Datacenter blocklists are still the default proxy defence in a lot of fraud stacks. The addresses showing up in proxy supply this week mostly were not in datacenters.
Between 26 October – 1 November 2026 (UTC), the IP99 risk feed captured 10,256,050 proxy exit addresses it had not seen in the previous 7 days (−11% vs the prior week). Source page: ip99.com/en/proxy-exits (generated 2 Nov 2026 UTC).
What those addresses sit on
| Usage type | Addresses | Share |
|---|---|---|
| Residential broadband | 8,141,209 | 79.4% |
| Mobile network | 1,368,798 | 13.3% |
| Gateway / NAT egress | 467,034 | 4.6% |
| Datacenter | 205,624 | 2.0% |
| Education network | 47,673 | 0.5% |
| Unclassified | 25,712 | 0.3% |
About 62% were rated high-risk at the moment of capture. The rest still carried a proxy-class signal at a lower risk level.
IP99 counts an address as "captured" when it enters the feed with a proxy-class signal (proxy, VPN, dial-up pool, cloud phone, or hijacked shared proxy) and was not in the live 7-day risk mirror. Addresses that go quiet and return can be counted again. The page describes what 67 upstream collection sources delivered — not the total number of proxies in the world. No address lists are published.
Why the 2% matters
If your defence is mainly an ASN or hosting blocklist, you are mostly looking at that 2.0% datacenter slice. Residential and mobile space is where home-broadband proxies and dial-up pools live. An address that keeps turning up in proxy supply is a proxy exit whatever its ISP label says.
That is the same reason a residential allowlist fails the other way: usage type answers "what kind of network is this," not "is this address currently sold as an exit." Rotating residential proxies and dial-up pools are designed to sit in DYN / MOB space. Detecting them needs supply-side observation with an age attached, not a permanent network-type label.
Which networks show up most
Top ASNs in this week's capture window (by distinct address count):
| ASN | Addresses | Share |
|---|---|---|
| AS4134 | 965,520 | 9.4% |
| AS4837 | 721,836 | 7.0% |
| AS9808 | 345,459 | 3.4% |
| AS6057 | 257,614 | 2.5% |
| AS55836 | 217,058 | 2.1% |
Large access networks appearing here are a clue about where proxy supply is being sold from — not a claim that every customer on those networks is a proxy. Ban a whole ASN and you take out legitimate home and mobile users. Prefer per-address evidence at decision time.
Day-to-day shape
Captured addresses (new to the prior 7-day mirror that day), with how many were high-risk at capture:
| Day (UTC) | Captured | High-risk at capture |
|---|---|---|
| 2026-10-26 | 1,506,506 | 921,527 |
| 2026-10-27 | 1,496,376 | 927,608 |
| 2026-10-28 | 1,482,695 | 919,210 |
| 2026-10-29 | 1,430,961 | 917,972 |
| 2026-10-30 | 1,529,687 | 940,305 |
| 2026-10-31 | 1,442,095 | 886,256 |
| 2026-11-01 | 1,367,730 | 828,494 |
Volume eased week-over-week (−11% after the prior week's 10.5M window), while upstream sources sat at 67. The softer headline is about what those collectors delivered into the 7-day mirror, not a claim that proxy supply worldwide shrank. The mix held: residential near 80%, datacenter still about 2%. Daily capture stayed in a band roughly 1.37–1.53M addresses — no single spike day that would make a static list look "caught up."
How to use this without over-blocking
- Branch on evidence, not network type. Residential is where your customers live; do not hard-block on DYN / MOB alone.
- Step up, don't stop. A fresh proxy-class signal on signup, a coupon claim, or a login from a new device justifies a second factor or a delay — not an immediate ban.
- Read the age.
evidence_state: "stale"means the address was in supply before and is not now; treat it as a weak prior. Re-query at decision time rather than caching a verdict for days. - Keep the timestamp. Store
computed_atwith the decision so a disputed block can be traced back to when the observation was made.
Check one yourself
Free, no signup:
curl https://ip99.com/v1/ip/8.8.8.8 Look at evidence_state (active / stale / none), risk.score, and the proxy-class signals. A score of 0 is not "safe" — it means IP99 holds no current verifiable evidence against that address. The score is the freshness and strength of that evidence, not a probability that the address "is an attacker."
The same lookup is available to agents as an MCP tool at https://ip99.com/mcp (ip_risk_lookup). Field reference and routing notes live on the API docs.
