Proxies are not a privacy feature in checker tooling — they are an egress-reputation budget, and every proxy class trades cost against longevity differently. Datacenter ranges (cloud VPS blocks) are cheap per-guaranteed-gigabyte and die fastest against any target running IP-reputation scoring, because the ranges themselves advertise as non-residential in every commercial reputation database. Residential pools (ISP-allocated addresses through peer networks) carry gate traffic longest because the addresses profile as real households, at 5-to-20x the datacenter price. Mobile (carrier-grade NAT pools) survive the hardest reputation layers at the highest price and the weirdest concurrency constraints (hundreds of users behind one CGNAT address). This is proxy architecture for checkers decoded: the four classes and what each is actually for, the sticky-versus-rotating session decision that most integrations get backwards, the health-check discipline that keeps a pool from silently poisoning results, and the cost math that decides which class rides which layer of the stack.
ROUTE MAP (PLAIN ENGLISH)
The class hierarchy runs on two axes: cost per usable request and survival time per reputation tier. Datacenter: pennies per gigabyte, minutes-to-hours against aggressive reputation scoring, fine for non-gated traffic (BIN-lookup APIs, static site fetches, website-checker status probes on soft targets) and fatal for gate authorizations and protected-target challenges. Residential: dollars per gigabyte, hours-to-days against the same scoring, the default class for gate layers and challenge-bound solves. ISP/static-residential: datacenter economics with residential reputation (single-hop ISP addresses provisioned as "residential" in reputation databases) — the middle class that gate-heavy operations increasingly standardize on for cost-controlled longevity. Mobile: premium pricing, survives what kills residential (carrier NAT's shared-address nature makes per-user attribution hard for reputation layers), constrained by CGNAT concurrency limits and higher latency — the escalation class for the hardest targets, not the default.
Session strategy is where most homemade stacks invert the correct decision. Sticky sessions (one exit identity held across a session's requests — challenge fetch, solve binding, retry submission, or a config's multi-step flow) are mandatory for anything with inter-request state, because reputation layers score *behavioral coherence* — an authenticated flow that changes IPs mid-sequence is a signature, not a privacy win. Rotating sessions (fresh exit per request) are correct only for stateless mass traffic (website-checker probes, mass BIN lookups) where each request is independent and IP diversity across the batch is the goal. The integration bug pattern: rotating proxies on a config that maintains session cookies — every request arrives from a new household carrying the previous request's cookie jar, which is the single most deterministic bot-signal a reputation layer can ask for, and it burns the proxy pool's reputation for every other consumer sharing those exits.
STEP 1 - CLASS DEPLOYMENT BY LAYER
STEP 2 - PROVIDER SELECTION SIGNALS
STEP 3 - HEALTH CHECKS AND POOL MAINTENANCE
STEP 4 - COST MATH PER CLASS
WORKED EXAMPLE - A POOL ROTATION DECISION
Operation running gate authorizations through a residential provider, three CIDR ranges in rotation, per-thread sticky binding, ban-rate normally 8 per thousand. Tuesday's run: bans spike to 90 per thousand, concentrated: range-a shows 140/thousand, range-b 85, range-c 6 — the range-level correlation (not scattered single-exit bans) reads as a reputation-database update hitting ranges a and b together, not a config change or key burn (keys were fine, decline ratios unchanged, no challenge-class spike). Response, in order: ranges a and b pulled to cooldown wholesale (not exit-by-exit — the CIDR-level correlation makes individual cooldown pointless), range-c promoted with fresh exits topping it up, throughput throttled to 40% while the smaller pool absorbs, mobile-class escalation enabled only for the highest-value lines (the tier where conversion value justifies premium-class spend during the rotation window). Range-a's cooldown probe after 48 hours: still 80% ban-rate on re-entry test — stays out; range-b probes clean at 5% — returns to rotation. Total cost of the wave: two days of throttled throughput on one healthy range plus a thin mobile-class spend on priority lines — versus the alternatives' costs (keep hammering dead ranges = key-burn cascade and result poisoning; wholesale mobile upgrade = 5x proxy spend for weeks against a problem that resolved itself in four days at range level).
WORKING SEQUENCE
QUICK ANSWERS
RELATED
The class hierarchy runs on two axes: cost per usable request and survival time per reputation tier. Datacenter: pennies per gigabyte, minutes-to-hours against aggressive reputation scoring, fine for non-gated traffic (BIN-lookup APIs, static site fetches, website-checker status probes on soft targets) and fatal for gate authorizations and protected-target challenges. Residential: dollars per gigabyte, hours-to-days against the same scoring, the default class for gate layers and challenge-bound solves. ISP/static-residential: datacenter economics with residential reputation (single-hop ISP addresses provisioned as "residential" in reputation databases) — the middle class that gate-heavy operations increasingly standardize on for cost-controlled longevity. Mobile: premium pricing, survives what kills residential (carrier NAT's shared-address nature makes per-user attribution hard for reputation layers), constrained by CGNAT concurrency limits and higher latency — the escalation class for the hardest targets, not the default.
