This Week's Proxy Exits: 10.9M New Addresses, Still Almost All Off Datacenter Space

Datacenter blocklists are still the default proxy defence in a lot of fraud stacks. The addresses showing up in proxy supply this week mostly were not in datacenters.

Between 23–29 October 2026 (UTC), the IP99 risk feed captured 10,930,592 proxy exit addresses it had not seen in the previous 7 days (−4% vs the prior week). Source page: ip99.com/en/proxy-exits (generated 30 Oct 2026 UTC).

What those addresses sit on

About 62% were rated high-risk at the moment of capture. The rest still carried a proxy-class signal at a lower risk level.

IP99 counts an address as "captured" when it enters the feed with a proxy-class signal (proxy, VPN, dial-up pool, cloud phone, or hijacked shared proxy) and was not in the live 7-day risk mirror. Addresses that go quiet and return can be counted again. The page describes what 68 upstream collection sources delivered — not the total number of proxies in the world. No address lists are published.

Why the 2% matters

If your defence is mainly an ASN or hosting blocklist, you are mostly looking at that 2.2% datacenter slice. Residential and mobile space is where home-broadband proxies and dial-up pools live. An address that keeps turning up in proxy supply is a proxy exit whatever its ISP label says.

That is the same reason a residential allowlist fails the other way: usage type answers "what kind of network is this," not "is this address currently sold as an exit." Rotating residential proxies and dial-up pools are designed to sit in DYN / MOB space. Detecting them needs supply-side observation with an age attached, not a permanent network-type label.

Which networks show up most

Top ASNs in this week's capture window (by distinct address count):

Large access networks appearing here are a clue about where proxy supply is being sold from — not a claim that every customer on those networks is a proxy. Ban a whole ASN and you take out legitimate home and mobile users. Prefer per-address evidence at decision time.

Day-to-day shape

Captured addresses (new to the prior 7-day mirror that day), with how many were high-risk at capture:

Volume eased week-over-week (−4% after last week's rebound to 11.5M), while upstream sources rose from 54 to 68. More sources did not mean a bigger headline total — the soft dip is about what those collectors delivered into the 7-day mirror, not a claim that proxy supply worldwide shrank. The mix held: residential near 80%, datacenter still about 2%. Daily capture drifted gently lower through the window, staying in a band roughly 1.4–1.8M addresses — no single spike day that would make a static list look "caught up."

How to use this without over-blocking

1. Branch on evidence, not network type. Residential is where your customers live; do not hard-block on DYN / MOB alone.
2. Step up, don't stop. A fresh proxy-class signal on signup, a coupon claim, or a login from a new device justifies a second factor or a delay — not an immediate ban.
3. Read the age. evidence_state: "stale" means the address was in supply before and is not now; treat it as a weak prior. Re-query at decision time rather than caching a verdict for days.
4. Keep the timestamp. Store computed_at with the decision so a disputed block can be traced back to when the observation was made.

Check one yourself

Free, no signup:

curl https://ip99.com/v1/ip/8.8.8.8

Look at evidence_state (active / stale / none), risk.score, and the proxy-class signals. A score of 0 is not "safe" — it means IP99 holds no current verifiable evidence against that address. The score is the freshness and strength of that evidence, not a probability that the address "is an attacker."

The same lookup is available to agents as an MCP tool at https://ip99.com/mcp (ip_risk_lookup). Field reference and routing notes live on the API docs.