This Week's Proxy Exits: 10.6M New Addresses, Still Almost All Off Datacenter Space

Datacenter blocklists still look like the default proxy defence in a lot of fraud stacks. The addresses showing up in proxy supply this week mostly were not in datacenters — though the datacenter slice did tick up from the flat ~2% band of recent weeks.

Between 29 October – 4 November 2026 (UTC), the IP99 risk feed captured 10,576,402 proxy exit addresses it had not seen in the previous 7 days (−6% vs the prior week). Source page: ip99.com/en/proxy-exits (generated 5 November 2026 UTC).

What those addresses sit on

Usage type	Addresses	Share
Residential broadband	8,308,606	78.6%
Mobile network	1,355,233	12.8%
Gateway / NAT egress	441,993	4.2%
Datacenter	376,455	3.6%
Education network	55,304	0.5%
Unclassified	38,811	0.4%

About 63% were rated high-risk at the moment of capture. The rest still carried a proxy-class signal at a lower risk level.

IP99 counts an address as "captured" when it enters the feed with a proxy-class signal (proxy, VPN, dial-up pool, cloud phone, or hijacked shared proxy) and was not in the live 7-day risk mirror. Addresses that go quiet and return can be counted again. The page describes what 57 upstream collection sources delivered — not the total number of proxies in the world. No address lists are published.

Why 3.6% still is not "mostly datacenter"

If your defence is mainly an ASN or hosting blocklist, you are still mostly looking past the problem. Residential broadband alone is 78.6% of this week's capture window. Mobile adds another 12.8%. Together that is over 90% of newly seen proxy exits sitting in access networks where real customers also live.

The datacenter row moved from about 2.0% in the prior complete week (26 Oct – 1 Nov) to 3.6% here. That is a real mix shift in what the collectors delivered into the mirror — worth watching — but it does not flip the headline. A hosting-only blocklist still misses the majority of the supply-side traffic that shows up as residential or mobile exits.

Usage type answers "what kind of network is this," not "is this address currently sold as an exit." Rotating residential proxies and dial-up pools are designed to sit in DYN / MOB space. Detecting them needs supply-side observation with an age attached, not a permanent network-type label. Product notes: rotating residential proxies, detect proxy / VPN.

Which networks show up most

Top ASNs in this week's capture window (by distinct address count):

ASN	Addresses	Share
AS4134	959,474	9.1%
AS4837	720,839	6.8%
AS9808	347,983	3.3%
AS6057	251,108	2.4%
AS55836	231,901	2.2%

Large access networks appearing here are a clue about where proxy supply is being sold from — not a claim that every customer on those networks is a proxy. Ban a whole ASN and you take out legitimate home and mobile users. Prefer per-address evidence at decision time. ASN pages for deeper network mix: ip99.com/en/asn/.

Day-to-day shape

Captured addresses (new to the prior 7-day mirror that day), with how many were high-risk at capture:

Day (UTC)	Captured	High-risk at capture
2026-10-29	1,430,961	917,972
2026-10-30	1,529,687	940,305
2026-10-31	1,442,095	886,256
2026-11-01	1,367,730	828,494
2026-11-02	1,410,781	835,680
2026-11-03	1,642,470	1,080,877
2026-11-04	1,752,678	1,169,732

Volume eased week-over-week (−6% after the prior ~10.3M window), while upstream sources sat at 57. The softer headline is about what those collectors delivered into the 7-day mirror, not a claim that proxy supply worldwide shrank. Daily capture stayed in a band roughly 1.37–1.75M addresses, with 3–4 Nov the heavier days inside this window — still not a shape that makes a static list look "caught up."

How to use this without over-blocking

1. Branch on evidence, not network type. Residential is where your customers live; do not hard-block on DYN / MOB alone.
2. Step up, don't stop. A fresh proxy-class signal on signup, a coupon claim, or a login from a new device justifies a second factor or a delay — not an immediate ban.
3. Read the age. evidence_state: "stale" means the address was in supply before and is not now; treat it as a weak prior. Re-query at decision time rather than caching a verdict for days. Score 0 with evidence_state: "none" is not a clean bill of health either — it means no current verifiable evidence is on file.
4. Keep the timestamp. Store computed_at with the decision so a disputed block can be traced back to when the observation was made.

IP99 by ThreatHunter publishes the free weekly aggregate so you can see the mix without buying a feed. The score on a single lookup is the freshness and strength of verifiable risk evidence — not a probability that the address "is an attacker." Do not treat IP99 scores as identical to every other ThreatHunter dataset you may have seen elsewhere; this article only claims what the public proxy-exits page and free /v1/ip document.

Check one yourself

Free, no signup:

curl https://ip99.com/v1/ip/8.8.8.8

Look at evidence_state (active / stale / none), risk.score, and the proxy-class signals. Public DNS infrastructure often shows a hosting network attribute with score 0 and evidence_state: "none" — that is a network fact, not a proxy verdict. The same lookup is available to agents as an MCP tool at https://ip99.com/mcp (ip_risk_lookup). Field reference and routing notes live on the API docs.

Try it on ip99.com, keep an eye on this week's proxy exits, and wire the free OpenAPI at ip99.com/openapi.json if you want the same fields in Postman or codegen.