5 Reasons TikTok Ads Accounts Get Banned Even With a Mobile Proxy

You bought a "private mobile proxy with a clean geo," set it up on your iPhone, finished registration, uploaded your first creative — and six hours later the account is gone with no explanation. The proxy is "clean," the IP is "dedicated," and the seller swears it isn't his problem. He's usually right that it isn't a proxy problem per se — it is a problem with five typical mistakes in everything wrapped around the proxy. All of them are closed at the configuration level, no tier upgrade required.

Below — five causes, ordered by how often they kill accounts in TikTok Ads Manager and TikTok Studio.

1. IPv6 Leak — the Quietest and the Most Frequent

Ninety percent of "I have everything set up but they still ban me" complaints come down to IPv6. Most mobile carriers and home ISPs already deliver dual-stack: IPv4 + IPv6 simultaneously. Your mobile proxy runs on IPv4. Your tunnel is built for IPv4. Then the TikTok app, spotting a live IPv6 on the interface, fires a request outside the tunnel through that IPv6 — over the real address of your carrier or Wi-Fi hotspot.

From TikTok's point of view, you are connecting from two addresses simultaneously: the "intended" IPv4 (from the proxy) and the "real" IPv6 (with the geo of your physical uplink). Antifraud puts two and two together and lands the account.

How to check: turn on the tunnel and open ipleak.net or ipv6-test.com in Safari. If the IPv6 field shows any address other than what your tunnel is supposed to deliver, you have a leak.

How to fix:

• In the IKEv2 profile (.mobileconfig) explicitly add an IPv6 section, or disable IPv6 on the Wi-Fi network: Settings → Wi-Fi → (i) → Configure IPv6 → Link-Local Only.
• In Shadowrocket — enable the IPv6 option in the proxy settings and confirm the node supports IPv6, or block IPv6 traffic at the routing-rule level.
• The most reliable path: in the .mobileconfig set ExcludeLocalNetworks=false and add a ::/0 route through the tunnel, or pick a dual-stack node.

After any change, recheck ipleak.net. If IPv6 is empty or shows the same address as the tunnel, you're good.

2. DNS Leak — Your ISP Is Broadcasting Your Geo

The tunnel encrypts the traffic. But DNS queries are a separate packet, and unless your config explicitly says "resolve through my DNS," iOS will fire queries through whatever DNS server was handed out by DHCP on the Wi-Fi you're attached to.

In practice it looks like this: the tunnel hands you a US IP. You're on Wi-Fi in Bucharest — DHCP plugged in an Orange Romania resolver — every lookup for tiktok.com, analytics.tiktok.com, byteoversea.com first goes to Bucharest, and only then the connection itself rides through the tunnel. TikTok sees:

• Client IP — United States,
• DNS resolver — Romania.

That is a proxy/VPN-use marker with near-100% confidence.

How to diagnose: dnsleaktest.com → Extended test. If the results contain resolver IPs or names that don't match your tunnel's geo, you have a leak.

How to fix:

• In the IKEv2 .mobileconfig, under the DNS section, explicitly set ServerAddresses (e.g., 1.1.1.1, 1.0.0.1) and leave SupplementalMatchDomains empty — otherwise only some domains will be resolved through the configured DNS.
• In Shadowrocket: Settings → DNS → Remote DNS = 1.1.1.1, and in the rules switch on DNS over HTTPS to https://cloudflare-dns.com/dns-query.
• Alternative: use the DNS resolver provided by the proxy service if they expose one in the target geo.

3. Geo Mismatch: SIM, IP, and App Store Don't Line Up

TikTok collects more than one signal — it pulls a bouquet:

• The SIM's MCC/MNC,
• The current IP's geo,
• The Apple ID region (via App Store),
• The device's TimeZone,
• Language/Locale,
• And sometimes GPS, if granted.

These are cross-referenced against each other. Any meaningful gap triggers suspicion. The most common case: "iPhone with a Romanian SIM, US IP from the tunnel, App Store on a German account, time zone Moscow." TikTok rarely bans on a single parameter, but composite noise across five signals trips a soft limit — impression capping, moderation rejections without explanation, a ban right after the first balance top-up.

Solution (in order of priority):

1. Pull the SIM physically. No eSIMs with cellular data disabled — CarrierBundle still leaks the carrier. The slot must be empty.
2. Apple ID region = tunnel IP geo. If you run on US — the Apple ID must be US, the App Store must show dollar prices and US apps.
3. TimeZone, Language, Region under Settings → General → Language & Region — all set to the target geo.
4. Keyboard layouts must match too — TikTok harvests the list of installed keyboards.

After each change: Settings → General → Transfer or Reset iPhone → Reset → Reset Network Settings. Without this, old DNS entries and session caches can stick around for days.

4. A Shared "Dirty" IP Sold as "Private"

"Mobile proxy, dedicated, no one else but you" — every word in that phrase can be a lie. The reality of mobile networks: the carrier hands out a public IP to a pool of subscribers via CGNAT. A single 94.X.X.X will see dozens of sessions from different people over the course of a day. If the person who used that IP before you was getting their accounts banned en masse, TikTok already flagged the address as high-risk in its antifraud.