Session strategy is where most homemade stacks invert the correct decision. Sticky sessions (one exit identity held across a session's requests — challenge fetch, solve binding, retry submission, or a config's multi-step flow) are mandatory for anything with inter-request state, because reputation layers score *behavioral coherence* — an authenticated flow that changes IPs mid-sequence is a signature, not a privacy win. Rotating sessions (fresh exit per request) are correct only for stateless mass traffic (website-checker probes, mass BIN lookups) where each request is independent and IP diversity across the batch is the goal. The integration bug pattern: rotating proxies on a config that maintains session cookies — every request arrives from a new household carrying the previous request's cookie jar, which is the single most deterministic bot-signal a reputation layer can ask for, and it burns the proxy pool's reputation for every other consumer sharing those exits.
STEP 1 - CLASS DEPLOYMENT BY LAYER
- Gate/authorization layer: sticky residential or ISP per-thread — one exit bound to one worker for the thread's lifetime, session coherence intact, reputation budget spent where it buys longevity; the per-thread binding doubles as the ban-rate attribution key (bans graph per provider range through the thread's known binding).
- Challenge/solve layer: the same sticky exit the challenge fetch used (the anti-captcha binding rule — solve bound to fetch IP, submit through same exit), residential floor for the whole three-leg lifecycle; rotating here is guaranteed token-reject.
- Lookups and probes: rotating datacenter is fine — BIN API calls, status-code probes on soft targets, and any request where the target has no inter-request state and no aggressive reputation layer; the cost difference (datacenter pennies vs residential dollars per GB) is exactly why non-gated traffic should never ride the residential budget.
- Escalation ladder: a residential-range ban wave on a hard target escalates that target's traffic to mobile-class exits (or a fresher residential range) rather than upgrading the whole pool — class decisions are per-target, informed by that target's observed ban-rate curve, not a global preference.
STEP 2 - PROVIDER SELECTION SIGNALS
- Pool provenance: "residential" claims vary wildly — genuine peer-network residential (devices, apps, real ISP allocations) versus mislabeled datacenter ranges (the cheap "residential" that reputation databases unmapped within weeks); the operational test: run a small gate batch and graph ban-rate per provider — genuine residential on a mid-tier target shows single-digit bans per thousand, mislabeled ranges show datacenter-class death curves regardless of marketing.
- Rotation control granularity: sticky-session support with real session-duration control (minutes-to-hours holds, not best-effort), per-thread binding endpoints, and geo-targeting by country/region/city where the target's flow correlates geography with identity (payment gates correlating BIN-country with egress-country); providers without sticky control are unusable for gate work regardless of pool quality.
- Concurrency and CGNAT reality: mobile-class pools share addresses across many users — high-concurrency hammering from one CGNAT address trips rate-limits that have nothing to do with your behavior and everything to do with co-tenants; mobile-class workloads run low-and-slow by necessity, and providers advertising "unlimited concurrent mobile" are describing the shared-address problem, not solving it.
- Protocol and DNS hygiene: HTTP and SOCKS5 both carry checker traffic fine; SOCKS5's DNS-resolution-mode option matters — remote DNS resolution (the proxy resolves target hostnames, not the local stack) prevents DNS-leak fingerprints where the request egresses through a residential exit but the DNS lookup fingerprints the local network; half of "why does my residential proxy still ban instantly" debugging ends at DNS resolution mode.
STEP 3 - HEALTH CHECKS AND POOL MAINTENANCE
- Pre-flight validation: a known-good probe target run through each proxy before it enters the working pool (connection succeeds, exit geolocation matches the provider's claim, no transparent-proxy interception headers) — dead-on-arrival exits waste gate attempts and corrupt ban-rate math if left in.
- Runtime health signals: per-proxy success-rate and latency tracking during runs — a proxy whose error streak crosses threshold mid-run gets pulled to a cooldown pool instead of continuing to burn keys and solves through a dying exit; cooldown expiry re-probes before return to the working pool.
- Ban-wave correlation: bans graphed per provider range over time — a range-wide spike (most exits in one CIDR banning together) means the reputation database updated that block, rotate the range out wholesale; scattered single-exit bans mean individual exit bad-luck, cooldown-and-replace at the exit level; conflating the two either keeps dead ranges in rotation too long or rotates healthy ranges out unnecessarily.
- Burn-rate budgeting: each class carries a monthly spend budget (datacenter pennies rarely need rationing; residential and mobile do), consumed per gigabyte or per-thousand-requests, with the run reports feeding actual spend-per-class against budget — the operations that survive long-term track proxy spend per live-result alongside gate and solve costs, not as an invisible line item.
STEP 4 - COST MATH PER CLASS
- Unit economics: datacenter in the low pennies per GB (or per-thousand-exit-model pricing), residential in the low-to-mid dollars per GB, ISP/static-residential between them, mobile at premium dollars per GB — the spread is 100x between cheapest datacenter and premium mobile, which is why class-by-layer deployment (cheap class on ungated traffic, premium class only where it earns its keep) is the whole cost-control strategy.
