This Week's Proxy Exits: 10.6M New Addresses, Still Almost All Off Datacenter Space

Datacenter blocklists still look like the default proxy defence in a lot of fraud stacks. The addresses showing up in proxy supply this week were still mostly not in datacenters. The datacenter slice eased from the 3.6% in the last posted recap, though it remains above the flat ~2% band of mid-to-late October.

Between 4–10 November 2026 (UTC), the IP99 risk feed captured 10,561,845 proxy exit addresses it had not seen in the previous 7 days (+2% vs the previous 7 days). Source page: ip99.com/en/proxy-exits (generated 11 November 2026, 09:36 UTC). The public page rolls daily over the last 7 complete UTC days; this is the window it reports today, continuing the series after the 29 October–4 November recap (the two windows overlap on 4 November).

Against that last posted week (10,576,402 addresses), volume is essentially unchanged (−0.1%). The page's official +2% compares 4–10 November with 28 October–3 November, not with the overlapping posted window.

What those addresses sit on

About 63% were rated high-risk at the moment of capture. The rest still carried a proxy-class signal at a lower risk level.

IP99 counts an address as "captured" when it enters the feed with a proxy-class signal (proxy, VPN, dial-up pool, cloud phone, or hijacked shared proxy) and was not in the live 7-day risk mirror. Addresses that go quiet and return can be counted again. The page describes what 59 upstream collection sources delivered — not the total number of proxies in the world. An address is counted once per window. No address lists are published.

Why 3.2% still is not "mostly datacenter"

If your defence is mainly an ASN or hosting blocklist, you are still mostly looking past the problem. Residential broadband alone is 80.0% of this week's capture window. Mobile adds another 12.1%. Together that is over 92% of newly seen proxy exits sitting in access networks where real customers also live.

The datacenter row moved from 3.6% in the last posted recap (29 Oct–4 Nov) to 3.2% here, and from about 2.0% in the 26 Oct–1 Nov window a fortnight back. That is a real mix shift worth watching, but it does not flip the headline. A hosting-only blocklist still misses the majority of the supply-side traffic that shows up as residential or mobile exits.

Usage type answers "what kind of network is this," not "is this address currently sold as an exit." Rotating residential proxies and dial-up pools are designed to sit in DYN / MOB space. Detecting them needs supply-side observation with an age attached, not a permanent network-type label. Product notes: rotating residential proxies, detect proxy / VPN.

Which networks show up most

Top ASNs in this week's capture window (by distinct address count):

AS4134, AS4837, and AS9808 remain the three largest contributors, as they have in recent recaps. AS36903 enters the top five this window; AS55836, which held fifth place in the 29 Oct–4 Nov recap (2.2%), sits lower in this week's table (1.6%, seventh). Large access networks appearing here are a clue about where proxy supply is being sold from — not a claim that every customer on those networks is a proxy. Ban a whole ASN and you take out legitimate home and mobile users. Prefer per-address evidence at decision time. ASN pages for deeper network mix: ip99.com/en/asn/.

Day-to-day shape

Captured addresses (new to the prior 7-day mirror that day), with how many were high-risk at capture:

Volume rose slightly week-over-week (+2% after the immediately preceding ~10.3M days), while upstream sources sat at 59 (57 in the last posted recap). The firmer headline is about what those collectors delivered into the 7-day mirror, not a claim that proxy supply worldwide grew. Daily capture stayed in a band roughly 1.37–1.75M addresses, with 4 Nov the heavier day — still not a shape that makes a static list look "caught up."

How to use this without over-blocking

1. Branch on evidence, not network type. Residential is where your customers live; do not hard-block on DYN / MOB alone.
2. Step up, don't stop. A fresh proxy-class signal on signup, a coupon claim, or a login from a new device justifies a second factor or a delay — not an immediate ban of a whole building's shared egress.
3. Read the age. evidence_state: "stale" means the address was in supply before and is not now; treat it as a weak prior. Re-query at decision time rather than caching a verdict for days. Score 0 with evidence_state: "none" is not a clean bill of health either — it means no current verifiable evidence is on file.
4. Keep the timestamp. Store computed_at with the decision so a disputed block can be traced back to when the observation was made.

IP99 by ThreatHunter publishes the free weekly aggregate so you can see the mix without buying a feed. The score on a single lookup is the freshness and strength of verifiable risk evidence — not a probability that the address "is an attacker." Do not treat IP99 scores as identical to every other ThreatHunter dataset you may have seen elsewhere; this article only claims what the public proxy-exits page and free /v1/ip document.

Check one yourself

Free, no signup:

curl https://ip99.com/v1/ip/8.8.8.8

Look at evidence_state (active / stale / none), risk.score, and the proxy-class signals. Public DNS infrastructure often shows a hosting network attribute with score 0 and evidence_state: "none" — that is a network fact, not a proxy verdict. The same lookup is available to agents as an MCP tool at https://ip99.com/mcp (ip_risk_lookup). Field reference and routing notes live on the API docs.

Try it on ip99.com, keep an eye on this week's proxy exits, and wire the free OpenAPI at ip99.com/openapi.json if you want the same fields in Postman or codegen.