloudflare, DataDome, Akamai or Kasada, and agent workloads that hold a session across many steps. A clean IP does not help when the block came from canvas entropy or a headless-browser check. That is the band Archonum is built for: 250,000+ real smartphones in 175+ countries, one hop to the target, drop-in for existing Playwright and Puppeteer scripts.
So the question to answer first is which layer your target actually inspects. If it stops at the ASN, buy the cheapest thing that clears the ASN. If it reads the browser, the IP was never the problem.