Carrier-Targeted Mobile Proxies: Picking a Specific Network

A website cannot see a SIM card, a phone model or a tariff. What it sees is a public IP address, and that address belongs to a block announced to the internet by an autonomous system, identified by an ASN. Mobile operators announce their subscriber address space from their own ASNs. In the United States, for example, AT&T Mobility is AS20057, Verizon Wireless (registered as Cellco Partnership) is AS6167, and T-Mobile USA is AS21928.

So when a vendor offers "carrier: T-Mobile US", what you are really buying is an exit IP whose address falls inside the space that carrier announces. Everything a site or an IP intelligence service can infer about the carrier comes from that mapping, plus the connection-type label those services attach to the range. That is why what a datacenter ASN is matters to mobile buyers too: the ASN is the whole identity.

Two consequences follow. First, anything that is not visible in the IP (the specific MVNO brand, the phone plan, whether the SIM is a data-only IoT line) cannot be selected by carrier targeting and usually cannot be seen by the site either. Second, anything the carrier does inside its own network before traffic reaches the internet, such as content filtering or header enrichment, applies to real modems on that network and not to anything else.

These are the situations where two mobile IPs in the same country give you different answers depending on the network.

The common thread: the carrier is part of the thing being tested. If the carrier is only a proxy for "looks like a phone user", you are paying for precision you do not use. The ad verification guide covers the wider ad-checking workflow that carrier filters plug into.

Most mobile proxy traffic does not need a named carrier. Public data collection, price monitoring, search results and social media research generally depend on the country, sometimes the city, and the fact that the IP is cellular. Sites that give mobile ranges more tolerance do so because carrier-grade NAT puts many real subscribers behind one address, which is true of every major network. CGNAT and proxies explains that effect.

There are anecdotes in every buyer forum about one carrier "working better" on a particular target. They may be true for a week on one site, but they are not a stable basis for a purchase. If you believe it for your target, measure success rate per carrier on a few thousand requests before committing, and re-check monthly.

And a harder question: do you need mobile at all? Plenty of jobs sold as mobile work are fine on cheaper exits. Datacenter vs mobile proxies goes through where each one wins. For public pages that do not block hosting ranges, a flat datacenter plan (SparkProxy starts at $75 a month for 100 threads with unlimited bandwidth) is usually far cheaper at volume than mobile traffic billed per gigabyte. For anything that specifically needs a carrier, it is the wrong product, and we would rather say so.

Carrier targeting is sold in three different shapes, and they behave differently under load.

1. Filtered rotating pools

The vendor runs or resells a large pool of mobile exits and lets you add a carrier (and sometimes an ASN) to your connection parameters, usually as a field in the proxy username. Bright Data's mobile page lists targeting by "country, city, ZIP Code, carrier, & ASN", and SOAX advertises the ability to "Target by region, city, or ASN" on its mobile proxies (both as of September 2026). You pay per gigabyte, and every request or session can land on a different device on that network.

Good for: ad verification and offer checks across many carriers and countries. Weak at: reproducible performance tests, because you never know which device or cell you are on.

2. Dedicated modem ports on a named network

A vendor with a physical farm sells you a port: one modem and SIM on one carrier in one place, usually priced monthly with unlimited or large traffic allowances. You rotate the IP by reconnecting the modem, and the carrier never changes. The trade-offs between dedicated and shared mobile access are covered in dedicated vs shared mobile proxies.

Good for: app QA, throttling and filter tests, anything needing the same network path day after day. Weak at: coverage. Each additional carrier or country is another port.

3. Carrier as a label on a country pool

Some smaller vendors show a carrier name in the dashboard but do not let you choose it, or let you choose it but fall back silently to any network when that carrier has no free exits. Neither is necessarily dishonest, but both break a carrier-specific test without warning. Ask directly what happens when the requested carrier has no available exit: an error, a wait, or a different network.

Carrier labels look exact. Several things make them less so.

MVNOs usually share their host network's ranges. Mobile virtual network operators rent capacity from a host operator. In most cases their subscribers' traffic leaves through the host's gateways and IP space, so the public IP looks like the host carrier. If your task is "see what a subscriber of budget brand X sees", no IP-based targeting can separate that brand from its host, and most sites cannot either. Where a site does distinguish them, it is using signals other than the IP, such as a logged-in account.

