The address an attacker connects from stopped being a useful fact about them. Most defensive tooling still leads with it.
IP reputation worked because attackers reused addresses. A bad address accumulated a history, and blocking it stopped the attacker until they obtained a new one. Residential proxy networks removed that constraint — they route each request through a different real consumer connection, so every attempt arrives from an address with a clean record. GreyNoise found 39% of unique IPs attacking the edge come from residential space, and 78% vanish before a reputation feed can flag them. A signal that describes the past cannot catch a client that never repeats itself.
The devices are real, and so are the connections. Residential proxy networks are largely built from consumer hardware — routers, streaming boxes, Android TV devices, phones — running software the owner did not knowingly install. Traffic exits through the device, so from your server's point of view it originates on a home broadband line in a residential ASN.
The 2026 case study is Kimwolf, a botnet that infected roughly two million consumer devices and rents them out as residential proxies. DataDome's analysis traced how that inventory is monetised across login, registration and cart endpoints — credential stuffing, web scraping, account creation and payment fraud. The botnet survived a federal takedown in March 2026 and rebuilt, partly by hiding command infrastructure in blockchain naming records.
The uncomfortable part is what this means for the traffic you already allow. These are not requests from hosting providers that a datacenter blocklist can sweep up. They are requests from consumer connections, indistinguishable at the network layer from a customer at home — because they are running on exactly that hardware.
| Finding | Figure | Source |
|---|---|---|
| Edge-targeting IPs from residential space | 39% | GreyNoise, ~4bn sessions |
| Residential IPs that vanish before being flagged | 78% | GreyNoise |
| IPs in a single 10-minute account-takeover burst | 14,864 | Accertify ATO telemetry |
| Those IPs with a clean reputation score | 99.29% | Accertify |
| Devices in the Kimwolf proxy botnet | ~2 million | DataDome |
| Threat clusters using one proxy network's exit nodes in a week | 316 | Google, on NetNut/Popa |
Read those first two rows together and the problem is unambiguous. Telemetry from a real account-takeover burst shows attacks spread across nearly fifteen thousand addresses in ten minutes, 99.29% of which had a clean reputation. Not a poisoned reputation — clean. Velocity controls never trigger because no address repeats. Reputation controls never trigger because no address has a history.
This is why "block more IPs" is not a strategy. The addresses being used are, by every measure a reputation feed has, good addresses.
The obvious response — block residential ranges — has no safe setting. Residential address space is where your customers live. On a consumer site that is most of your traffic; on a B2B site it is everyone working from home.
This is the specific failure mode worth designing against. A blocklist that catches the attack by catching the neighbourhood is not a security control, it is an outage with extra steps. And the attackers know it — that asymmetry, where the defence must be precise and the attack only has to be plausible, is what makes residential proxies effective.
The address changes; the automation stack behind it usually does not. Browser and device fingerprinting recognises the same tooling across different IPs, which is the only signal in this list that survives rotation by design.
Peer-reviewed work on agent detection found the strongest discriminators were behavioural — mouse event rate and click-duration variance — rather than timing artefacts. What a client does is harder to rent than where it connects from.
Per-account and per-credential limits hold regardless of IP rotation, because the thing being limited is the resource the attacker wants. This is the layer that actually contains a distributed credential-stuffing run once a valid credential has been found.
Residential origin is worth points on a score. It is not worth a block. Any rule that blocks on it alone will, at some volume, lock out real customers — and the false positive is indistinguishable from the true positive at the moment you make it.
Because the attacker no longer reuses an address. A residential proxy network routes each attempt through a different real consumer connection, so every request arrives from an IP with a clean history and no prior abuse. Reputation systems flag addresses that have misbehaved before — these never have.
A pool of real consumer devices — routers, smart TVs, set-top boxes, phones — whose owners have usually not consented to being part of it. Traffic exits through the device, so it appears to come from a home broadband connection rather than a datacenter, which is exactly what IP-based blocking is designed to look for.
A GreyNoise analysis of roughly four billion sessions found 39% of unique IPs targeting the edge originate from residential address space, and 78% of them disappear before a reputation feed can flag them.
No. Residential space is where your customers live. Blocking it blocks legitimate users on home broadband, which on a consumer site is most of your traffic. This is a case where the obvious control has no safe setting.
Scoring the client rather than the address: browser and device fingerprinting to recognise the automation stack across IP rotations, behavioural signals such as interaction timing and event rate, and — for the account layer — per-account limits that do not depend on where the request came from.
GreyNoise — The Invisible Army: residential proxy abuse · DataDome — Inside Kimwolf traffic · RH-ISAC — residential proxies and account takeover · M3AAWG — from DDoS to residential proxies · eSecurity Planet — Kimwolf · arXiv — minimal feature sets for agent detection. Accertify's ATO figures are as reported in RH-ISAC's analysis.
Per-request scoring that survives IP rotation. $50/mo flat, free tier.
Get started free →