Proxy Glossary

A 4G proxy is a mobile proxy whose exit runs on an LTE connection, using an address the mobile operator assigns to a SIM. It behaves like any phone on that network: carrier ASN, carrier geolocation, a public address shared with other subscribers, and a new one available whenever the data session is re-established.

A 5G proxy is a mobile proxy whose exit device connects over a 5G network, giving higher throughput and lower radio latency than LTE. To a website it is indistinguishable from a 4G exit on the same carrier, because both draw public addresses from the same operator ranges and report the same ASN.

Account farming is registering accounts in bulk and warming them with ordinary activity before they are used. New registrations carry the least trust on any platform, so operators age them and build a history, keeping each one on a consistent IP, device fingerprint and behaviour pattern. Most platforms prohibit the practice in their terms.

Ad verification is the practice of checking that ads ran as they were bought: the right creative, the right geography, an acceptable page, a viewable position. Because ad delivery is decided from the request's IP, device and profile, verification teams load publisher pages from many locations and record exactly what was served.

An AI agent is a program that lets a language model choose its own next action toward a goal, calling tools such as a browser, an HTTP client or a shell between reasoning steps and feeding each result back into its context. A fixed script sets the order in advance; an agent derives it from what the last step returned.

Airplane mode switches off a device's radios. Toggling it on a mobile proxy forces the modem to detach from the carrier and attach again, which normally returns a different public IP from the operator's pool. It is how dedicated mobile proxies rotate, and USB modems accept the same instruction as an AT command.

Anonymity, in proxy terms, is how much a destination server can learn about the client behind a connection. Proxy listings grade it by whether the proxy forwards your real IP or announces itself in request headers, though DNS, WebRTC and TLS details can give away the same information a header would.

An anonymous proxy hides the client's real IP address from the destination server but still identifies itself as a proxy, typically through a Via or Proxy-Connection header. The site learns that an intermediary is in the path and can act on that, without ever learning where the request originated.

An antidetect browser is a browser built to run many separate identities on one machine. Each profile keeps its own cookies, storage and cache, its own proxy, and its own fingerprint - user agent, screen metrics, timezone, canvas and WebGL values - so sites see distinct devices instead of one browser switching between accounts.

An API (application programming interface) is a defined contract that lets one program call another. On the web that usually means HTTP endpoints returning JSON, with an authentication header, documented parameters and stable error codes. Proxy providers publish APIs so a script can list endpoints, trigger an IP rotation or read bandwidth usage without anyone opening a dashboard.

An Autonomous System Number identifies a network that announces its own IP address ranges to the rest of the internet through BGP. Every routable address sits inside a prefix announced by some AS, so the ASN behind an IP tells you who operates it - a mobile carrier, a hosting provider, a home ISP or a corporate network.

A backconnect proxy is a single hostname and port that fronts a pool of many IP addresses. The client keeps one connection string while the provider's gateway assigns a different exit IP per request, per session or on a timer. Rotation and pool health checks happen upstream, where the client cannot see them.

Bandwidth carries two meanings in proxy work. One is link capacity, measured in bits per second. The other is transferred volume, measured in gigabytes, and that is what proxy providers bill. Metering counts every byte crossing the proxy in both directions, including protocol overhead, headers, redirects, images and requests that end in a block.

Bandwidth pricing charges for the data a proxy moves, metered per gigabyte, instead of charging per endpoint or per seat. Mobile and residential networks use it because the provider pays real carrier data costs. Rates usually step down as committed volume rises, and providers differ on what counts as billable data.

A blacklist is a list of IP addresses, domains or ranges that a service refuses or restricts. Public DNS blacklists such as Spamhaus target mail abuse, while anti-bot vendors, CDNs and individual sites keep private ones. An address lands on a list after abuse reports, spam or automated traffic, and removal ranges from automatic expiry to a manual delisting request.

Bot detection is the practice of separating automated traffic from human traffic. Systems score each request against network signals, transport-layer fingerprints, browser characteristics and behaviour over time, then allow, challenge or block it. Vendors including Cloudflare, DataDome, Akamai and HUMAN sell this as a service running in front of the origin server.

