Skip to content

CONCEPT Cited by 1 source

IP rotation as evasion

Definition

IP rotation in the evasion sense is the practice of spreading automated-client requests across many source IPs — residential proxies, VPN exit nodes, cloud-egress pools, scraping-proxy networks — so that no single IP accumulates enough request volume to trigger origin-side rate limits or reputation-based blocks.

Distinct from legitimate IP rotation: many cooperative crawlers also source from many IPs, but publish the full set in advance. Evasion-style IP rotation is defined by the IPs being:

  • Outside the operator's published / documented range.
  • Drawn from pools (residential, VPN) whose purpose is to hide operator attribution.
  • Rotated in response to enforcement rather than balanced for capacity.

Canonical instance

Perplexity AI's stealth crawler (Cloudflare, 2025-08-04): "This undeclared crawler utilized multiple IPs not listed in Perplexity's official IP range, and would rotate through these IPs in response to the restrictive robots.txt policy and block from Cloudflare." The "in response to the block" qualifier is the signature — rotation as reactive evasion, not steady-state distribution. See patterns/stealth-on-block-fallback.

Why IP blocks alone don't scale

  • Pool size of commercial scraping-proxy networks is measured in millions of IPs.
  • TTL on any given IP-to-operator binding is short — a residential IP is one operator's crawler today, someone else's Netflix session tomorrow.
  • Collateral damage — blocking an IP can block legitimate users sharing it (CGNAT, coffee-shop Wi-Fi).

Which is why Cloudflare's structural answer is to fingerprint the request shape, not the source IP — see ML bot fingerprinting.

Seen in

Last updated · 200 distilled / 1,178 read