--- title: "IP reputation for browser automation: 19% vs 0 of 70 runs" description: "IP reputation against profile maturity in 191 reCAPTCHA measurements: what the exit address decided, why aged profiles did not help, and how to test an exit." canonical: "https://scalebrowser.net/blog/ip-reputation" last_modified: "2026-10-29" published: "2026-10-29" author: "davide" category: "proxies" --- > ## Documentation Index > Fetch the complete documentation index at: https://scalebrowser.net/llms.txt > Use this file to discover all available pages before exploring further. # IP reputation for browser automation: 19% vs 0 of 70 runs > IP reputation against profile maturity in 191 reCAPTCHA measurements: what the exit address decided, why aged profiles did not help, and how to test an exit. The usual advice for an automated browser that keeps getting puzzles is to age its profiles: browse for a few days, collect cookies, build a history, then try again. We wanted to know whether that advice still holds, so on 9 September 2026 we put aged and fresh profiles side by side in front of the same check and moved one thing at a time. Profile age moved nothing we could measure. The address the browser came from moved everything. ## What is IP reputation for an automated browser? IP reputation for an automated browser is the trust a website's bot defence gives the address a request arrives from, decided before the page's own code runs. The same term means something narrower in email. Spamhaus, which has published reputation data for over 25 years, defines it as "an assessment of the trustworthiness of an IP", and email filtering is its best-known use: a mail server consults the list to decide whether to accept a message. A bot defence asks a different question: whether a browser session from this address is likely to be a person. The address carries its network type (mobile carrier, home line, datacenter), its history with the defence, and what else is arriving from it at the same moment. None of that sits in the browser, and no setting inside the browser changes it. ## What did 191 measurements show? 191 measurements in 2 runs showed that the exit address decided the outcome and profile maturity did not. The measure was the one the research literature uses for reCAPTCHA v2: after a click on the checkbox, does it turn green at once, or does an image puzzle open? We ran it against Google's own demo page with 8 seconds between runs, because a burst of requests is a signal of its own. | Run | Setup | Measurements | Result | | --- | --- | --- | --- | | 1 | 20 profiles, 5 rounds, each profile on its own bought mobile exit | 100, of which 89 could be judged | mature 22 percent through, fresh 15 percent through, p = 0.60 | | 2 | 13 profiles, 7 rounds, all profiles over one home line | 91, of which 70 could be judged | 0 of 70 through, in both groups | ![Two pairs of bars for the reCAPTCHA v2 checkbox without a puzzle: through bought mobile exits, in blue, mature profiles got through 22 percent of the time and fresh ones 15 percent, 17 of 89 in all; over one home line, both got through 0 of 70.](/blog/ip-reputation/exit-not-maturity.png "Through mobile exits mature profiles passed 22 percent and fresh ones 15 percent of the time, a difference with p = 0.60. Over one home line neither passed once in 70 judged runs.") Across the mobile exits, 17 of 89 judged runs (19 percent) passed without a puzzle. Over the home line, none did, whatever the profile carried. Measurements that could not be judged count in neither direction: a verdict was only written from positive evidence (a green checkbox or an open puzzle), never from the absence of one. The obvious objection is that a measuring run burns its own address, so the later rounds should get worse. They did not. Without a proxy, the first round was already all puzzles and stayed that way for 7 rounds. With the mobile exits, every round had between 2 and 5 passes and no downward trend. Both runs were stable over their whole length. The cohorts were balanced on purpose. A first attempt grouped profiles by age and turned out to group them by persona origin as well, 9 of 10 mature profiles with a European persona and 9 of 10 fresh ones with a US persona, so any difference would have been unattributable. The runs above move maturity alone. ## Why can a mature profile not make up for a bad IP? A mature profile cannot make up for a bad IP because, against reCAPTCHA in September 2026, maturity was not measurable at all: 22 percent against 15 percent through the same kind of exits is a difference that chance explains, p = 0.60. The address separated 19 percent from 0. Of the inputs a site combines into its verdict, and the [automated browser detection](/blog/bot-detection) article lists all four layers, the address is the one the profile cannot reach. Two earlier studies measured the same checkbox and came to different answers, which is why the date matters. | Study | What it varied | What it found | | --- | --- | --- | | Sivakorn, Polakis, Keromytis, Columbia University, Black Hat Asia 2016 | cookie age and network, a departmental network against Tor | a checkbox without a puzzle from the 9th day of a cookie's life, "without requiring any browsing activities and type of network connection" | | Plesner, Vontobel, Wattenhofer, ETH Zurich, 2024 | VPN, mouse movement, history and cookies of a logged-in Google account | from one address, the challenges escalated after the 19th run; with the logged-in account's data, far fewer challenges | | Scalebrowser, 9 September 2026 | profile maturity without an account, mobile exits against one home line | maturity p = 0.60; exits 17 of 89 through (19 percent), home line 0 of 70 | The [2016 paper](https://blackhat.com/docs/asia-16/materials/asia-16-Sivakorn-Im-Not-a-Human-Breaking-the-Google-reCAPTCHA-wp.pdf) found the network irrelevant and the cookie's age decisive. Our result contradicts it on both counts, which suggests that what reCAPTCHA weighs has changed in ten years. The [2024 paper](https://arxiv.org/abs/2409.08831) agrees with us on the address, since rotating it was what kept its bot from escalating, and it found history and cookies to matter. Its history came from a signed-in Google account, while our mature profiles carried ordinary browsing without one, so the two results measure different kinds of maturity. What we measured about maturity itself explains part of the null result. Across 100 real profiles, cookie count, cookie hosts, visited pages, visits, origins and Chromium's own site engagement correlated with each other between 0.80 and 0.99: several readings of one signal. Profile age correlated with none of them above 0.45 and is the only second, independent one. And 31 of the 100 profiles carried nothing at all. The finding has limits. It says maturity is not measurable against reCAPTCHA while the address dominates. It does not say maturity counts nowhere, and the same measurement against Arkose at Microsoft and against Reddit is still open. ### How do timezone and locale follow the exit? Timezone and locale follow the exit in Scalebrowser under its default geo mode: the proxy check places the exit address, and the profile's timezone, language list and Accept-Language header are written from that country as one unit, at creation and at every launch. A clean address does not excuse a clock from another continent: a site compares the two, and the pair either agrees or it does not. The article on [geolocation and timezone checks](/blog/geolocation-spoofing) goes through the five places a location shows and what happens when the exit's country is unknown. ## How can you test an exit's reputation yourself? Test the exit with [the same checkbox](/check/captcha), before a profile ever uses it. One run takes about 15 seconds, costs nothing and, in our series, separated the addresses visibly on every round. Leave at least 8 seconds between runs, as our bench did, count only a green checkbox or an open puzzle, and judge an address over several rounds rather than one. reCAPTCHA v3 is no substitute: on a fresh site key without visitor history it returned a constant 0.9 in 9 of 9 readings, with humanised input, without any mouse movement and from an untouched Chrome, so it separates nothing. The [proxies documentation](/docs/proxies) shows how Scalebrowser checks an exit and holds each address for one profile.