Browser automation is the scripted control of a real browser, navigating, clicking, typing and reading the rendered DOM in place of a person doing it by hand. Playwright, Puppeteer and Selenium drive Chromium, Firefox and WebKit over a debugging or WebDriver protocol, headless or with a visible window, for testing, scraping and agent work.

A browser fingerprint is an identifier derived from the properties your browser exposes - user agent, screen and window dimensions, timezone, language, installed fonts, canvas and WebGL rendering output, audio stack behaviour, hardware concurrency. Combined, these values are often unique enough to recognise the same browser across sessions and sites without any cookie.

Canvas fingerprinting draws hidden text and shapes into an HTML5 canvas, reads the pixels back with toDataURL or getImageData, and hashes them. The exact output varies with GPU, graphics driver, font rendering and anti-aliasing, so the hash stays stable for one device and browser build while differing between machines.

A CAPTCHA is a challenge a site serves to decide whether a visitor is a person or a script. Modern versions rarely show distorted text; they score behaviour, browser fingerprint and IP reputation in the background, and only show a puzzle when confidence is low. reCAPTCHA, hCaptcha and Cloudflare Turnstile dominate deployment.

A carrier, or mobile network operator, is the company that owns the radio network and core infrastructure a phone connects to, such as AT&T, Vodafone or Orange. It assigns each device an address from its own IP ranges and ASN, which is what makes traffic from a mobile proxy read as an ordinary subscriber to the sites receiving it.

Carrier-grade NAT is address translation performed by an ISP rather than in the customer's router, putting many subscribers behind one public IPv4 address. Mobile networks depend on it. Each customer holds a private or shared-range address, usually from 100.64.0.0/10, and the carrier rewrites the source address and port on every outbound flow.

Cloudflare is a CDN and security company whose reverse proxy sits in front of a large share of public websites. Traffic to a protected domain reaches Cloudflare's network first, where caching, DDoS filtering, WAF rules and bot scoring run before anything reaches the origin server. The edge challenges or blocks whatever it judges automated.

Concurrent connections are the number of proxy connections open at the same moment, counted across your workers rather than over a period. It is a capacity limit, separate from requests per second and from bandwidth. Ten connections can carry thousands of requests an hour when each is short, or almost none when each holds a slow page open.

A datacenter proxy runs on a server in a hosting facility, using an IP address registered to a cloud or colocation provider rather than to a consumer ISP or a mobile carrier. It is fast and cheap, and it is the easiest kind for a website to identify, because hosting ranges are public knowledge.

A dedicated proxy reserves a resource for one customer instead of sharing it among many. What gets reserved varies by product: an exit IP, a port on a gateway, or, on a mobile network, a whole modem and SIM whose traffic is yours alone. Dedicated describes exclusivity, not a fixed address.

A device fingerprint is an identifier built from the hardware and software traits a device exposes: screen geometry, GPU and driver strings, CPU core count, memory, timezone, languages, installed fonts, audio and canvas rendering, and touch support. Hashed together, those values are stable enough to recognise a returning device across sessions without any cookie.

The Domain Name System turns a hostname such as example.com into the IP addresses a client can connect to. A stub resolver on the device asks a recursive resolver, which walks the root, TLD and authoritative name servers, then caches the answer for the record's TTL. Queries travel on port 53, or over TLS or HTTPS when encrypted.

A DNS leak happens when a client sends its name lookups outside the proxy tunnel, so queries travel over the real ISP connection while the traffic itself exits on the proxy IP. The resolver operator, and any authoritative server it contacts, then sees a lookup tied to your actual network, region and provider.

An elite proxy, also called a high-anonymity or level 1 proxy, forwards requests without adding Via, X-Forwarded-For or any other header that reveals an intermediary. To the destination server the traffic reads as an ordinary direct connection from the proxy's own IP address. That address can still be classified.

A proxy endpoint is the address a client dials to reach a proxy, a hostname or IP plus a port, usually with credentials attached. Written as host:port, it is the single string you paste into a browser, scraper or antidetect profile. One endpoint can map to one fixed device or to a whole rotating pool.

