Residential proxy false positives: homes, CGNAT and Private Relay

Explore checkers, demos and evaluation routes →

A residential-proxy false positive occurs when the evaluated claim is wrong: for example, a known ordinary connection is incorrectly labeled as a proxy. A legitimate-user restriction is a related but different outcome. A privacy relay can be correctly detected while the application still responds too harshly to an otherwise legitimate visit.

Keep classification, abuse assessment and application action separate. That makes it possible to improve the control without pretending that all relay use is fraud or that every appeal proves a detector error.

Build a legitimate-user cohort you actually know

Use permitted sessions with independently established network and account conditions. Include ordinary home broadband, a shared household, mobile carrier NAT, an office connection and supported privacy-relay traffic. Record what is known, what is uncertain and what cannot be established from the test.

The shared address space defined by RFC 6598 supports carrier-grade NAT arrangements. Many subscribers can share a public egress address; the carrier’s internal shared-address range is not the same thing as the public address your website observes. Counting sessions per public IP therefore does not count people.

Apple’s Private Relay explanation describes two relays that separate knowledge of the client address from the destination. For supported Safari browsing, the website sees a temporary relay address. That privacy design can change IP-based location and rate-limit behavior without establishing abusive intent.

Label each evaluation question

Keep unresolved cases outside a clean “correct/incorrect” classification until their status is established. Report how many there are. Dropping them silently can make a detector look more reliable than the integrated system.

Inspect the reason, not only the color

A result might concern shared infrastructure, recent observed proxy participation, a device/network mismatch or repeated account activity. Those reasons support different responses. A mobile carrier IP with many customers is different from a controlled device repeatedly creating accounts to obtain a benefit.

IPQualityScore’s API documentation describes lower strictness settings and accommodation for public access points. Raising strictness changes the trade-off and can increase false positives and latency. Compare the same known cases before and after a change rather than judging only the number of blocked requests.

ShieldLabs supplies live device/network context, risk scoring and account-abuse findings. That richer context can help investigate why several users appear behind a shared exit. Inspect the actual signals and account relationships; a shared IP or device does not by itself establish a shared physical person.

Evaluate the application response

Record whether a session was allowed, restricted, reviewed or asked for additional verification through the actual application flow. If an order is delayed, also record whether a legitimate customer can complete the process and whether the review resolves before the useful deadline.

Use proportionate handling for uncertainty. Blanket denial of an entire ISP range can affect ordinary households whose sessions have no corresponding abuse evidence. A blanket exception for all residential addresses can also admit known abusive activity. The useful control acts on the relevant evidence and protected action.

Learn from corrections without circular labels

An appeal is a case to investigate, not an automatic false positive. No appeal is not proof that a restriction was correct: the person may simply leave. Payment success, a returned email and an analyst’s initial decision are also imperfect labels when used alone.

Preserve the evidence available at decision time, the reason for the response and the later correction. If a corrected case changes a threshold or workflow, rerun the permitted cohort and compare the complete outcomes. A new setting can reduce one type of error while increasing another.

Read the evaluation guide for clear denominators and the rotation guide for repeated activity across changing exits. The methodology supplies a common protocol for comparing vendors.

FAQ

Sources

Sources read October 21, 2026: RFC 6598, Apple Private Relay, IPQualityScore API settings and ShieldLabs proxy/VPN context.