What are residential proxies and how do they work in attacks?

Residential proxies use real home IPs from infected devices or botnets, rotating fast to mimic legit users and evade blocks.

Why can't IP reputation systems catch 78% of these sessions?

They're too short-lived—most under a month—and diverse across 683 ISPs, outpacing reputation feeds.

Ditch IP reliance: track behavior, sequential probes, device fingerprints, and block odd protocols from ISP space.

🛡️ Security Tools

Four billion malicious sessions. 78% slip through IP reputation nets via sneaky residential proxies. Defenses built on bad assumptions are crumbling.

Threat Digest Apr 03, 2026 3 min read

Residential proxies evaded IP reputation in 78% of 4B malicious sessions, exposing flaws in location-based defenses. 𝕏
89.7% of these IPs active under a month; diversity across 683 ISPs aids stealth. 𝕏
Shift to behavioral detection essential—track probes, fingerprints over IPs. 𝕏

Published by

Threat intelligence. Zero noise.

#Greynoise #IP reputation evasion #cyber defense #malicious sessions #residential proxies

Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.

Originally reported by Bleeping Computer