Netflix's April 2024 ASN block wave hit residential proxies hardest, but datacenter ranges weren't spared. The new heuristics appear to combine:
- IP velocity scoring (too many accounts per /24)
- TCP fingerprinting against known VPS host kernel builds
- SNI + TLS fingerprint timing analysis
I've seen reports that HostHatch's latest acquisition (AS3987xx, formerly a WISP block) still works, but that won't last once IRR catches up. The real play is finding ASNs with legitimate residential history, valid RPKI, and no BGP communities marking them as hosting/transit.
Before anyone asks: no, I won't post working subnets publicly. Last time that happened the provider got burned in 72 hours.