GreyNoise: Residential Proxy Rotation Undermines IP Reputation Defenses Across 4 Billion Edge Sessions
GreyNoise analyzed 4 billion sessions targeting edge infrastructure over 90 days and concluded that IP reputation feeds are structurally ineffective against residential proxy traffic. Attackers route scanning and reconnaissance through compromised home broadband, mobile and small-business connections, so source IPs look like legitimate users. Residential IPs rotate so quickly that they are gone before a feed can flag them. The report cites repeated takedowns, including IPIDEA (disrupted by Google Threat Intelligence Group in January 2026), 911 S5 and AnyProxy/5Socks (DOJ actions), and notes that networks regenerate after each disruption.
Technical Details
- 39% of unique IPs targeting the edge are residential, versus 22% of sessions. Each residential IP averages fewer than 3 sessions (median 1), and 78% are seen at most twice across the GreyNoise Global Observation Grid.
- Only 0.1% of residential sessions carry exploitation payloads, versus 1.0% from hosting infrastructure. Residential nodes appear to be used for mapping the terrain, with exploitation following from hosting infrastructure.
- Traffic from IPs geolocating to India drops 34% between daytime peak and overnight trough (server traffic varies under 3%). GreyNoise infers these are infected home PCs that get powered off, so the owners are victims rather than willing proxy nodes.
- SMB worm propagation is 84% residential, with zero overlap between SMB and Telnet source IP populations, indicating separate device populations.
- IPIDEA reportedly had 9-11 million daily active proxies used by over 550 threat groups. 911 S5 covered 19 million IPs in 190 countries. AnyProxy/5Socks had over 7,000 proxies and $46 million in revenue. Mandiant M-Trends 2025 documented state actors using residential infrastructure.
- The report also covers commercial SDK-enrolled proxy fleets, VPN reconnaissance from residential IPs against enterprise perimeters, and a Censys ground-truth validation, along with GreyNoise's observation limits.
Remediation
The article summary does not give specific controls beyond noting a detection gap section. The data implies defenders should not rely solely on IP reputation feeds and should favor behavior- and payload-based detection at the edge.
Linha do tempo
-
GreyNoise: Residential Proxy Rotation Undermines IP Reputation Defenses Across 4 Billion Edge Sessions
ler a análise desta fonte ocultar
GreyNoise analyzed 4 billion sessions targeting edge infrastructure over 90 days and concluded that IP reputation feeds are structurally ineffective against residential proxy traffic. Attackers route scanning and reconnaissance through compromised home broadband, mobile and small-business connections, so source IPs look like legitimate users. Residential IPs rotate so quickly that they are gone before a feed can flag them. The report cites repeated takedowns, including IPIDEA (disrupted by Google Threat Intelligence Group in January 2026), 911 S5 and AnyProxy/5Socks (DOJ actions), and notes that networks regenerate after each disruption.
Technical Details
- 39% of unique IPs targeting the edge are residential, versus 22% of sessions. Each residential IP averages fewer than 3 sessions (median 1), and 78% are seen at most twice across the GreyNoise Global Observation Grid.
- Only 0.1% of residential sessions carry exploitation payloads, versus 1.0% from hosting infrastructure. Residential nodes appear to be used for mapping the terrain, with exploitation following from hosting infrastructure.
- Traffic from IPs geolocating to India drops 34% between daytime peak and overnight trough (server traffic varies under 3%). GreyNoise infers these are infected home PCs that get powered off, so the owners are victims rather than willing proxy nodes.
- SMB worm propagation is 84% residential, with zero overlap between SMB and Telnet source IP populations, indicating separate device populations.
- IPIDEA reportedly had 9-11 million daily active proxies used by over 550 threat groups. 911 S5 covered 19 million IPs in 190 countries. AnyProxy/5Socks had over 7,000 proxies and $46 million in revenue. Mandiant M-Trends 2025 documented state actors using residential infrastructure.
- The report also covers commercial SDK-enrolled proxy fleets, VPN reconnaissance from residential IPs against enterprise perimeters, and a Censys ground-truth validation, along with GreyNoise's observation limits.
Remediation
The article summary does not give specific controls beyond noting a detection gap section. The data implies defenders should not rely solely on IP reputation feeds and should favor behavior- and payload-based detection at the edge.