This Week's Proxy Exits: 10.3M New Addresses, Still Almost All Off Datacenter Space

Datacenter blocklists are still the default proxy defence in a lot of fraud stacks. The addresses showing up in proxy supply this week mostly were not in datacenters.

Between 26 October – 1 November 2026 (UTC), the IP99 risk feed captured 10,256,050 proxy exit addresses it had not seen in the previous 7 days (−11% vs the prior week). Source page: ip99.com/en/proxy-exits (generated 2 Nov 2026 UTC).

What those addresses sit on

About 62% were rated high-risk at the moment of capture. The rest still carried a proxy-class signal at a lower risk level.

IP99 counts an address as "captured" when it enters the feed with a proxy-class signal (proxy, VPN, dial-up pool, cloud phone, or hijacked shared proxy) and was not in the live 7-day risk mirror. Addresses that go quiet and return can be counted again. The page describes what 67 upstream collection sources delivered — not the total number of proxies in the world. No address lists are published.

Why the 2% matters

If your defence is mainly an ASN or hosting blocklist, you are mostly looking at that 2.0% datacenter slice. Residential and mobile space is where home-broadband proxies and dial-up pools live. An address that keeps turning up in proxy supply is a proxy exit whatever its ISP label says.

That is the same reason a residential allowlist fails the other way: usage type answers "what kind of network is this," not "is this address currently sold as an exit." Rotating residential proxies and dial-up pools are designed to sit in DYN / MOB space. Detecting them needs supply-side observation with an age attached, not a permanent network-type label.

Which networks show up most

Top ASNs in this week's capture window (by distinct address count):

Large access networks appearing here are a clue about where proxy supply is being sold from — not a claim that every customer on those networks is a proxy. Ban a whole ASN and you take out legitimate home and mobile users. Prefer per-address evidence at decision time.

Day-to-day shape

Captured addresses (new to the prior 7-day mirror that day), with how many were high-risk at capture:

Volume eased week-over-week (−11% after the prior week's 10.5M window), while upstream sources sat at 67. The softer headline is about what those collectors delivered into the 7-day mirror, not a claim that proxy supply worldwide shrank. The mix held: residential near 80%, datacenter still about 2%. Daily capture stayed in a band roughly 1.37–1.53M addresses — no single spike day that would make a static list look "caught up."

How to use this without over-blocking

1. Branch on evidence, not network type. Residential is where your customers live; do not hard-block on DYN / MOB alone.
2. Step up, don't stop. A fresh proxy-class signal on signup, a coupon claim, or a login from a new device justifies a second factor or a delay — not an immediate ban.
3. Read the age. evidence_state: "stale" means the address was in supply before and is not now; treat it as a weak prior. Re-query at decision time rather than caching a verdict for days.
4. Keep the timestamp. Store computed_at with the decision so a disputed block can be traced back to when the observation was made.

Check one yourself

Free, no signup:

curl https://ip99.com/v1/ip/8.8.8.8

Look at evidence_state (active / stale / none), risk.score, and the proxy-class signals. A score of 0 is not "safe" — it means IP99 holds no current verifiable evidence against that address. The score is the freshness and strength of that evidence, not a probability that the address "is an attacker."

The same lookup is available to agents as an MCP tool at https://ip99.com/mcp (ip_risk_lookup). Field reference and routing notes live on the API docs.