Lumen Says Residential Proxy Botnets Near 60 Million Victim IPs
Summary
Lumen’s Black Lotus Labs says residential proxy botnets span nearly 60 million victim IPs worldwide. It reports that IPIDEA rebounded after a January disruption and now has about 10 million IPs.
Key points
- Black Lotus Labs estimates that residential proxy botnets involve nearly 60 million victim IP addresses worldwide; about one in four are in the United States.
- Lumen says the true number of infected devices is higher because its visibility is incomplete and multiple devices can share an IP.
- According to researchers, IPIDEA recovered to nearly half strength within hours of a January disruption and later grew to about 10 million IPs.
- Black Lotus Labs tracks more than 30 malicious proxy botnet clusters; most reportedly have over 100,000 daily victims.
- Researchers describe proxy services collaborating in a supply chain that can move millions of IPs within hours, making isolated takedowns short-lived.
- Lumen says aging devices that no longer receive security updates add to the pool that may be absorbed into botnets.
Article Details
- Event Type
- Report on the growth and resilience of residential proxy botnets
- Impact
- Lumen’s Black Lotus Labs reported nearly 60 million victim IP addresses in the observed proxy-botnet ecosystem, with roughly one in four compromised IPs in the United States. The networks help criminals conceal traffic, can rapidly recover after disruption, and may shift millions of IPs within hours, complicating efforts to disrupt them.