This Week's Proxy Exits: 10.0M New Addresses, Still Almost All Off Datacenter Space

Datacenter blocklists still look like the default proxy defence in a lot of fraud stacks. The addresses showing up in proxy supply this week were still mostly not in datacenters. The mix shift worth flagging is the datacenter slice itself: it eased from 3.2% in the last posted recap back to 2.2%, in line with the flat ~2% band of mid-to-late October.

Between 5–11 November 2026 (UTC), the IP99 risk feed captured 10,026,346 proxy exit addresses it had not seen in the previous 7 days (−5% vs the previous 7 days). Source page: ip99.com/en/proxy-exits (generated 12 November 2026, 12:36 UTC). The public page rolls daily over the last 7 complete UTC days; this is the window it reports today, continuing the series after the 4–10 November recap (the two windows overlap on 5–10 November).

Against that last posted week (10,561,845 addresses), volume is also down about −5.1%. The page's official −5% compares 5–11 November with 29 October–4 November, not with the overlapping posted window. A large part of the step-down is compositional: 11 November was a lighter day (1,217,179 captured) and replaced 4 November (1,752,678) as the window rolled forward. That describes what entered the 7-day mirror, not worldwide proxy supply.

What those addresses sit on

Usage type	Addresses	Share
Residential broadband	8,092,828	80.7%
Mobile network	1,227,350	12.2%
Gateway / NAT egress	405,698	4.0%
Datacenter	221,094	2.2%
Education network	50,409	0.5%
Unclassified	28,967	0.3%

About 62% were rated high-risk at the moment of capture. The rest still carried a proxy-class signal at a lower risk level.

IP99 counts an address as "captured" when it enters the feed with a proxy-class signal (proxy, VPN, dial-up pool, cloud phone, or hijacked shared proxy) and was not in the live 7-day risk mirror. Addresses that go quiet and return can be counted again. The page describes what 56 upstream collection sources delivered — not the total number of proxies in the world. An address is counted once per window. No address lists are published.

Why 2.2% still is not "mostly datacenter"

If your defence is mainly an ASN or hosting blocklist, you are still mostly looking past the problem. Residential broadband alone is 80.7% of this week's capture window. Mobile adds another 12.2%. Together that is 93% of newly seen proxy exits sitting in access networks where real customers also live.

The datacenter row moved from 3.2% in the last posted recap (4–10 Nov) and 3.6% in the 29 Oct–4 Nov recap down to 2.2% here, back near the 2.0% of the 26 Oct–1 Nov window a fortnight earlier. The headline does not flip. A hosting-only blocklist still misses the majority of the supply-side traffic that shows up as residential or mobile exits.

Usage type answers "what kind of network is this," not "is this address currently sold as an exit." Rotating residential proxies and dial-up pools are designed to sit in DYN / MOB space. Detecting them needs supply-side observation with an age attached, not a permanent network-type label. Product notes: rotating residential proxies, detect proxy / VPN.

Which networks show up most

Top ASNs in this week's capture window (by distinct address count):

ASN	Addresses	Share
AS4134	946,807	9.4%
AS4837	726,730	7.2%
AS9808	356,305	3.6%
AS6057	256,393	2.6%
AS36903	199,394	2.0%

AS4134, AS4837, and AS9808 remain the three largest contributors, as they have in recent recaps. The top five is unchanged from the 4–10 November recap, with AS6057 and AS36903 still fourth and fifth. AS55836, which held fifth place in the 29 Oct–4 Nov recap (2.2%), again sits eighth this week (1.6%). Large access networks appearing here are a clue about where proxy supply is being sold from — not a claim that every customer on those networks is a proxy. Ban a whole ASN and you take out legitimate home and mobile users. Prefer per-address evidence at decision time. ASN pages for deeper network mix: ip99.com/en/asn/.

Day-to-day shape

Captured addresses (new to the prior 7-day mirror that day), with how many were high-risk at capture:

Day (UTC)	Captured	High-risk at capture
2026-11-05	1,493,146	946,402
2026-11-06	1,544,553	943,591
2026-11-07	1,517,140	919,244
2026-11-08	1,415,823	897,828
2026-11-09	1,371,503	883,005
2026-11-10	1,467,002	940,244
2026-11-11	1,217,179	695,544

Volume was down week-over-week (official −5%), while upstream sources sat at 56 (59 in the last posted recap). Daily capture stayed in a band roughly 1.22–1.54M addresses, with 11 Nov the lighter day and 6 Nov the heavier one in this window — still not a shape that makes a static list look "caught up."

How to use this without over-blocking

1. Branch on evidence, not network type. Residential is where your customers live; do not hard-block on DYN / MOB alone.
2. Step up, don't stop. A fresh proxy-class signal on signup, a coupon claim, or a login from a new device justifies a second factor or a delay — not an immediate ban of a whole building's shared egress.
3. Read the age. evidence_state: "stale" means the address was in supply before and is not now; treat it as a weak prior. Re-query at decision time rather than caching a verdict for days. Score 0 with evidence_state: "none" is not a clean bill of health either — it means no current verifiable evidence is on file.
4. Keep the timestamp. Store computed_at with the decision so a disputed block can be traced back to when the observation was made.

IP99 by ThreatHunter publishes the free weekly aggregate so you can see the mix without buying a feed. The score on a single lookup is the freshness and strength of verifiable risk evidence — not a probability that the address "is an attacker." Do not treat IP99 scores as identical to every other ThreatHunter dataset you may have seen elsewhere; this article only claims what the public proxy-exits page and free /v1/ip document.

Check one yourself

Free, no signup:

curl https://ip99.com/v1/ip/8.8.8.8

Look at evidence_state (active / stale / none), risk.score, and the proxy-class signals. Verified 12 November 2026, 13:08 UTC: public DNS infrastructure here still shows a hosting network attribute with score 0, evidence_state: "none", and usage_type IDC — a network fact, not a proxy verdict. The same lookup is available to agents as an MCP tool at https://ip99.com/mcp (ip_risk_lookup). Field reference and routing notes live on the API docs.

Try it on ip99.com, keep an eye on this week's proxy exits, and wire the free OpenAPI at ip99.com/openapi.json if you want the same fields in Postman or codegen.