What Routes Traffic Through a Satellite Constellation

An IP address shows up in a fraud review queue. It resolves to a residential-sounding ASN, geolocates to a rural county, and behaves like a normal home connection right up until someone checks the round-trip time. It’s pinging back at 45 milliseconds when everything else on that subnet is doing 12. Nobody moved a cable. The traffic is coming down from orbit.

Satellite internet has gone from a niche option for people who couldn’t get cable to a real slice of the residential IP pool, and that shift has quietly changed what “looks like a normal user” means to anyone running fraud detection, geofencing, or bot mitigation. Understanding how a packet actually gets from a satellite constellation to a website explains both why satellite traffic behaves strangely and why it’s not as anonymous as it looks.

Two very different kinds of satellite

“Satellite internet” covers two architectures that behave nothing alike on the wire.

Geostationary (GEO) satellites sit in a fixed orbit about 35,786 kilometers above the equator, matching Earth’s rotation so they appear stationary from the ground. Older satellite ISPs like the legacy HughesNet and Viasat services run on GEO birds. The advantage is coverage: one satellite can blanket a huge footprint with no handoffs needed. The cost is physics. A signal has to travel roughly 71,500 kilometers round trip just to get from the ground to the satellite and back, twice if the destination server is also reached through the same relay. At the speed of light that’s an unavoidable floor of around 500 to 600 milliseconds of round-trip latency before any processing happens. No amount of engineering fixes that; it’s a distance problem.

Low Earth Orbit (LEO) constellations, the kind Starlink and similar networks operate, fly at around 500 to 600 kilometers up. That’s close enough that round-trip latency drops to something closer to conventional broadband, often in the 20 to 40 millisecond range, but a satellite at that altitude only stays in view of a given ground spot for a few minutes before it drops below the horizon. So instead of one satellite per user, LEO systems run constellations of thousands of satellites and hand a user’s connection off from one to the next continuously, sometimes with inter-satellite laser links that pass traffic satellite-to-satellite before it ever touches the ground.

That handoff is the tell. Every time a user terminal switches which satellite it’s talking to, there’s a brief disruption, a small spike in latency or a dropped packet or two. It happens on a cadence tied to orbital mechanics, not to anything the user is doing, and it shows up as a periodic jitter pattern that a plain cable or fiber connection never produces.

From dish to backbone

A satellite terminal, the dish or phased-array antenna at a house or business, doesn’t talk directly to the wider internet. It talks to a satellite, which either relays the signal to a ground station (a “gateway”) within view, or bounces it satellite-to-satellite until it reaches one. The ground station is where the satellite network hands traffic off to terrestrial fiber and into the normal internet backbone.

This matters because the ground station, not the user’s house, is usually the point that determines the public IP address and the routing path. A user’s physical location and the ground station serving their traffic aren’t always in the same place. Depending on network load and which gateways are online, a household in one state can find its traffic exiting through a gateway hundreds of kilometers away. IP geolocation databases, which mostly infer location from where an address is registered and where similar addresses have historically been seen, often end up pointing at the gateway’s city rather than the subscriber’s actual one.

Why the exit IP doesn’t look residential

Satellite ISPs are short on IPv4 space the same way every ISP is, and they typically serve a geographically enormous, sparse customer base through a comparatively small number of gateways. The practical result is aggressive carrier-grade NAT: hundreds or thousands of subscriber connections sharing a handful of public IP addresses at any given ground station. From the outside, that looks a lot like a datacenter NAT pool rather than a household connection, because in effect it behaves like one.

The autonomous system registration compounds it. Satellite operators run their own ASNs, separate from the terrestrial cable and DSL providers in the same region. IP reputation and fraud-scoring services maintain databases that map ASNs to connection types, and satellite ASNs are increasingly their own labeled category rather than folded into “residential.” A platform doing basic IP intelligence doesn’t need to guess that a connection is satellite-based. It’s often just a lookup.

How platforms actually catch it

None of this requires anything exotic on the defensive side. It’s mostly signals that were already being collected for other reasons, read together.

ASN and IP range lookups are the first pass. Fraud and bot-mitigation vendors maintain lists of known satellite operator ranges the same way they track hosting providers and VPN exits, and traffic from those ranges gets scored differently by default.

Latency fingerprinting is the second layer, and it’s harder to spoof because it’s a physical property of the connection, not something set in a header. A TCP handshake or a WebSocket ping-pong reveals round-trip time, and GEO satellite latency in particular is distinctive enough that it’s hard to mistake for anything else. LEO latency is closer to normal broadband, but the periodic jitter from satellite handoffs is a pattern that shows up over the course of a session in a way single-request checks miss.

Geolocation mismatch is the third. When the IP’s registered location, the timezone implied by browser and system settings, payment method billing address, and behavioral signals like language and currency don’t line up, that inconsistency itself is a scoring input, regardless of whether the cause is a satellite gateway, a VPN, or something else entirely. Satellite connections produce this kind of mismatch naturally, as a side effect of how gateways are assigned, which means legitimate satellite subscribers occasionally get caught in filters meant for something else.

None of these checks are individually conclusive, and platforms that lean too hard on any one of them end up blocking real customers on rural satellite broadband along with anything else. That’s part of why detection in this space is usually layered and probabilistic rather than a single hard rule; a satellite ASN plus a latency signature plus a geolocation mismatch is a much stronger signal than any one of those alone.

Why this matters to the proxy underground

Shared, NAT’d, geographically ambiguous IPs sitting on residential-labeled infrastructure are exactly what makes an IP address useful for evading detection, which is why satellite ranges have drawn attention from operators running proxy networks and multi-accounting infrastructure, not just legitimate rural subscribers. The appeal is obvious on paper: an IP that isn’t a flagged datacenter block, sitting behind carrier-grade NAT alongside a lot of other traffic, with a residential-sounding backstory.

The problem for anyone trying to use that as cover is that satellite traffic’s fingerprints are structural, not cosmetic. The latency signature comes from orbital mechanics. The ASN comes from a registration the operator controls, not the person routing traffic through it. The gateway-based geolocation mismatch happens whether or not anyone’s trying to hide anything. Detection systems that already watch for these properties in ordinary satellite subscribers pick up the same properties in anything routed the same way, which is part of why satellite-based proxy traffic tends to get scored as higher risk rather than lower, even when the IP itself has a clean history. It’s a good illustration of a pattern that shows up constantly in this space: infrastructure built for one purpose gets repurposed for cover, and the same physical properties that make it work for its original purpose are what give it away.

The Hidden Internet covers this kind of infrastructure regularly, tracing how traffic actually moves and how the platforms on the other end tell one kind of connection from another. Explore more breakdowns like this one.

Get new guides and videos first — join the Telegram channel.