Geo-restriction is a service limiting access or content by the visitor's apparent location. The site maps the client IP to a country through a geolocation database, then blocks the request or quietly swaps in a regional catalogue with local pricing. Content licensing, sanctions rules, tax registration and commercial strategy are the usual reasons.

Geotargeting is choosing which country, region, city or carrier your proxy traffic exits from, so a site sees a visitor located where you want. You select it through parameters in the proxy username, a country-specific hostname, or a dedicated port, and the site reads that exit IP against whichever geolocation database it uses.

A headless browser is a real browser engine running without a visible window. It loads pages and runs their JavaScript the way a visible browser does, rendering to an off-screen buffer and taking instructions from a script rather than a person. Puppeteer, Playwright and Selenium all drive browsers in this mode.

An HTTP proxy is a server that forwards HTTP requests on a client's behalf, parsing the protocol rather than blindly relaying bytes. The client sends the full target URL in the request line, or issues a CONNECT to tunnel an HTTPS session. Proxies conventionally listen on ports such as 8080 or 3128; port 80 belongs to the origin web server.

HTTP/2 is a binary version of HTTP that carries many concurrent requests as multiplexed streams over a single TCP connection and compresses headers with HPACK. It keeps HTTP's methods, status codes and header semantics unchanged, so only the wire format differs. Browsers negotiate it during the TLS handshake through ALPN, advertising the identifier h2.

HTTP/3 is HTTP carried over QUIC, which runs on UDP and builds the TLS 1.3 handshake into the transport itself. It keeps HTTP semantics and HTTP/2-style multiplexing while removing TCP's head-of-line blocking, so a lost packet stalls only its own stream. Clients discover it from an Alt-Svc header or an HTTPS DNS record and negotiate it as h3.

An HTTPS proxy carries encrypted TLS traffic between a client and a destination site, usually by opening a tunnel with the HTTP CONNECT method to port 443. The proxy relays raw bytes without reading the request path, headers or body. The term also describes a proxy whose own listening port accepts a TLS-encrypted client connection.

An IP address is the numeric identifier a device presents on an IP network so packets can be routed to and from it. IPv4 writes 32 bits as four decimal octets, such as 203.0.113.7. IPv6 writes 128 bits as hexadecimal groups, such as 2001:db8::1. Every request a server logs is tied to one.

IP authentication authorizes a proxy client by the source address of its connection instead of a credential. You register the public IP of the machine that will connect, and the provider's gateway accepts sessions from it while refusing the rest. There is no Proxy-Authorization header to send and no password sitting in a config file.

IP reputation is the trust score a website, mail server or anti-bot system assigns to an IP address based on the traffic it has produced before. Spam complaints, request patterns, past abuse reports, hosting type and ASN ownership all feed that score. A poor one earns CAPTCHAs where a good one passes, or a refusal with no explanation.

IP rotation is the practice of changing the outbound address a client uses, on every request, on a timer, or on demand. It spreads traffic so no single address builds up enough volume to be rate limited or banned, and it is the defining behaviour of rotating and backconnect proxy services.

IPv4 is version 4 of the Internet Protocol, addressing hosts with 32 bits written as four dot-separated octets, which gives roughly 4.3 billion addresses. The top-level pool ran dry in 2011, pushing providers toward private addressing, carrier-grade NAT and a paid transfer market. Nearly all proxy traffic still runs over IPv4 because that is what target sites accept.

IPv6 is version 6 of the Internet Protocol, addressing hosts with 128 bits written as eight hexadecimal groups, such as 2001:db8::1. The space is large enough that carriers assign each subscriber a whole subnet, usually a /64 or wider, so reputation systems score prefixes instead of single addresses. Adoption is broad but far from universal.

JA3 is a TLS client fingerprinting method that reads five fields from the ClientHello, joins their decimal values into a single string and hashes it with MD5. The fields are TLS version, cipher suites, extensions, supported elliptic curves and EC point formats. The 32-character result groups clients by TLS library and configuration.

JA4 is the TLS client fingerprint in the JA4+ family published by FoxIO, designed to replace JA3. Rather than one opaque MD5, it produces a partly readable string: a ten-character prefix describing transport, TLS version, SNI, cipher and extension counts and ALPN, followed by two truncated SHA-256 digests of the sorted cipher and extension lists.

