Researchers caution that residential proxies, which route malicious traffic, significantly challenge IP reputation systems because distinguishing attackers from legitimate users is difficult.

This difficulty arises because residential proxies have short lifespans, are largely uninvolved, or undergo systematic rotation, making it hard for defenses to categorize them in a timely manner.

GreyNoise, a cybersecurity intelligence platform, reached this conclusion after reviewing a vast dataset of 4 billion malicious sessions targeting the edge over three months.

Around 39% of these sessions appeared to originate from home networks, likely part of residential proxies, but IP reputation feeds missed 78% of them.

“The data shows a trend that opposes a key principle of network security: differentiating attackers from legitimate users based on traffic origin,” GreyNoise explains.

According to the company, most residential IPs are used briefly before disappearing, as attackers constantly rotate them, outpacing the ability of reputation systems to flag them.

Approximately 89.7% of residential IPs engage in malicious activity for less than a month, with only 8.7% lasting two months and 1.6% persisting for three months.

Researchers suggest that longer-lasting IPs have specialized uses, such as focusing on SSH and utilizing Linux TCP stacks.

Diversity further complicates detection and blocking, as GreyNoise’s data reveals that the attacking residential IPs come from 683 internet service providers.

Another reason they are difficult to detect is that they are primarily used for network scanning and reconnaissance, with the researchers reporting that only 0.1% are involved in actual exploits.

A small percentage (1.3%) targeted enterprise VPN login pages, while in some cases, residential IPs were used for path traversal and credential stuffing.

Regarding the source of these residential proxies, GreyNoise states that China, India, and Brazil contribute significantly, with IP traffic following human sleep patterns, decreasing by a third at night when most people turn off their devices.

Researchers claim that residential proxy traffic comes from two separate and distinct sources: IoT botnets and compromised computers.

In the latter situation, the proxies originate from SDKs found in free VPNs, ad blockers, and similar apps, which enroll user devices in bandwidth-selling programs.

GreyNoise also underscored the robustness of these networks, citing the example of IPIDEA, one of the largest residential proxy networks worldwide, which was recently disrupted by Google Threat Intelligence Group (GTIG) and collaborators.

While the disruption reduced its proxy pool by around 40%, datacenter traffic subsequently increased, indicating that demand can be absorbed by other providers when necessary, and capacity is quickly restored.

GreyNoise suggests that the evasion tactics of residential proxies necessitate moving away from IP reputation as a primary indicator and instead focusing on behavior.

The researchers advise detecting sequential probing from rotating residential IPs, blocking clearly illegitimate protocols such as SMB from ISP space, and tracking device fingerprints that persist despite IP rotation.