Residential Proxy Traffic Appeared in 65% of Infoblox Customer Networks
Summary
Infoblox found residential-proxy-related DNS queries in over 65% of its cloud customers, rising about 25% from January 2025 to April 2026. It warns that unauthorized proxy use can expose organizations to abuse and added security workload.
Key points
- Infoblox observed residential-proxy-related DNS queries across more than 65% of its Threat Defense Cloud customers.
- Monthly queries to residential proxy domains increased about 25%, from nearly 400 billion in January 2025 to over 500 billion in April 2026.
- Residential proxies can make third-party abuse appear to originate from an organization’s IP space, creating investigation, legal, and reputational risks.
- Proxyware may be installed through apps, browser extensions, or IoT devices, sometimes without users’ knowledge; some services may also enable probing of internal networks.
- Infoblox saw a 265% one-day increase in customer networks querying an IPIDEA-related domain around January 23, 2026, but could not explain the anomaly.
- At least 40% of customers in every examined industry vertical had residential-proxy traffic; more than 60% of government and banking customers did.
- The article recommends reviewing DNS logs, applications, extensions, and IoT devices, and considering protective DNS controls to detect or block unauthorized proxy activity.
Article Details
- Publisher
- Infoblox Intel
- Report Period
- January 2025–April 2026
- Scope
- Residential proxy-related DNS queries and network telemetry across Infoblox cloud customer networks.
- Key Statistics
- More than 65% of Infoblox Threat Defense Cloud customers queried domains associated with residential proxy networks in 2026.
- Monthly queries to residential proxy domains grew from nearly 400 billion in January 2025 to over 500 billion in April 2026, an increase of approximately 25%.
- The number of customer networks querying ipinfo[.]ipidea[.]io increased by over 265% in one day around January 23, 2026; the report says the cause was unclear.
- Brightdata appeared in over 50% of cloud customers.
- At least 40% of customers in each industry vertical had residential proxy-related traffic; over 90% of pharmaceutical and food and beverage customers, and over 60% of government and banking customers, queried residential proxy indicators.
- Recommendations
- Risk-averse organizations should consider mechanisms, including Protective DNS, to detect and block unauthorized residential proxies.
- Review DNS query logs for queries to known residential proxy domains.
- Review installed applications, browser extensions, and IoT devices for residential proxy usage.
- Review Protective DNS response policies; risk-averse organizations should consider blocking bogon resolutions and suspicious or malicious domains.
- Check organizational IP addresses with Synthient or another organization that tracks residential proxies.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ipinfo[.]ipidea[.]io | IPIDEA-associated residential proxy domain queried by customer networks; the report observed a sharp increase in querying networks but said the cause was unexplained. |
People
Vendors
BrightdataBrightdata is by far the most frequently observed proxy service we see, appearing in over 50% of cloud customers.GrassGrass is a residential proxy that states that it “turns your unused internet into rewards automatically” and pays out the rewards in cryptocurrency, namely the $GRASS token.Hola VPNHola VPN is advertised as a free VPN, but it is in fact a residential proxy service offered in conjunction with an affiliated company, and the free browser extension provides the supply side of the proxy network.HoneygainHoneygain is a residential proxy that pays users to allow others to use their residential IP address as a proxy.InfobloxSurprisingly, we found that over 65% of Infoblox Threat Defense Cloud customers made queries to the domains used to access or orchestrate residential proxy networks in 2026.IPIDEADespite actions taken against one service, IPIDEA, in January 2026 and heightened awareness of the risks associated with these services, we have seen no reduction in their use.OxylabsBoth Brightdata and Oxylabs offer residential proxies for businesses, advertising that they can be used for web scraping to train AI.SynthientDuring the last several months, we have collaborated with Synthient to better understand residential proxies and identify how these services, and the malicious actors who sometimes promote them, impact global networks.
Products
CareBuzzHoneygain also runs CareBuzz, which is a similar product but claims to give the revenue to a charity of the user’s choosing.Infoblox Threat Defense CloudSurprisingly, we found that over 65% of Infoblox Threat Defense Cloud customers made queries to the domains used to access or orchestrate residential proxy networks in 2026.SuperboxesGrass was reportedly pre-installed on Superboxes, Android TV streaming devices, adding users to the network without their knowledge.
Industries
BankingPerhaps even more concerning is that over 60% of government and banking customers have as well.EducationThe appearance of education at the top seems unsurprising, because there could be many students on higher-education networks willingly trading access to their network for monetary compensation.ElectronicsAfter education, however, the results are more concerning from a security professional’s perspective: pharmaceutical, electronics, industrial, and healthcare all show strong residential proxy use.Food and BeverageGovernmentPerhaps even more concerning is that over 60% of government and banking customers have as well.HealthcareAfter education, however, the results are more concerning from a security professional’s perspective: pharmaceutical, electronics, industrial, and healthcare all show strong residential proxy use.IndustrialAfter education, however, the results are more concerning from a security professional’s perspective: pharmaceutical, electronics, industrial, and healthcare all show strong residential proxy use.pharmaceuticalOver 90% of our pharmaceutical and food & beverage customers have queried residential proxy indicators.