Accounts are banned not because you are using a proxy — platforms are well aware that part of the traffic goes through them. A ban occurs when the IP address does not match a dozen other parameters: time zone, system language, browser fingerprint, mouse behavior. We analyze all the technical signs by which Facebook Ads, TikTok Ads, and Instagram detect substitution — and what to do about it in practice.
Why the platform sees a proxy, even if the IP is "clean"
Many arbitrageurs believe that the main thing is to buy a "clean" IP that is not listed in blacklists. In practice, anti-fraud systems of Facebook, TikTok, and Google hardly look at the reputation of an individual address — they build a digital fingerprint from 30-50 parameters of the browser, system, and network stack, and compare them for consistency. If the IP says "Germany," but the system's time zone is "Moscow," the system detects an anomaly and increases the risk score. One anomaly rarely leads to a ban, but three or four at the same time almost certainly sends the account for verification or blocking.
It is important to understand: proxy detection is not "detecting the proxy server as such." The platform cannot technically prove 100% that you are using a proxy. It works with probabilities: the more inconsistencies in the fingerprint, the higher the risk assessment. Therefore, the task is not to "hide the proxy," but to eliminate all signs that reveal the substitution of location and environment.
DNS leaks and WebRTC — the main reason for revealing the real IP
The most common technical mistake made by beginners is leaking through WebRTC. This is a browser technology for video calls and peer-to-peer connections, and it requests the real IP address of the system directly, bypassing the proxy tunnel. Even if you have set up a SOCKS5 proxy in the settings tab, WebRTC can "punch through" your home or work IP via a STUN request, and the platform will see two different addresses within one session — this is an instant red flag.
The same problem exists with DNS requests: if the browser resolves domains through the system's DNS provider instead of through the proxy server's DNS, the logs of the platform may record the geo-tag of your real provider. The solution is to use an anti-detect browser with forced DNS through the proxy and built-in blocking of WebRTC leaks. In Dolphin Anty, AdsPower, and Octo Browser, this is done in the profile settings: you need to enable the "Protect against WebRTC leaks" option or a similar one, and check the result on specialized leak testing services before starting to work with the account.
Mismatch of time zone, language, and geolocation of the IP
This is one of the easiest parameters to detect, but often overlooked. If the proxy issues an IP from Brazil, while the system settings show a time zone of UTC+3 and the interface language is Russian — for the anti-fraud algorithm, this is a clear signal of substitution. Facebook Ads is particularly sensitive to this parameter when launching ads in a new geolocation: the system checks the IP, browser language (Accept-Language), JavaScript time zone (Intl.DateTimeFormat), and even the keyboard language if it has access to this data.
Good anti-detect browsers automatically adjust the time zone and language to the geo proxy when creating a profile. In AdsPound and GoLogin, this happens automatically when inserting a proxy: the system determines the country by IP and offers to synchronize the time zone. Check this manually before launching — automation sometimes makes mistakes, especially if a proxy with a multi-regional IP pool is used.
TLS/JA3 fingerprint of the connection
A less known but critically important sign is the TLS handshake fingerprint, also known as the JA3 hash. When the browser establishes a secure connection with the server, it transmits a set of supported ciphers, extensions, and protocol versions in a specific order. This set is unique to a specific version of the browser and operating system. The problem is that some cheap proxy solutions or outdated anti-detect browsers substitute the User-Agent for "latest Chrome," but the TLS fingerprint remains from the old version of the library — the platform sees a desynchronization between the declared browser and the real TLS client.
This is one of the signs by which the anti-fraud systems of major platforms detect automated tools and proxy servers with modified traffic, even if other parameters look impeccable. For protection, it is important to use modern versions of anti-detect browsers that synchronize the TLS fingerprint with the declared version of Chrome or Firefox, and not to skimp on the quality of the proxy — cheap data center proxies often proxy traffic through layers that distort the TLS handshake.
HTTP headers and User-Agent
Request headers are the most obvious, yet still a frequent source of errors. A mismatch of the User-Agent with the actual version of the browser engine, absence of standard headers like Accept-Encoding or Sec-CH-UA, non-standard order of headers — all of this forms a fingerprint that is different from regular user traffic. Many automated scripts and cheap multi-accounting solutions use a trimmed set of headers, which immediately marks the traffic as automated.
Quality anti-detect browsers automatically generate a complete and consistent set of headers, mimicking the structure of a real browser on a specific OS. When manually configuring through extensions or scripts, it is important to compare the headers with a reference browser — use built-in developer tools (DevTools → Network) and compare the requests of your profile with the requests of regular Chrome on the same device.
TCP/IP stack fingerprint (TTL, window, ASN)
A deeper level of detection is the analysis of TCP/IP packet parameters: TTL (time to live), receive window size, MSS options. These values differ between operating systems (Windows, Linux, Android) and types of network equipment. If your profile is declared as a Windows browser, but packets come with a TTL characteristic of a Linux server (as is often the case with cheap data center proxies deployed on Ubuntu servers), the anti-fraud system detects a platform mismatch.
