Residential proxy traffic is difficult because the address can look ordinary.
Residential does not mean trustworthy
Compromised devices, proxy SDKs, and paid networks can all produce consumer-looking traffic with abusive intent.
Routes add texture
ASN history, routing changes, provider relationships, and geography can expose patterns that raw IP labels miss.
Link network and session evidence
Network evidence becomes stronger when it explains changes in device story, account behavior, and request timing.