Latency is the delay between sending a request and receiving the first byte back, measured as round-trip time in milliseconds. Through a proxy it spans the client's hop out, the proxy's hop to the target and the return leg. A mobile exit adds more delay than a datacenter one, since radio scheduling and carrier NAT sit in the path.

LTE, or Long-Term Evolution, is the 3GPP radio standard behind 4G mobile networks. It carries voice and data over an all-IP core that assigns every attached device an address from the operator's range. Proxies built on LTE modems inherit those carrier addresses, which websites treat very differently from datacenter ranges.

MCP, the Model Context Protocol, is an open standard for connecting AI assistants to external tools and data. A server declares the tools, resources and prompts it provides; a client such as Claude Desktop, Claude Code or an IDE discovers them at runtime over JSON-RPC and calls them on the model's behalf, so one integration works across every compatible assistant.

A mobile proxy routes traffic through an IP address assigned by a cellular carrier, so requests appear to come from a handset or modem on a 4G or 5G network. Carriers share each public address among many subscribers, which gives mobile IPs a reputation that anti-bot systems are reluctant to block.

A modem is the hardware that speaks a carrier's radio protocol and presents the result to a computer as an IP connection. Mobile proxy infrastructure runs on 4G and 5G modems - USB dongles, industrial routers or phones - each holding a SIM and giving its host one real carrier address.

Multi-accounting is operating several accounts on one platform from the same machine or team. Platforms link accounts by IP address, cookies, device fingerprint and behaviour, so each identity needs its own consistent set of those signals, typically a separate antidetect browser profile paired with a separate and stable proxy exit.

Network Address Translation rewrites the address and port fields of packets as they cross a router, letting many private hosts share one public IP. The router keeps a translation table, mapping each outbound flow to a free public port and reversing the rewrite on replies. Home routers do this for a household; carriers do it for whole regions.

p0f is a passive OS fingerprinting tool that identifies the system behind a connection by watching traffic rather than probing it. It reads TCP SYN packets for initial TTL, window size, MSS, the order of TCP options and a set of quirk flags, then matches them against a signature database. It sends nothing to the host it identifies.

Playwright is Microsoft's browser automation library. A single API drives Chromium, Firefox and WebKit, with official bindings for JavaScript, Python, .NET and Java. It has auto-waiting, isolated browser contexts, per-context proxy settings and a trace viewer that replays a failed run step by step, which makes it the usual pick for new automation projects.

A port is a 16-bit number that identifies one network service on a host, so a single IP address can run many services at once. TCP and UDP each have their own range from 0 to 65535. Proxy endpoints are written host:port, and the port decides which listener answers you.

Port pricing charges a fixed fee for each proxy endpoint - a port, a modem or a dedicated IP - usually monthly and regardless of how much data passes through it. Dedicated mobile proxy sellers use it because every port is a physical SIM and modem they keep powered and rotating.

Price monitoring is the repeated collection of competitor prices, stock and promotions from retail sites and marketplaces. Retailers vary what they display by country, currency, delivery postcode, device and account, so the IP and session of the collecting client decide which price it records. That is why the checks run through geo-targeted proxies.

A private proxy is allocated to one customer, so no other user of the provider sends traffic through the same exit address. Exclusivity buys predictable bandwidth and a reputation history you alone create. On residential and mobile networks the address is still shared with the carrier's own subscribers, which is a different kind of sharing.

A proxy pool is the set of IP addresses a provider can route your traffic through. Its usefulness comes from composition as much as from size: how many distinct subnets and autonomous systems it spans, how many countries it reaches, how heavily each address is reused, and how clean those addresses look to the sites you target.

A proxy server is an intermediary that accepts your connection, makes its own request to the destination, and relays the response back. The destination logs the proxy's IP address instead of yours. Proxies are used for anonymity, geographic routing, access control, caching, and spreading a workload across many addresses so no single one is rate limited.

Puppeteer is a Node.js library that drives Chrome and Chromium through the Chrome DevTools Protocol. From JavaScript it launches a browser, opens pages, clicks and types, intercepts network traffic and renders screenshots or PDFs. Teams run it to scrape pages that only assemble their content after JavaScript executes, and to automate logged-in workflows.

