what detects you on ip-api.com

ip-api.com returns proxy/hosting booleans for the EGRESS IP. it scores the PROXY layer (the IP the proxy presents), not the browser it rode. human/pass = the IP is NOT flagged as a proxy (looks residential/clean); a flagged IP fails. `hosting:true` (datacenter) is a softer tell, tighten to also fail on it once calibrated. The `?fields=` param MUST include proxy+hosting (off by default). CONFIRMED (KAN-432, verified live 2026-07-29): the untokened endpoint returns `{"status":"success","countryCode":"US","org":"","as":"AS2728 Gigsouth, LLC","mobile":false,"proxy":false,"hosting":false,"query":"…"}`, the `proxy` key is PRESENT on every response, so `notContains "\"proxy\":true"` is a real two-sided test rather than an assertion about a field that never ships (contrast `ipinfo`, whose `hosting` key does not exist without a token). The ledger agrees it discriminates: 450/570 pass, i.e. 120 recorded failures, so the rule has actually flipped in production. Flipped to confirmed because `scored: true` now REQUIRES it (see the schema gate); had the shape not verified, the honest move would have been to drop `scored`. SIGNALS (WP3.10, verified live 2026-07-24): the endpoint returns flat JSON as the document body, so `read: json` with no selector parses body text directly. These measure the PROXY axis, not the browser, proxy/hosting/mobile + ASN/org are how we answer whether a residential pool is actually residential from measured data instead of a vendor claim.