Datacenter blocklists are still the default proxy defence in a lot of fraud stacks. The addresses showing up in proxy supply this week mostly were not in datacenters.
Between 12–18 October 2026 (UTC), the IP99 risk feed captured 10,829,683 proxy exit addresses it had not seen in the previous 7 days (-7% vs the prior week). Source page: ip99.com/en/proxy-exits (capture window still 12–18 Oct 2026 UTC as of publish).
What those addresses sit on
| Usage type | Addresses | Share |
|---|---|---|
| Residential broadband | 8,645,883 | 79.8% |
| Mobile network | 1,436,705 | 13.3% |
| Gateway / NAT egress | 466,938 | 4.3% |
| Datacenter | 220,055 | 2.0% |
| Education network | 36,064 | 0.3% |
| Unclassified | 24,038 | 0.2% |
About 63% were rated high-risk at the moment of capture. The rest still carried a proxy-class signal at a lower risk level.
IP99 counts an address as "captured" when it enters the feed with a proxy-class signal (proxy, VPN, dial-up pool, cloud phone, or hijacked shared proxy) and was not in the live 7-day risk mirror. Addresses that go quiet and return can be counted again. The page describes what 53 upstream collection sources delivered - not the total number of proxies in the world.
Why the 2% matters
If your defence is mainly an ASN or hosting blocklist, you are mostly looking at that 2.0% datacenter slice. Residential and mobile space is where home-broadband proxies and dial-up pools live. An address that keeps turning up in proxy supply is a proxy exit whatever its ISP label says.
Top ASNs in this week's capture window (by address count) include large access networks such as AS4134 and AS4837. That is a clue about where supply is being sold from, not a claim that every customer on those networks is a proxy.
Day-to-day shape
Captured addresses (new to the prior 7-day mirror that day), with how many were high-risk at capture:
| Day (UTC) | Captured | High-risk at capture |
|---|---|---|
| 2026-10-12 | 1,522,820 | 961,739 |
| 2026-10-13 | 1,501,634 | 953,757 |
| 2026-10-14 | 1,489,460 | 957,899 |
| 2026-10-15 | 1,496,390 | 965,299 |
| 2026-10-16 | 1,667,871 | 1,059,319 |
| 2026-10-17 | 1,671,080 | 1,036,063 |
| 2026-10-18 | 1,480,428 | 887,422 |
Volume cooled off after last week's spike (-7% WoW), but the mix barely moved: residential still near 80%, datacenter still about 2%.
Check one yourself
Free, no signup:
curl https://ip99.com/v1/ip/8.8.8.8
Look at evidence_state (active / stale / none), risk.score, and the proxy-class signals. A score of 0 is not "safe" - it means IP99 holds no current verifiable evidence against that address.
IP99 is built by ThreatHunter. Weekly capture totals refresh daily on ip99.com/en/proxy-exits.
Top comments (0)