QUIC is an encrypted transport protocol that runs over UDP instead of TCP and carries HTTP/3 traffic, normally on UDP port 443. It combines the transport and TLS 1.3 handshakes into one exchange and multiplexes independent streams without head-of-line blocking. The protocol identifies a connection by an ID rather than by an address and port pair.

Rate limiting is a server-side control that caps how many requests one client may send in a time window. The server counts requests against a key such as an IP address, API token or account, then refuses anything above the ceiling, most often with HTTP 429 and a Retry-After header saying when to come back.

A residential proxy routes requests through an IP address that an internet service provider assigned to a home connection, so traffic appears to come from a consumer household. Lookups return the ISP's ASN and a residential classification. Pools are usually large and rotating, drawn either from real consumer devices or from ISP-registered ranges.

A rotating proxy changes the exit IP address it presents to the target, either on every request or on a timer, without the client changing its configuration. Your code keeps pointing at one host and port; the provider swaps the address behind it, spreading traffic across a pool of many IPs.

Scrapy is an open-source Python framework for large-scale web crawling. Its asynchronous engine keeps many requests in flight at once, while spiders, item pipelines and downloader middlewares keep parsing separate from transport. Proxies plug into the middleware chain, so a crawl can change exit IP addresses without any edit to spider code.

Selenium is a browser automation framework that drives real browsers through the W3C WebDriver protocol. It has official bindings for Java, Python, C#, Ruby and JavaScript, and Selenium Grid spreads runs across many machines. Long-standing use makes it the default in enterprise QA, though newer libraries handle waiting and proxy credentials with far less code.

SEO monitoring is the continuous tracking of where a site ranks in search engines for a defined set of queries, broken down by country, city, language and device. Because search results are localised and often personalised, rank trackers run each query from an IP address in the target market rather than from one office connection.

A SERP is a search engine results page, meaning everything an engine returns for one query. Alongside organic links it can carry ads, a local map pack, People Also Ask, images, video, shopping units and an AI-generated summary. What appears changes with the query, the searcher's location, language and device, so two SERPs for the same words are rarely identical.

In proxy usage, a session is a span of requests that all exit through the same IP address. It begins when you open a connection or claim a session identifier, and it ends when that identifier's timer expires or the network reassigns the address underneath you. Session control is what separates rotating traffic from a continuous identity.

A shared proxy carries traffic from several customers through the same exit IP or the same pool of addresses. Sharing spreads the cost of the underlying line across users, which is why shared plans price lower per gigabyte. What you give up is control, since another customer's activity shapes the reputation of the address you send through.

A SIM card is the smartcard that stores a mobile subscriber's identity and the secret key a carrier uses to authenticate a device onto its network. In mobile proxy hardware, the SIM inside each modem determines the operator, the country and the address pool that endpoint's traffic leaves from.

A service level agreement is the contract text that states measurable service targets and what the provider owes when it misses them. It names the indicator, the target value, the measurement window and the remedy, normally service credits. A percentage published without a measurement method or a credit schedule is a marketing claim rather than a commitment.

Sneaker botting is the use of automated software to buy limited-release footwear the moment it goes on sale, faster than any person can check out. Bots poll product endpoints and fire prepared checkout requests from many accounts and IP addresses at once, using stored payment and address profiles. Retailers treat it as a terms-of-service violation and build defences against it.

SOCKS4 is the earlier version of the SOCKS proxy protocol. It relays TCP connections only and addresses targets by raw IPv4 address, with no authentication beyond a user ID string the proxy may ignore. The SOCKS4a extension adds hostname support. SOCKS5 superseded it, and current clients keep SOCKS4 only for legacy endpoints.

SOCKS5 is a session-layer proxy protocol, defined in RFC 1928, that relays TCP connections and can relay UDP datagrams for any application rather than only web traffic. It negotiates an authentication method first, then takes a target given as an IPv4 address, an IPv6 address or a domain name and forwards bytes without interpreting them.

