GreyNoise Finds Residential Proxies Evaded IP Reputation Checks in 78% of Sessions

Summary

GreyNoise analyzed 4 billion malicious sessions over three months and found that 78% of residential-originating sessions evaded reputation feeds. It recommends behavior-based detection, including sequential-probing detection and persistent device fingerprints.

Key points

About 39% of analyzed sessions appeared to originate from residential networks; 78% of those were invisible to reputation feeds.
Most residential IPs were used only once or twice, and 89.7% were active in malicious operations for under a month.
Residential proxy IPs came from 683 ISPs and were primarily used for scanning and reconnaissance; researchers attributed only 0.1% to exploits.
The article describes two proxy ecosystems: IoT botnets and infected computers enrolled through apps such as free VPNs and ad blockers.
Following a disruption of IPIDEA that reduced its proxy pool by about 40%, datacenter traffic increased, suggesting demand shifted to other sources.
GreyNoise recommends prioritizing behavior-based detection, including sequential-probing detection, blocking illegitimate protocols such as SMB from ISP space, and tracking device fingerprints across IP changes.

Article Details

Publisher: BleepingComputer
Report Period: Three-month analysis; specific dates not disclosed
Scope: GreyNoise analysis of malicious edge sessions and residential proxy activity
Sample Size: 4 billion malicious sessions
Key Statistics: About 39% of analyzed sessions appeared to originate from home networks.
78% of the residential-network sessions were invisible to reputation feeds.
89.7% of residential IPs were active in malicious operations for under a month; 8.7% lasted two months and 1.6% persisted for three months.
Only 0.1% of residential IPs were involved in actual exploits; 1.3% targeted enterprise VPN login pages.
The residential IPs participating in attacks belonged to 683 internet service providers.
Recommendations: Do not rely on IP reputation as the primary detection signal; prioritize behavior-based detection.
Detect sequential probing from rotating residential IPs.
Block clearly illegitimate protocols, such as SMB, when they originate from ISP space.
Track device fingerprints that persist across IP rotation.

MITRE ATT&CK

T1110.004 · Credential StuffingThe article reports limited credential-stuffing attempts involving residential IPs.T1595 · Active ScanningThe article reports network scanning and reconnaissance from residential proxy IPs.

Vendors

GreyNoiseGreyNoise’s analysis of 4 billion edge sessions found roughly 39% appearing to originate from home networks with 78% invisible to reputation feeds, and the company recommends shifting to behavior-based detection.

Countries

BrazilMost residential IPs are used for scanning and reconnaissance and come from diverse ISPs and countries like China, India, and Brazil.ChinaMost residential IPs are used for scanning and reconnaissance and come from diverse ISPs and countries like China, India, and Brazil.IndiaMost residential IPs are used for scanning and reconnaissance and come from diverse ISPs and countries like China, India, and Brazil.