Residential proxies scraping your site? Drain their bandwidth
Sign inGet started
TripwirePricingBlogDocsContactSign in
Residential proxies scraping your site? Drain their bandwidth<br>Layer3 Intel Team·August 23, 2026
Today we're launching bandwidth drain in Tripwire, our proxy detection tool.<br>Most anti-bot tools block suspicious traffic or show it a challenge. A scraper can respond by changing IPs and trying again. The block works, but it does not make the next attempt more expensive.<br>Tripwire's bandwidth drain adds a cost. When Tripwire confirms a residential proxy connection, it sends up to 10MB through that connection. Residential proxy providers charge their customers for those bytes.<br>Residential proxies charge by the gigabyte<br>Proxy customers can rotate through a large supply of residential IPs. Layer3 Intel sees 70–80 million live IPs at any point in time, and even the seizure of a 33-million-IP network had little effect on the wider pool.<br>Bandwidth is harder to avoid because major providers bill by the gigabyte. Bright Data lists $4.00/GB pay-as-you-go, dropping to $2.50/GB at a 798GB commitment. Oxylabs lists $6/GB at entry and $2.50/GB at a terabyte a month. Changing IPs does not change those rates.<br>The cost of a drain<br>Assume each page transfers 100KB. Adding a full 10MB drain makes each request use about 100 times more bandwidth. Here is the cost of one million requests at current list prices:<br>Residential ratePlan1M pages1M pages, drained$2.50 / GB1 TB monthly commit$250$25,250$4.00 / GBPay as you go$400$40,400$6.00 / GBEntry tier$600$60,600<br>Assumes a 100KB page and a full 10MB drain on every request. Most drains stop short of the cap, so actual costs will be lower.<br>Rotating to another IP does not help: Tripwire checks the new connection too. Ending the connection early reduces the drain, but the proxy provider still bills for bytes already transferred.<br>What happened on our site<br>layer3intel.com was receiving steady scraper traffic through residential proxies. On August 20th , we enabled bandwidthDrain=true in our Tripwire snippet. This is the unedited dashboard result:<br>Aug 17–19: The drain was off.<br>Aug 20: We enabled it and sent about 6 GB through confirmed residential proxies.<br>Aug 21: Tripwire sent another 5.46 GB across 704 sessions.<br>Aug 22: The scraper traffic fell sharply.<br>Aug 23: The scraper traffic stopped.<br>The result<br>The scraping stopped within two days.<br>Tripwire drained 11.6 GB across 1,510 confirmed residential proxy connections. The average was 7.9MB per connection , or about 80 times the assumed 100KB page size. The average fell below the 10MB cap because crawlers often left before the transfer finished.<br>At the rates above, those two days added an estimated $31 to $75 to the operator's bill. The important change is the cost per request, which scales with a larger crawl.<br>Each drain also occupied the connection for an average of 12 seconds . During that time, the residential device had less capacity for other proxy traffic.<br>How Tripwire limits false positives<br>The feature is off by default. It runs only when all three conditions are met:<br>You enable it. Each deployment must opt in.<br>Tripwire detects a forwarded connection. Its WebSocket test measures a delay caused by the additional hop created by a forwarded connection or TCP-terminating middlebox.<br>The IP is a known residential proxy. It must match Layer3 Intel's residential proxy database, which receives more than 500 million unique signals a day.<br>Neither signal is enough on its own to authorize a bandwidth drain. Requiring both limits draining to Tripwire's highest-confidence residential proxy classification and reduces the risk of draining a legitimate visitor.<br>Layer3 Intel serves the drain payload. It does not use your origin or CDN bandwidth.<br>Why it applies only to residential proxies<br>Tripwire can identify ISP proxies and datacenter proxies, but it does not drain them. Those services often use flat-rate or unmetered bandwidth, so sending extra data would cost us without adding much cost for the proxy operator. The feature works because residential proxy bandwidth is metered.<br>Turning it on<br>Add one parameter to the Tripwire snippet:<br>Bandwidth drain requires the visitor to execute Tripwire's JavaScript, so its effectiveness depends on how your site serves protected content. For stricter enforcement, you can place a Tripwire interstitial at the edge using a Cloudflare Worker or other middleware and require a successful assessment before serving the requested content.<br>A drained assessment returns its encrypted token after the transfer finishes. If a form waits for that token, run the drain on page load and validate the token already stored for the session. See the bandwidth drain documentation for configuration options and per-call overrides.<br>Pricing<br>Tripwire's free plan includes 100,000 assessments a month. Each eligible assessment can send up to 10MB, for a maximum of one terabyte of drain traffic. Layer3 Intel pays to serve that...