Why am I getting CAPTCHAs even with a good proxy
If you are seeing challenges on residential IPs, the IP is probably not what triggered them. Modern anti-bot systems score several signals, and the address is only one.
What else is being scored
Browser fingerprint. Canvas and WebGL rendering, installed fonts, screen dimensions, timezone, language. Headless browsers have distinctive defaults that are trivial to detect unless they are explicitly patched.
Request pattern. Perfectly even timing, no mouse movement, pages fetched in strict order, no assets loaded — none of that looks like a person.
Header consistency. A Chrome User-Agent with header order from a Python library is an immediate mismatch.
TLS fingerprint. The exact cipher suites and extensions your client offers identify the library, regardless of what headers you set.
Consistency across signals. A German IP with an Accept-Language of en-US and a New York timezone is three answers to the same question that disagree.
What to change, in order
- Slow down and add jitter.
- Make headers match the browser you are claiming to be, including order.
- Align timezone and locale with the exit country.
- If you are using a headless browser, patch its automation markers.
- Only then change proxy type — mobile and residential carry more trust than datacenter.
If it persists
Some targets challenge everything on first visit and settle once a session is established. A sticky session that solves one challenge and reuses the resulting cookie is often more efficient than rotating into a fresh challenge every request.
Related: Captcha avoidance.