Security
Tripwire makes residential proxy scraping cost more
Layer3 Intel’s Tripwire can send up to 10MB through confirmed residential proxies, adding metered bandwidth costs for scrapers.
Layer3 Intel is adding a way to make residential proxy scraping more expensive: the company says it is launching a bandwidth-drain feature in its Tripwire proxy-detection tool that can send up to 10MB through a connection it has identified as a residential proxy.
The tactic does not block a scraper or force it through a challenge. Instead, it uses the way residential proxy providers bill customers: by the gigabyte. A crawler can rotate through millions of IP addresses, but changing addresses does not avoid the bandwidth charge.
Layer3 Intel estimates that 70 million to 80 million residential IPs are live at any given time. It says even the seizure of a network containing 33 million IPs had little effect on the broader residential proxy pool. Bandwidth, by contrast, is metered by the major providers and is harder for a proxy customer to evade.
How Tripwire’s bandwidth drain works
Tripwire first needs to confirm two signals before it sends the extra data:
- The connection is forwarded through an additional hop or TCP-terminating middlebox, detected by Tripwire’s WebSocket delay test.
- The IP matches Layer3 Intel’s residential proxy database, which receives more than 500 million unique signals per day.
Neither signal is sufficient on its own. The drain is also off by default and must be enabled separately for each deployment. That combination is intended to limit the feature to Tripwire’s highest-confidence residential proxy classifications and reduce the chance of imposing the cost on a legitimate visitor.
Layer3 Intel serves the drain payload itself, rather than using the customer’s origin server or CDN bandwidth. The feature targets residential proxies specifically because those services generally charge for traffic. Tripwire can identify ISP and datacenter proxies too, but it does not drain them because their bandwidth is often flat-rate or unmetered.
The feature requires the visitor to execute Tripwire’s JavaScript. A site can enable it by adding one parameter to the snippet:
''html <script src=“https://cdn.layer3intel.com/tripwire.min.js?key=YOUR_PUBLIC_KEY&bandwidthDrain=true” ></script> ''
For stricter enforcement, Layer3 Intel says operators can put a Tripwire interstitial at the edge using a Cloudflare Worker or other middleware. The site can require a successful assessment before serving the requested content. A drained assessment returns its encrypted token after the transfer completes; sites whose forms depend on that token can start the drain when the page loads and validate the token already stored for the session.
The bandwidth cost for a scraper
Layer3 Intel’s example assumes a 100KB page and a full 10MB drain for every request. That makes each request consume roughly 100 times more bandwidth than the page itself. At the current list prices cited by the company, one million requests would cost a proxy customer:
- $250 for undrained traffic at $2.50 per GB, compared with $25,250 with the drain.
- $400 at $4.00 per GB pay-as-you-go, compared with $40,400 with the drain.
- $600 at $6.00 per GB, compared with $60,600 with the drain.
The $2.50 rate is associated with a 798GB commitment from Bright Data and a one-terabyte monthly plan from Oxylabs, while the $4.00 and $6.00 rates are their cited pay-as-you-go and entry-tier prices. Layer3 Intel notes that most drains stop before the 10MB cap because crawlers often close the connection early, so the actual bill will usually be lower.
Closing a connection or switching to another IP does not eliminate the cost. The proxy provider still bills for bytes already transferred, and Tripwire checks the replacement connection as well. A connection that remains open also has less capacity for other proxy traffic while the drain is running.
A live deployment stopped the traffic
Layer3 Intel tested the feature on its own site after receiving steady scraper traffic through residential proxies. On August 20, 2026, it enabled bandwidthDrain=true in its Tripwire snippet. The dashboard recorded about 6GB sent through confirmed residential proxies that day, followed by another 5.46GB across 704 sessions on August 21.
Traffic fell sharply on August 22 and stopped on August 23. Across those two days, Tripwire drained 11.6GB across 1,510 confirmed residential proxy connections. The average was 7.9MB per connection, or about 80 times the assumed 100KB page size, and the average connection remained active for 12 seconds.
At the cited proxy rates, Layer3 Intel estimates that the test added between $31 and $75 to the operator’s bill. That small total reflects the limited duration of the test; the intended effect is to make the cost scale with a larger crawl rather than to impose a fixed penalty on a single request.
Tripwire’s free plan includes 100,000 assessments per month. Each eligible assessment can send up to 10MB, for a maximum of one terabyte of drain traffic. Layer3 Intel says it pays to serve that traffic, and the transfer does not count against the customer’s own bandwidth allocation.
Bandwidth drain will not stop every scraper, particularly because it depends on JavaScript execution and high-confidence proxy classification. Its narrower promise is economic: a site can opt in with one parameter and make confirmed residential proxy connections consume the metered resource those services sell.