The Invisible Army: Residential Proxy Abuse in Internet-Scale Attack Traffic

Summary: GreyNoise analyzed 4 billion sessions over 90 days and found that 39% of unique IPs targeting the edge come from home internet connections, with 78% vanishing before any reputation system can flag them. Attackers route malicious traffic through ordinary home broadband, mobile data, and small-business connections, making the source IP indistinguishable from a legitimate user's connection on the same ISPs and address ranges.
What you should know: Nearly four in five of these residential IPs disappear before a reputation feed can catalog them, so the blocklist your edge relies on is structurally blind to the majority of this traffic. The addresses in question are the same ranges your employees, customers, and partners connect from, which leaves little room to block without collateral damage.

Read the original at GreyNoise Blog ↗