There's an extra layer: some services sell "mobile" proxies that are actually datacenter IPs with a spoofed User-Agent. TikTok sees the ASN — AS16509 Amazon or AS14061 DigitalOcean instead of AS12302 RCS&RDS or AS39737 Vodafone. ASN data is public and resolvable in a second through ipinfo.io.

Solution:

• Before paying — ask the seller for a test IP and run it through ipinfo.io, scamalytics.com, ipqualityscore.com. The ASN must belong to a mobile carrier, not a datacenter. Fraud score under 25 is normal, over 50 means the IP has been burned.
• Take IPs bound to a specific modem/SIM (LTE farms), not "mobile residential" from a shared pool. The price is higher, but the address has no history.
• For critical accounts — a dedicated IP for one person, no sharing, with the ability to see the modem iface (Quectel, Sierra, Fibocom) in the provider's docs.

5. The IP Outlives the Account — Forgotten Rotation

The scenario: you hold the same mobile IP for weeks, cycling three, five, ten ad accounts through it. They seem to live, then they start dropping in batches — simultaneously, within an hour. Not a coincidence. TikTok links accounts by long-lived IPs: if an address shows up in three different Ads accounts within 30 days, antifraud welds them into a single graph. Ban one, ban the cluster.

A mobile IP "lives long" in the sense of physical stability (the modem holds a session for weeks) — but that is a negative, not a positive. Antifraud wants exactly that kind of stable anchor to draw edges between accounts.

Solution:

• One IP = one account (or one bundle of 1–3 accounts if they were planned as a family from the start). Never attach a new account to an IP after an old one has already worked through it.
• Rotate IPs per profile. Before registering a new account, hit reset IP on your mobile proxy — the modem flips sessions, the carrier assigns a new address from its pool. With ProxyGrow this happens with a single URL: both the IKEv2 config and the VLESS link run over the same mobile IP, and that IP can be swapped on demand at any moment — no "cooldown," no timers. New account — hit reset, get a fresh IP, keep going.
• Binding log. Keep a simple registry (Notion, Sheets): IP → bind date → which account → status. That way you can see which profile sat on which IP and whether there was overlap.
• At scale — a dedicated modem (Quectel RM520 / Sierra MC7455 / Fibocom L860) per batch of accounts, with automated IP rotation via AT+CFUN=4 → AT+CFUN=1 or APN switching — for teams that build their own farm without an external service.

Bonus: Secondary Signals TikTok Reads

The five causes above are the base frame. Once they're closed, accounts stop dying inside the first day. But TikTok antifraud works on an ensemble of signals, and there are a few secondary factors that don't kill on their own but stack into a higher "risk score":

• Tunnel TLS fingerprint. Standard open-source IKEv2 stacks have a recognizable JA3 fingerprint. Serious antifraud (Cloudflare, Imperva, TikTok's own antifraud engines) can read it. VLESS with Reality closes this naturally; IKEv2 does not. If you suspect aggressive detection and you have the choice — VLESS.
• Session lifecycle. TikTok remembers the time of first app open after install. If during the first 60 seconds the app receives "normal" signals (typical API calls, feed scroll, like), trust is higher. Registering immediately after open and jumping straight into the ad account = elevated risk.
• iOS background traffic. iCloud, push notifications, App Store updates — all originate from the same Apple servers through the same IP. If those connections are missing (the tunnel blocks push), TikTok sees a "bare" device without typical background noise. The norm is to route Apple system traffic through the tunnel as well.
• TimeZone / IP consistency. Settings → General → Date & Time → Set Automatically should be on, but Time Zone should be explicitly aligned with the tunnel geo. Otherwise the iPhone will pick up the time of the Wi-Fi network, and TikTok will read the mismatch through NSDate.

These don't make the "top five," but they are worth keeping in mind once the basics are closed and accounts still die more often than your peers'.

What These Five Reasons Have in Common

All of them are about infrastructure, not creative. You can produce a brilliant video chain and burn it to the ground if IPv6 is leaking on the device. You can ship identical clips and run accounts for weeks if the IP layer is built right: a clean IP, no leaks, rotated per profile, geo signals aligned.

Most media buyers focus on creative because creative is "the creative work" — visible, fun, shareable. Infrastructure is invisible. Nobody enjoys pasting a static DNS into a .mobileconfig. But 80% of the difference between "mine die in two days" and "mine live for two weeks" sits in exactly that boring layer.

A breakdown of which tunnel format to choose (IKEv2 vs SOCKS5 vs VLESS) and why — in a separate piece: IKEv2 vs SOCKS5 for TikTok Ads on iPhone: What to Pick and Why.

A Clean, Unshared IP — ProxyGrow

ProxyGrow delivers real mobile IPs bound to specific Quectel / Sierra / Fibocom modems. ASNs are carrier (Orange, Vodafone, Digi), never datacenter. Rotation is on demand through the panel or API, per account. Configs come as IKEv2 .mobileconfig files or VLESS links — both transports run over the same mobile IP, and that IP rotates by URL with no cooldown.

→ Website: proxygrow.com → Telegram: t.me/ProxyGrow