Datacenter blocklists are still the default proxy defence in a lot of fraud stacks. The addresses showing up in proxy supply this week mostly were not in datacenters.
Between 6–12 October 2026 (UTC), the IP99 risk feed captured 11,860,625 proxy exit addresses it had not seen in the previous 7 days (+27% vs the prior week). Source page: ip99.com/en/proxy-exits (generated 13 Oct 2026 UTC).
What those addresses sit on
| Usage type | Addresses | Share |
|---|---|---|
| Residential broadband | 9,427,787 | 79.5% |
| Mobile network | 1,557,255 | 13.1% |
| Gateway / NAT egress | 536,041 | 4.5% |
| Datacenter | 260,684 | 2.2% |
| Education network | 48,206 | 0.4% |
| Unclassified | 30,652 | 0.3% |
About 65% were rated high-risk at the moment of capture. The rest still carried a proxy-class signal at a lower risk level.
IP99 counts an address as "captured" when it enters the feed with a proxy-class signal (proxy, VPN, dial-up pool, cloud phone, or hijacked shared proxy) and was not in the live 7-day risk mirror. Addresses that go quiet and return can be counted again. The page describes what 53 upstream collection sources delivered - not the total number of proxies in the world.
Why the 2% matters
If your defence is mainly an ASN or hosting blocklist, you are mostly looking at that 2.2% datacenter slice. Residential and mobile space is where home-broadband proxies and dial-up pools live. An address that keeps turning up in proxy supply is a proxy exit whatever its ISP label says.
Top ASNs in this week's capture window (by address count) include large access networks such as AS4134 and AS4837. That is a clue about where supply is being sold from, not a claim that every customer on those networks is a proxy.
Day-to-day shape
Captured addresses (new to the prior 7-day mirror that day), with how many were high-risk at capture:
| Day (UTC) | Captured | High-risk at capture |
|---|---|---|
| 2026-10-06 | 1,251,843 | 785,307 |
| 2026-10-07 | 1,274,864 | 789,967 |
| 2026-10-08 | 1,890,133 | 1,202,297 |
| 2026-10-09 | 2,242,137 | 1,559,247 |
| 2026-10-10 | 1,926,679 | 1,267,978 |
| 2026-10-11 | 1,752,149 | 1,112,807 |
| 2026-10-12 | 1,522,820 | 961,739 |
The peak on 8–9 Oct is visible in the table; the week still closes well above the prior window.
Check one yourself
Free, no signup:
curl https://ip99.com/v1/ip/8.8.8.8
Look at evidence_state (active / stale / none), risk.score, and the proxy-class signals. A score of 0 is not "safe" - it means IP99 holds no current verifiable evidence against that address.
IP99 is built by ThreatHunter. Weekly capture totals refresh daily on ip99.com/en/proxy-exits.
Top comments (0)