The Invisible Army: Why IP Reputation Fails Against the Rotation Economy

Summary: GreyNoise observed 4 billion sessions targeting the edge over 90 days and found 39% of unique IPs came from home internet connections, nearly double their 22% share of sessions. Each residential IP averaged fewer than 3 sessions before disappearing, with 78% seen at most twice across the Global Observation Grid, and 0.1% of residential sessions carried exploitation payloads versus 1.0% from hosting infrastructure.
Why it matters: By the time a reputation feed flags a residential IP, the median address has already made its single appearance and rotated, so feed-based detection cannot keep pace with an adversary pool that includes networks like IPIDEA's 9 to 11 million daily active proxies used by over 550 threat groups.

Read the original at GreyNoise Blog ↗