The Good Tech Companies - Inside 30 Days of Residential Proxy Data: Patterns, Risks, and Surprising Insights

Episode Date: August 12, 2025

This story was originally published on HackerNoon at: https://hackernoon.com/inside-30-days-of-residential-proxy-data-patterns-risks-and-surprising-insights. 30 days of residential proxy data reveal patterns in IP reuse, top countries, ISPs, IPv6 adoption, and churn—shaping better fraud detection. Check more stories related to cybersecurity at: https://hackernoon.com/c/cybersecurity. You can also check exclusive content about #residential-proxy-detection, #ipinfo-proxy-data, #ipv4-vs-ipv6-proxies, #proxy-ip-churn, #top-proxy-countries, #isp-proxy-activity, #fraud-prevention-ip-data, #good-company, and more. This story was written by: @ipinfo. Learn more about this writer by checking @ipinfo's about page, and for more stories, please visit hackernoon.com. Analyzing 26M+ residential proxy IPs over 30 days, IPinfo uncovers key trends: 45% of IPs span multiple providers, Brazil and the US lead usage, 10 ISPs power 20% of supply, IPv4 dominates over IPv6, and high churn keeps networks dynamic. These insights help security teams refresh blocklists, score risks, and detect proxies with greater accuracy.

This audio is presented by Hacker Noon, where anyone can learn anything about any technology. Inside 30 Days of Residential Proxy Data, Patterns, Risks, and Surprising Insights by IP Info, IP Data Provider. Earlier this year, we introduced our Residential Proxy Detection Data, which gives users clear signals on whether an IP is associated with a residential proxy provider. Residential proxies are a type of IP anonymization that root traffic through real residential IPs, making online activity appear legitimate. Standard IP data can't reliably identify this behavior. Specialized detection methods are needed to distinguish genuine users from proxy-based activity. And this type of IP anonymization is growing more popular for that very reason, fueling all types of online fraud.

That's why we continue to improve how we identify and monitor these proxies. Just in the past month, we've grown the number of residential proxies in our 30-day database from 20 to 25 million IP addresses. We don't want to risk a residential proxy IP slipping through the cracks, which could result in anything from web scraping to add click fraud. Looking at the last 30 days of residential proxy data, I've gained new insights into how and where these residential proxies operate. One IP, many providers. A staggering 45% of IP addresses flagged as residential proxies appear in multiple provider pools. Some IPs show up an astounding amount of times, like 198. 50. 156,199 showing up in 75 different providers. What this tells us, providers often resell from the same

upstream sources. Unique, IPs might not be so unique after all. Some, competitors may be white labeling the same inventory. Why it matters. Risk engines treating IPs as provider-specific are missing the bigger picture. Where the proxies really are, residential proxy usage is heavily concentrated in just a handful of countries. While IPs appear across thousands of networks globally, most of the activity ice-driven by a small group of high-volume markets, countries where large populations, strong last-mile connectivity, and economic incentives for bandwidth-sharing apps come together. The top five countries alone, Brazil, the United States, India, Vietnam, and Russia account for over 46% of all residential proxy IPs observed in the past 30 days.

Brazil leads the list with 3.66 million IPs, followed closely by the United States, 3.44 million, and India, 1.77 million. Vietnam and Russia follow with 1.46 million and 1. 22 million, respectively, based on approximately 26. 3M unique IPV4 plus IPV6 residential proxy IPs observed in the last 30 days. What these countries have in common isn't just population. size. They also have widespread mobile and broadband coverage and a meaningful portion of user swilling to monetize unused bandwidth. In lower to middle income markets like Brazil, India, Vietnam, and Russia, even small payouts from apps like Honeygain or packet stream are enough to drive adoption. In the United States, the appeal often lies in unlimited home

internet plans. Residential proxy supply appears to follow factors like broadband and mobile penetration, especially 4G Plus and fiber. Population size, adoption of, get paid for bandwidth, apps, the ISPs powering the proxy economy. While residential proxy IPs span tens of thousands of networks, most of the traffic is concentrated within a surprisingly small group of providers. Over the last 30 days, we observed residential proxy activity in more than 33,000 unique ASNs, autonomous system numbers, which represents roughly a quarter of all allocated ASNs worldwide. But despite this wide reach, just 10 ISPs account for 20% of all residential proxy IPs. This means a handful of consumer internet providers are unintentionally responsible for