Carrier ASNs can include fixed wireless home internet. Operators that sell 5G or LTE home internet often serve those customers from the same or neighbouring address space as phones. An exit IP from a carrier ASN is therefore not proof of a phone user, and some IP intelligence services label parts of these ranges differently. If a target treats home internet and mobile differently, check the connection-type label on your exits, not just the ASN.

Mergers and brand changes leave multiple ASNs. Large operators often hold several ASNs from acquisitions, regional networks or enterprise services. A vendor filter keyed to one ASN may miss some of a carrier's consumer ranges, and a filter keyed to a brand name may include business or IoT ranges you did not want.

Geolocation is coarse on mobile. Carriers anchor traffic in a small number of gateway sites, so geolocation databases often place mobile IPs in a few large cities regardless of where the modem is. Combining a carrier filter with a city filter narrows the pool a lot and may not change what the site sees. The 4G and 5G mobile proxies explainer goes into how gateways assign addresses.

Every filter you add shrinks the set of exits you rotate through. Country to carrier is often a large cut, especially outside the biggest markets, and carrier plus city can leave only a handful of devices.

That matters for two reasons. First, reuse: with fewer exits, the same public IPs come back more often, and a target that rate-limits per IP will see it. Second, latency and availability: vendors route your request to whichever matching device is free, and a thin pool means waiting or falling back.

A simple way to size this before you buy is to sample. Send a few hundred requests through the filtered endpoint over an hour and count distinct IPs. Illustrative numbers only: if 500 requests return 450 distinct IPs, the pool is deep enough for rotation-heavy work. If they return 40, plan for per-IP pacing, or widen the filter to the country and add the carrier only for the jobs that need it.

A practical split many teams land on: run the bulk of mobile traffic at country level, and send only the carrier-dependent checks (the ad or offer being verified) through carrier filters. Per-gigabyte billing makes that split directly visible on the invoice.

Do not trust the filter. Log the ASN of every exit and compare it with the carrier you asked for. The script below sends requests through a proxy, looks up each exit on ipinfo.io's free lite endpoint, and tallies what came back. Swap in your vendor's host, port and carrier username syntax.

import collections
import requests

PROXY = "http://USERNAME-carrier-EXAMPLE:PASSWORD@mobile.vendor-host.example:PORT"
EXPECTED_ASNS = {"AS21928"}   # the carrier you paid for, e.g. T-Mobile USA
TOKEN = "YOUR_IPINFO_TOKEN"

seen = collections.Counter()
ips = set()
wrong = []

for i in range(50):
    ip = requests.get("https://api.ipify.org", proxies={"http": PROXY, "https": PROXY}, timeout=30).text
    info = requests.get(f"https://api.ipinfo.io/lite/{ip}?token={TOKEN}", timeout=10).json()
    ips.add(ip)
    asn = info.get("asn", "unknown")
    seen[(asn, info.get("as_name", ""))] += 1
    if asn not in EXPECTED_ASNS:
        wrong.append((ip, asn))

for (asn, name), n in seen.most_common():
    print(f"{n:3}  {asn:10} {name}")
print(f"{len(ips)} distinct IPs, {len(seen)} distinct ASNs, {len(wrong)} requests outside the expected carrier")

What the output tells you:

• All requests in the expected ASN: the filter works. Now check how many distinct IPs you saw.
• A few requests on another mobile carrier: the vendor falls back when the pool is thin. Ask whether that can be disabled.
• Any hosting ASN: the "mobile" exit is not on a cellular network at all. Stop and raise it with the vendor.

Before running a carrier-dependent test, also look up the exit on a second IP intelligence source and record the connection-type label. Two sources agreeing on "mobile" and the right operator is the evidence you want in a verification report.

1. Write down which job needs the carrier. If none, buy country-level mobile or a cheaper type.
2. Ask for the list of carriers per country, and whether each is available right now, not in principle.
3. Ask how the filter is keyed: brand name, one ASN, or all ASNs of that operator.
4. Ask what happens when the carrier pool is empty: error, queue, or silent fallback.
5. Check MVNO expectations. If the brand you care about is an MVNO, accept that you are testing its host network.
6. Sample depth and ASN correctness with a script like the one above during the trial, at the local peak hour.
7. For performance or filter tests, buy a dedicated port on the carrier instead of a filtered pool.
8. Compare vendors on verified exits, not on the length of the carrier dropdown. Best mobile proxy providers covers the vendor landscape.