Most defences against anonymised traffic work the same way underneath, whatever they are called. They recognise infrastructure.
A datacenter address is registered to a company that rents servers. A VPN exit is a host a provider operates for that purpose. A Tor exit is published in a directory anyone can read. In each case the address belongs to a machine that exists to move other people's traffic, and that fact is discoverable — from a registry, an operator's own documentation, or a public list.
Residential proxy networks break this, and they break it structurally rather than by being cleverer.
The address is genuinely residential
A residential proxy routes traffic through a real consumer connection. The address is a broadband subscriber's, issued by their ISP, on a network that serves households. There is nothing false about it and nothing to discover: every question the standard playbook asks returns the honest answer that this is somebody's home.
The supply comes from bandwidth-sharing software. Applications that pay users small amounts to resell idle capacity, SDKs bundled into free tools where the resale is disclosed somewhere in the terms, and at the dishonest end, compromised routers and devices whose owners were never asked. From the outside these are indistinguishable. The traffic leaves a residential connection either way.
This is also why the usual advice fails on contact. Blocking datacenter ranges does nothing, because this is not a datacenter. Checking the address against VPN lists does nothing, because no VPN provider is involved. Reputation history is thin, because a given exit may be used briefly and rarely reappears. The address is not on a list, and no list would be right to include it: the household on the other end is not an attacker, and may not know their connection is being resold at all.
What is left to work with
If the address cannot be recognised, the only thing remaining is what it does.
A home connection has a shape. It reaches a limited number of destinations, from a small and fairly stable set of devices, at a volume a household produces. That shape is not a rule anyone enforces — it is simply what a few people sharing a router look like.
An exit node has a different shape, and it is different for reasons the proxy operator cannot avoid. The address is being sold precisely so that many unrelated clients can use it, so it reaches destinations that have nothing to do with each other. Those clients bring their own devices and their own settings, which do not converge on a household's. And the address is worth money only while it is working, which sets a floor on how much it is used.
None of that is visible from the address. It is only visible in behaviour, over time, and — this is the part that decides who can do it — across enough separate vantage points to see fan-out at all. A single site sees its own traffic. Whether the same address is simultaneously working for a dozen unrelated destinations is not a question one site can ask.
The honest ceiling
Behavioural detection has a limit that no amount of engineering removes, and it is worth stating rather than talking around.
You never observe the proxy service. You observe traffic that is consistent with one. That is inference, and it stays inference however strong it gets, because the thing being inferred is not directly visible from where you are standing. A quiet exit node — used lightly, for one destination, by one client — produces no unusual shape and will not be found this way.
Which means the correct output is not a verdict. It is a graded finding, reported as likely rather than certain, weighted accordingly, and reversible when the behaviour stops. Being an exit node is a job an address holds for a while, not a property it acquires. Someone who uninstalls the software that was reselling their bandwidth has to be able to stop being treated as a proxy — and a system that only ever adds addresses to a list cannot offer them that.
Anyone selling certainty here is selling something they do not have. The useful version of this capability is the one that tells you how sure it is, and is willing to be wrong out loud.