- Effective cost per usable request: sticker price divided by survival rate — a $2/GB residential pool that survives 90% of gate attempts costs less per usable authorization than a $0.10/GB datacenter pool that dies at 95% (usable-request cost inverts the sticker order), which is the arithmetic that kills "just use cheap datacenter everywhere" thinking within one ban-wave analysis.
- Throughput-per-dollar by class: gate work at 100 req/min through residential with 5GB/hour consumption versus the same throughput through mobile at 8GB/hour premium pricing — the escalation class earns its cost only when residential survival has collapsed below the operation's viability floor, not as a default upgrade.
- The whole-stack join: proxy spend per class joins solve spend, gate/key costs, and tooling time in the per-live-result figure — architectures that track only the gate layer's economics misprice proxy decisions, and proxy architectures that track only sticker price misprice class decisions; the per-live-result number is the only honest comparison surface.
WORKED EXAMPLE - A POOL ROTATION DECISION
Operation running gate authorizations through a residential provider, three CIDR ranges in rotation, per-thread sticky binding, ban-rate normally 8 per thousand. Tuesday's run: bans spike to 90 per thousand, concentrated: range-a shows 140/thousand, range-b 85, range-c 6 — the range-level correlation (not scattered single-exit bans) reads as a reputation-database update hitting ranges a and b together, not a config change or key burn (keys were fine, decline ratios unchanged, no challenge-class spike). Response, in order: ranges a and b pulled to cooldown wholesale (not exit-by-exit — the CIDR-level correlation makes individual cooldown pointless), range-c promoted with fresh exits topping it up, throughput throttled to 40% while the smaller pool absorbs, mobile-class escalation enabled only for the highest-value lines (the tier where conversion value justifies premium-class spend during the rotation window). Range-a's cooldown probe after 48 hours: still 80% ban-rate on re-entry test — stays out; range-b probes clean at 5% — returns to rotation. Total cost of the wave: two days of throttled throughput on one healthy range plus a thin mobile-class spend on priority lines — versus the alternatives' costs (keep hammering dead ranges = key-burn cascade and result poisoning; wholesale mobile upgrade = 5x proxy spend for weeks against a problem that resolved itself in four days at range level).
WORKING SEQUENCE
Code:
proxy architecture: class by layer (gate=sticky residential/ISP per-thread, solve=same-exit binding, probes=rotating datacenter, hard targets=mobile escalation) -> sticky for state-inter-request flows, rotating only for stateless mass traffic -> provider test: ban-rate graph per range beats marketing claims -> DNS: remote resolution via SOCKS5 kills dns-leak fingerprint -> health: pre-flight probe, runtime error-streak pulls, range-level ban-wave correlation, cooldown re-probe -> cost: effective cost-per-usable-request inverts sticker order, whole-stack per-live-result figure joins proxy+solve+gate spendQUICK ANSWERS
- Datacenter or residential for gate work? Sticky residential or ISP-class, per-thread bound — datacenter ranges die against reputation scoring in minutes-to-hours regardless of request volume discipline, and the effective cost-per-usable-request inverts the sticker price once death rates are counted; datacenter belongs on ungated traffic (BIN lookups, soft-target probes) where the reputation layer is not looking.
- What does sticky vs rotating actually mean? Sticky holds one exit identity across a session's requests (mandatory for anything with cookies, challenge tokens, or multi-step flows — reputation scores behavioral coherence, mid-session IP changes are a deterministic bot-signal); rotating gives a fresh exit per request (correct only for stateless mass traffic where per-request independence is the property you want); rotating on session-bearing flows burns the pool's reputation for every co-tenant sharing those exits.
- Why do my residential proxies ban instantly anyway? Three usual causes: mislabeled datacenter ranges sold as residential (test with ban-rate graphs per provider — genuine residential shows single-digit bans per thousand on mid-tier targets), DNS leaks (local resolution fingerprints the real network while egress exits through the proxy — fix with SOCKS5 remote-DNS mode), or the mid-session rotation bug (session cookies arriving from fresh exits every request — the most deterministic bot-signal a reputation layer can receive).
- How do I maintain a proxy pool long-term? Pre-flight probe before pool entry, runtime error-streak tracking with cooldown pulls, range-level ban-wave correlation (CIDR-wide spikes = reputation-database update, rotate the range wholesale; scattered single-exit bans = cooldown-and-replace at exit level), cooldown re-probe before return, and monthly spend-per-class tracking against budget — the range-level versus exit-level distinction is what keeps rotation decisions correctly scoped.
- When is mobile-class proxy worth the premium? When residential survival on a specific hard target collapses below the operation's viability floor (ban-rate curve making cost-per-usable-request worse than mobile's sticker price) — it is the escalation class for targeted lines during rotation windows, never the default: CGNAT shared-address constraints cap sane concurrency, latency runs higher, and the economics only close on high-value targets where conversion value justifies premium spend.
- What is the whole-stack cost figure that actually matters? Per-live-result cost: (proxy spend by class + captcha solve spend + gate/key costs + tooling time) divided by live results produced — architectures tracking only gate economics misprice proxy decisions, proxy views tracking only sticker price misprice class decisions; the per-live-result number is the only surface where a residential upgrade, a solve-service switch, and a key-rotation policy can be honestly compared against each other.
RELATED