Geo-targeting sets one signal in six, and the other five still say US laptop

The useful part of the roamproxy write-up is the currency mess, because it is the only part of this failure that leaves something you can grep ^[1]. According to the post, a large storefront picks which shop to serve from some mix of IP geolocation, Accept-Language and any locale cookie you are carrying, and different endpoints resolve it differently: search on the IP, product page on the cookie, cart on the account ^[6]. Three currencies in one output file is therefore a transcript of which signal each handler believed ^[6]. Normalise it in post-processing and you have deleted your only free detector.

Then the count. The post enumerates six things a target can read off a single request arriving on a German residential exit: Accept-Language, timezone, locale-derived formatting, the storefront you get served, where your DNS query came from, and a resumed TLS session ticket ^{[3][4][5][6][7][8]}. The `country-de` flag in the proxy username sets exactly one of them ^[2]. Five to one is the whole argument ^[11].

The sharpest of the five is not exotic. Playwright's default Accept-Language is `en-US,en;q=0.9` ^[3], which is character for character the value the author's own profile table assigns to the `us` exit ^[10][12]. `requests` and `httpx` send the header not at all ^[3]. A real German Chrome sends four tags with descending q-values ^[3]. The German exit does not make the client German; the client keeps announcing its own country underneath a network layer that claims another.

Two of the six come with the author's own caveats, and they are worth keeping. The DNS split, where `socks5://` resolves locally so a CDN sees a query from California and a connection from Frankfurt, is described as something most sites do not act on; the harm is landing on the wrong edge, with a different A/B bucket and a different cache ^[7]. A TLS ticket issued to an IP in Ohio and resumed from Frankfurt is called a small oddity, visible at the handshake before any HTTP ^[8]. Neither of those blocks you. They corrupt data you have already collected and will misattribute to the target.

The number to handle carefully is the 8%. The soft-failure model around it is coherent: more challenges, fewer cached responses, sticky sessions that expire early, A/B assignment to the control group, and no error anywhere to tell you ^[13]. But the claim that your success rate sits 8% below where it should be, permanently, arrives without a measurement behind it ^[13], and it is the line most likely to get quoted back. Taken at face value it is roughly one request in twelve or thirteen that should have worked and did not ^[14], with nothing in the log to mark it.

The remedy the post offers is a table keyed by exit country holding language, timezone and locale, with nothing else in the codebase permitted to set those three ^[10]. It is cheap. The reason it goes undone is that IP reputation has a vendor attached and header coherence does not: rotation is a purchase, and a profile table is a refactor of code you already shipped ^[9].