New Report from Grey Noise Intelligence Points to a Significant Number of Compromised Residential IP Addresses
Summary: GreyNoise Intelligence published a report, "The Invisible Army: Residential Proxy Abuse in Internet-Scale Attack Traffic," based on 4 billion malicious sessions from 5,720,000 unique source IPs observed over 90 days, from November 29, 2025 to February 27, 2026. The company reports that nearly 4 in 10 IPs hitting its sensors are residential IPs, and cites the January 2026 disruption of the IPIDEA residential proxy network, which had 9 to 11 million daily active proxies used by over 550 threat groups, along with the May 2024 takedown of 911 S5 and its 19 million IPs across 190 countries.
Why it matters: Nearly 4 in 10 IPs reaching GreyNoise's sensors are home connections, so any control that treats an IP address as a signal of intent is now wrong at scale, and the proxy networks behind that traffic have drawn state-sponsored actors from China, DPRK, Iran, and Russia.
Read the original at GreyNoise Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026