A related parameter is ASN (Autonomous System Number), which determines which provider the IP belongs to. Platforms maintain databases of ASNs belonging to hosting providers (AWS, DigitalOcean, OVH) and separately — ASNs of home and mobile providers. If the ASN is marked as "hosting," the risk scoring of the account is automatically higher, even if other parameters are perfect. This is one of the reasons why residential proxies are chosen for sensitive tasks — their ASN belongs to regular internet providers, not data centers.
Canvas, WebGL, and Audio fingerprint
These three browser technologies are used by platforms to build a unique device fingerprint that is not related to the IP address at all. Canvas fingerprint is formed through rendering an invisible image using the GPU — different graphics cards and drivers yield slightly different results at the pixel level. WebGL fingerprint works similarly, but through 3D rendering, while Audio fingerprint analyzes sound processing features through the Web Audio API.
The problem arises when the same Canvas/WebGL fingerprint is repeated across 20 different accounts, supposedly launched from different devices and IPs. The platform instantly links these profiles into one cluster — this is called chain-banning, where blocking one account leads to all associated ones being banned. Anti-detect browsers solve the problem through noise randomization: a small controlled noise is added to Canvas and WebGL rendering at each profile launch, making the fingerprint unique for each profile, but stable between sessions of the same profile.
Behavioral patterns: speed and patterning of actions
A technically flawless browser fingerprint will not save you if the behavior within the platform looks like a bot. Facebook and TikTok analyze the speed of form filling, cursor movement trajectory, pauses between clicks, and page scrolling. If account registration, card linking, and launching the first ad campaign occur in 90 seconds straight without pauses — this is a statistical anomaly characteristic of automation, not a live person.
When manually farming accounts through an anti-detect browser, it is important to imitate natural behavior: take pauses between actions, warm up the account by viewing content before launching ads, and avoid performing identical sequences of actions on all profiles simultaneously. For SMM agencies managing 20-30 client accounts, it is critical to distribute activity over time — do not log into all profiles in one minute from one computer.
IP type: data center, residential, or mobile
The final and one of the most significant signs is the very nature of the IP address. Platforms classify IPs by type: data center, residential (home), or mobile (cellular operator). Data center IPs are cheaper and faster, but inherently carry a higher risk score simply due to their association with hosting infrastructure — regular users do not access Instagram from AWS servers.
Residential IPs belong to real home providers and visually do not differ from regular user traffic — this is the best balance of price and quality for most multi-accounting tasks. Mobile proxies go even further: the IP belongs to a cellular operator and is used by thousands of real subscribers simultaneously through NAT, making IP-based blocking almost meaningless for the platform. Arbitrageurs working with mobile proxies note a significantly lower percentage of blocks, especially during the warming phase of new Facebook Ads and TikTok Ads accounts.
Table: which signs each type of proxy closes
| Type of proxy | ASN reputation | Risk of ban at startup | Best for the task |
|---|---|---|---|
| Data center proxies | Low (hosting ASN) | High | Parsing, price monitoring |
| Residential proxies | High (home provider) | Low | Instagram, SMM, multi-accounting |
| Mobile proxies | Very high (cellular operator) | Minimal | Facebook Ads, TikTok Ads, warming |
Checklist for setting up an anti-detect browser and proxy
Before launching an account in Dolphin Anty, AdsPower, Multilogin, or GoLogin, go through this list — it covers all the listed signs of detection in one go:
- Checked for the absence of WebRTC leak of the real IP through the built-in profile test
- The system time zone is synchronized with the geo proxy (not manually "by eye," but through auto-detection)
- The browser interface language and Accept-Language correspond to the country of the IP
- User-Agent matches the current version of Chrome/Firefox declared in the profile
- Canvas/WebGL/Audio noise is enabled and unique for each profile
- Proxy ASN checked — does not belong to the list of known hosting providers
- The first actions in the new account are spaced out over time, without an immediate series of actions
- For Facebook Ads and TikTok Ads accounts, a stable sticky-IP is used without rotation within one session
Conclusion
Proxy detection is not one check, but a sum of ten to twelve signs: from WebRTC leaks and time zone desynchronization to TLS fingerprints and ASN type. Closing them all manually without tools is practically impossible — that is why the combination of "anti-detect browser plus quality proxy" remains the working standard for arbitrage, SMM agencies, and multi-accounting.
If you are farming Facebook Ads or TikTok Ads accounts, pay attention to mobile proxies — they provide the lowest risk scoring due to their association with cellular operators. For managing multiple Instagram profiles and other social networks, residential proxies are better suited — they balance price, speed, and anonymity without unnecessary signs of substitution.