HUMAN Bot Defender and Mobile Carrier IPs

HUMAN Security is the company formed when White Ops merged with PerimeterX, and its Bot Defender product is what most scraper builders still call PerimeterX. You recognize it by the press-and-hold button that asks you to hold until a bar fills. Behind that button is a system that watches how a browser behaves over a whole session, backed by a threat intelligence operation that grew out of ad fraud investigations. Here is what it is publicly known to evaluate, where a dedicated NeonProxies line helps honest jobs, and where it cannot.

A company built on catching fake humans

HUMAN's background matters for understanding its detection. The White Ops side spent years investigating large ad fraud botnets, where fake traffic is designed to look like real people watching real ads, and publishing takedowns with law enforcement. That work taught the company to judge traffic by whether it behaves like a person, because the addresses in those botnets were often real residential devices that had been compromised. It is a direct reminder that a clean-looking IP proves little on its own.

Bot Defender carries that thinking into websites. A sensor script collects hundreds of client signals, the results travel in cookies like _px3 and _pxvid, and the backend scores the session using models trained on traffic across HUMAN's customer base. Site owners set policies per route, such as a stricter stance on login and checkout than on product listings.

What the press-and-hold check is really measuring

The Human Challenge looks trivial because the task is trivial for people. The value is in what the sensor observes while you do it: how the pointer arrives at the button, the pressure and timing of the hold, the device characteristics reported during the interaction and whether they match the rest of the session. That is why scripted attempts to hold the button tend to fail even when the timing is right. For a legitimate automation job, the practical conclusion is simple: the challenge is a point where a human should take over or the job should stop.

Where carrier IPs fit, and where they do not

HUMAN does account for network signals. Hosting provider ranges, known proxy exits and addresses tied to recent attacks against its customers push a session toward suspicion. A NeonProxies line exits through AT&T, T-Mobile or Verizon, where carrier-grade NAT puts many real phones behind each address, and it is dedicated to you, so you inherit no one else's recent activity. For research jobs that were flagged simply because they ran from a VM, that alone can make results consistent.

Because HUMAN's heritage is spotting fraud that comes from real residential and mobile devices, the address carries less weight here than on simpler systems. The session's behavior and client integrity decide the result. A mobile IP will not rescue a headless browser that exposes automation flags or a crawler that never pauses.

Working patterns for legitimate automation

Treat HUMAN-protected routes as places for low, steady, human-scale activity. Monitoring your brand's listings on a retailer, checking a handful of competitor prices each morning, or verifying that your own content renders correctly on a partner site all fit that shape. Run a normal browser with a persistent profile per line, allow the sensor to load, keep each session on one sticky address, and stop on the first challenge instead of retrying. If your team operates a HUMAN deployment, use a carrier line from the metros your customers live in to confirm your policies do not challenge ordinary phone users before you tighten them.

Keep the audit trail simple: record the line, exit IP, route, time and outcome for every session. When a site owner or your own security team asks what your automation did, a log like that answers the question in minutes, and it also shows you quickly whether a change in results came from your code, from the target's policy or from the network.

Setting up a HUMAN Security proxy on NeonProxies

1. Pick a line on the carrier and metro that match the audience you want to observe.
2. Create one persistent browser profile per line and set the proxy inside that profile.
3. Visit the protected site manually once to establish normal cookies and confirm rendering.
4. Schedule the job at a pace a person could plausibly keep.
5. Detect the press-and-hold page and send it to a human rather than scripting it.
6. Rotate the line only between finished sessions, never in the middle of one.

HUMAN Security proxy questions