SSL and TLS are the protocols that encrypt and authenticate traffic between a client and a server. SSL is the deprecated original; TLS is what runs today, with TLS 1.2 and TLS 1.3 the only versions current software should negotiate. The handshake proves the server's identity with a certificate, then agrees the keys used for the session.

A static proxy keeps the same exit IP address for the life of the rental, so every request through it reaches the target from one identity. Providers sell static datacenter, static residential (ISP) and static mobile lines. Stability is both the benefit and the exposure, since a single flagged action attaches to an address you keep using.

Stealth mode is the collection of patches and habits that keep an automated browser from announcing that it is automated. It removes the flags automation frameworks leave behind and repairs the values a controlled browser reports differently, while pacing actions at something closer to human speed. It hides the tooling and does nothing for anonymity.

A sticky session is a proxy configuration that pins your traffic to one exit IP for a fixed window instead of rotating on every request. You request it through a session identifier in the username or through a dedicated port, and the gateway routes each matching request back to the same node until the timer runs out.

Success rate is the share of requests through a proxy that return the content you asked for. Teams count clean 2xx responses carrying real page data as successes, and treat blocks, CAPTCHA pages, timeouts and connection resets as failures, including the ones that arrive with a 200 status. The figure varies enormously by destination, so one global number says little.

Throttling is a deliberate slowdown applied to traffic a server treats as excessive or low priority. Rather than refusing the request, the system queues it or caps the bandwidth it gets, so the client sees rising latency instead of an error. APIs, origin servers and anti-bot systems all use it, and mobile carriers apply it past a data cap.

A TLS fingerprint is an identifier derived from the ClientHello a client sends when it opens an HTTPS connection: the TLS version offered, the ordered cipher suite list, the extension list, supported elliptic curves and signature algorithms. JA3 and JA4 are the common encodings of it. Different HTTP clients and browsers produce visibly different values.

A transparent proxy intercepts traffic without any client configuration and passes the client's real IP to the destination, usually in an X-Forwarded-For header alongside Via. ISPs, schools and corporate networks deploy them for caching and content filtering. They give the user no privacy and are visible to any server that reads headers.

Uptime is the share of a measured period during which a service is reachable and answering correctly, written as a percentage such as 99.9%. Providers report it monthly or quarterly from their own probes. The complement, downtime, is easier to reason about, since 95% uptime allows roughly 36 hours of outage across a 30-day month.

A user agent is the string a browser sends in the User-Agent request header to identify itself: browser, version, rendering engine and platform. Servers use it to select content and to sort traffic. Anyone can set it to anything, so detection systems treat it as a claim to be checked against every other signal.

Username authentication identifies a proxy client with a username and password rather than by its IP address. HTTP proxies carry the credential in a Proxy-Authorization header, and SOCKS5 negotiates it during the handshake. Most providers also encode routing instructions - country, session identifier, rotation behaviour - inside the username string, so one endpoint can serve many configurations.

A web application firewall inspects HTTP requests and responses at the application layer and blocks those matching rules for attacks such as SQL injection, cross-site scripting and path traversal. It runs in front of the application as a reverse proxy, a server module or a cloud service, and most deployments add IP reputation feeds and rate-based rules alongside signature matching.

Web scraping is the automated collection of data from websites. A program requests pages over HTTP, extracts fields from the HTML or JSON that comes back, and writes them as structured records. Scale ranges from one script polling a page to distributed crawlers that rotate proxies and render pages in a browser.

A WebGL fingerprint is an identifier derived from how a browser's GPU and graphics driver render 3D content. Sites read the renderer and vendor strings the driver reports, then hash the pixels of a small scene drawn off-screen. Capability limits from the context add more. The result stays stable across sessions and changes only when the hardware or driver does.

A WebRTC leak is a browser exposing your real IP address through its peer-to-peer connection API while page traffic goes through a proxy. WebRTC gathers ICE candidates over its own UDP sockets, which ignore the browser's proxy configuration, and any script on the page can read those candidates without asking permission.

A whitelist is an explicit list of IP addresses, ranges or identities that a system allows, with everything else denied by default. Firewalls, admin panels, API gateways, database hosts and proxy providers all use them. On the proxy side, whitelisting your server's public IP lets it connect without sending a username and password.