powering a significant chunk of the global proxy supply. And in some cases, the depth of this usage is staggering. We also looked at what share of each ISP's total IP address space was being used as a residential proxy. While most providers fall within a 2 to 5% range, Somo standout dramatically. In some networks, nearly one in five IPs is part of a proxy pool, often without the ISPs knowledge or the user's full understanding. Others, by contrast, show very limited proxy activity. Here's what we found, but this isn't a story about these ISPs selling access directly. In almost all cases, this usage is unintentional, driven by end users who install bandwidth sharing apps are browser extensions that monetize their connections. Some of these installs are voluntary.

may come bundled or misrepresented. And in some cases, malware may be involved. This raises important questions about transparency, privacy, and consent. Are users truly aware their IP address is being rented out? Are ISPs equipped to detect or manage this kind of usage? And what happens when a major network becomes a hotspot for abuse because 20% of its subscribers have unwittingly joined a proxy pool? IPV6 is still a rarity. Within the last 30 days, we have seen roughly 21. 7MV4 IPs, 88% versus 2.9M, 12% IPV6 IPs. So IPV6 is in fact still a lot less common than V4 for residential proxies even though Google's public stats show that almost half of global end user traffic, approximately

equals 48% now reaches Google over IPV6. Why does proxy adoption lag? The most plausible factors could be customer demand remains IPV4 first. Many scraping, ad verification, and sneaker bot targets still whitelist IPV4 only. Rotation economics differ. Home routers typically expose just one or a handful of IPV6 addresses, so providers can't cycle through, fresh V6 exits the way they shuffle IPV4.24s. Tooling and risk engines treat IPV6 as atypical. Some anti-fraud stacks still flag V6 traffic more aggressively, pushing vendors to stick with IPV4 where success rates are predictable.

For Defenders an IPV6 address flagged as residential proxy is rare enough to merit extra scrutiny, blanket blocking V6, however, risks high false positive costs for minimal gain. Churn is the norm. Roughly 2% of residential proxy IPs drop out of our dataset each day over a 30-day window, meaning we saw them at least once and then never again for the next 30 days. At the same time, the pool is constantly replenished. About 10% awful addresses we track have seen activity in the past 24 hours, and nearly 30% have shown up within the last five days. The result is a network that is in constant rotation, making it feel highly dynamic to anyone relying on or trying to block these proxies.

IPINFO's residential proxy detection data exposes two timing signals that makeeth those churn numbers actionable. Last underscore scene, the most recent date the IP was observed as a residential proxy. Use it to age out block list entries and to spot hot IPs that are active right now. Percent underscore days underscore scene, how often the IP was active over the look back window, seven days in the API, 3090th's days in the database. High percentages flagged sticky exit nodes worth a higher risk score. Low percentages point to aggressively rotated addresses that behave more like one-time burners. Together, these fields help security and fraud teams. Refresh block lists in near real time

instead of relying on static, quickly stale deny files. Weight risk dynamically. A brand new IP with a recent last underscore scene and high percent underscore day's underscore scene is far more suspect than an address last active months ago. Cut false positives by distinguishing long-lived home connections occasionally rented out from short-lived, high-rotation proxy exits. Identify residential Proxy IPs with IP info. Residential proxy traffic isn't a shadowy blur once you look at the data. The same IPs cycle rapidly rather than vanishing, most of the supply comes from a handful of countries and ISPs, and IPV4 still dwarfs IPV6. Recognizing those patterns let security teams refresh block lists intelligently instead of blocking in the dark. IPINFO's residential

proxy detection, delivered as an API or downloadable database, flags proxy IPs and and includes freshness timestamp and percentage day scenes so you can score risk, rotate rules automatically, or enrich historical logs with confidence. In short, residential proxies are measurable and manageable when you have the right data. If you'd like to see how our detection feed can sharpen your defenses or analytics pipeline, we'd be happy to share a trial key or sample data set. About the author Daniel Quant leads the solutions engineering team at IP Info, where he helps customers get the most out of internet data. For IP info, he worked in data science in the hospitality industry.

Thank you for listening to this Hackernoon story, read by artificial intelligence. Visit hackernoon.com to read, write, learn and publish.