This Week's Proxy Exits: 11.5M New Addresses, Still Almost All Off Datacenter Space

Datacenter blocklists are still the default proxy defence in a lot of fraud stacks. The addresses showing up in proxy supply this week mostly were not in datacenters.

Between 19–25 October 2026 (UTC), the IP99 risk feed captured 11,525,472 proxy exit addresses it had not seen in the previous 7 days (+6% vs the prior week). Source page: ip99.com/en/proxy-exits (generated 26 Oct 2026 UTC).

What those addresses sit on

Usage type	Addresses	Share
Residential broadband	9,151,795	79.4%
Mobile network	1,503,531	13.0%
Gateway / NAT egress	526,366	4.6%
Datacenter	260,847	2.3%
Education network	49,677	0.4%
Unclassified	33,256	0.3%

About 64% were rated high-risk at the moment of capture. The rest still carried a proxy-class signal at a lower risk level.

IP99 counts an address as "captured" when it enters the feed with a proxy-class signal (proxy, VPN, dial-up pool, cloud phone, or hijacked shared proxy) and was not in the live 7-day risk mirror. Addresses that go quiet and return can be counted again. The page describes what 54 upstream collection sources delivered — not the total number of proxies in the world. No address lists are published.

Why the 2% matters

If your defence is mainly an ASN or hosting blocklist, you are mostly looking at that 2.3% datacenter slice. Residential and mobile space is where home-broadband proxies and dial-up pools live. An address that keeps turning up in proxy supply is a proxy exit whatever its ISP label says.

That is the same reason a residential allowlist fails the other way: usage type answers "what kind of network is this," not "is this address currently sold as an exit." Rotating residential proxies and dial-up pools are designed to sit in DYN / MOB space. Detecting them needs supply-side observation with an age attached, not a permanent network-type label.

Which networks show up most

Top ASNs in this week's capture window (by distinct address count):

ASN	Addresses	Share
AS4134	998,961	8.7%
AS4837	725,984	6.3%
AS9808	367,102	3.2%
AS6057	269,928	2.3%
AS36947	242,659	2.1%

Large access networks appearing here are a clue about where proxy supply is being sold from — not a claim that every customer on those networks is a proxy. Ban a whole ASN and you take out legitimate home and mobile users. Prefer per-address evidence at decision time.

Day-to-day shape

Captured addresses (new to the prior 7-day mirror that day), with how many were high-risk at capture:

Day (UTC)	Captured	High-risk at capture
2026-10-19	1,638,525	1,098,049
2026-10-20	1,496,080	1,062,230
2026-10-21	1,679,859	1,061,464
2026-10-22	1,696,954	1,060,504
2026-10-23	1,785,796	1,147,796
2026-10-24	1,658,044	1,025,424
2026-10-25	1,570,214	957,858

Volume rebounded week-over-week (+6% after last week's soft dip), and the mix held: residential near 79%, datacenter still about 2%. Daily capture stayed in a band roughly 1.5–1.8M addresses — no single spike day that would make a static list look "caught up."

How to use this without over-blocking

1. Branch on evidence, not network type. Residential is where your customers live; do not hard-block on DYN / MOB alone.
2. Step up, don't stop. A fresh proxy-class signal on signup, a coupon claim, or a login from a new device justifies a second factor or a delay — not an immediate ban.
3. Read the age. evidence_state: "stale" means the address was in supply before and is not now; treat it as a weak prior. Re-query at decision time rather than caching a verdict for days.
4. Keep the timestamp. Store computed_at with the decision so a disputed block can be traced back to when the observation was made.

Check one yourself

Free, no signup:

curl https://ip99.com/v1/ip/8.8.8.8

Look at evidence_state (active / stale / none), risk.score, and the proxy-class signals. A score of 0 is not "safe" — it means IP99 holds no current verifiable evidence against that address. The score is the freshness and strength of that evidence, not a probability that the address "is an attacker."

The same lookup is available to agents as an MCP tool at https://ip99.com/mcp (ip_risk_lookup). Field reference and routing notes live on the API docs.