A residential proxy routes someone's internet traffic through a home internet connection, so it looks like it comes from an ordinary household instead of from the person really sending it. The FBI calls residential proxies "a standard tool criminals use to look like ordinary users online". This guide explains where the addresses come from, how attackers use them, and how to detect and block them, with 31 days of data from Whatoblock Heartbeat and our honeypot sensors, 7 October to 6 November 2026.
The short version
- What it is: a home, mobile or small business IP address that someone else rents to route their traffic through.
- Where the addresses come from: apps and SDKs that share bandwidth, free VPNs, infected routers and TV boxes, and malware. Some owners agree to it, many do not know.
- How big it is: Whatoblock Heartbeat tracked 4.200.534 residential proxy addresses in 31 days, in 25.061 networks and 235 countries.
- Why it matters: 109.042 of the addresses that attacked our sensors in the same 31 days (11%) were on that list.
- What to do: block known residential proxy addresses on services real customers never reach from home connections, such as SSH, RDP, VPN gateways and admin panels. On websites, score or challenge them instead of blocking outright.
What is a residential proxy?
A proxy is a server that forwards your traffic, so the website you visit sees the proxy's address instead of yours. A residential proxy does the same through an address that an internet service provider assigned to a home customer: a phone, a router, a smart TV or a PC.
The FBI defines it this way in its March 2026 alert: "A residential proxy is an intermediary server between individuals and websites they visit to make their connections appear to originate elsewhere." Buyers can usually pick the country, and often the city, their traffic should appear to come from.
That is the whole point. Traffic from a home connection in the same city as the victim looks like a real customer. Firewalls, fraud systems and rate limits that trust home addresses let it through.
Where residential proxy addresses come from
The FBI lists five ways a device ends up in a residential proxy network:
- SDK partnerships. Proxy services pay app developers to include their software kit, which then routes proxy traffic through the users' devices.
- Free VPNs with hidden terms. Some free VPN apps enroll users' devices in a proxy network, with the details buried in the terms of service.
- Compromised IoT devices. Cheap TV boxes and similar devices can come with proxy malware already installed, or get it when they download apps.
- Malware. Pirated games, films and software can carry malware that turns the computer into a proxy.
- Passive income apps. Apps that pay people for their spare bandwidth. Many users do not realise criminals use that bandwidth.
The FBI notes that addresses are obtained in two ways: "The owner of the device provides consent, or the owner of the device does not provide consent and is unaware their IP address is being used." Google's threat intelligence team went further after investigating one large network: claims of ethical sourcing "are often incorrect or overstated".
The largest known case shows the scale. The 911 S5 network, dismantled by the US Justice Department in May 2024, allegedly spread its malware through free VPN programs and pirated software and was associated with more than 19 million unique IP addresses, 613.841 of them in the United States.
Residential, datacenter, ISP and mobile proxies compared
| Type | Where the address lives | How hard to block |
|---|---|---|
| Residential | Home broadband and small business connections | Hard: spread over thousands of networks and shared with real users |
| Mobile | Phone networks | Hardest: many users share one address behind carrier grade NAT |
| ISP or static residential | Addresses registered to an internet provider but hosted in a data centre | Medium: few networks, but they look residential |
| Datacenter | Cloud and hosting servers | Easier: a few hosting networks hold most of them |
Our data shows the difference clearly. The 10 largest networks hold 14% of all residential proxy addresses we tracked, against 65% for datacenter proxies:
Share of all listed addresses held by the 10 largest networks in each category.
The two categories also overlap: 9.384 addresses appeared as both datacenter and residential proxies in the same 31 days, 6.054 of them in a single network. That is the grey zone often sold as ISP or static residential proxies. Our datacenter proxy guide covers the other side.
What 31 days of residential proxy data shows
Whatoblock Heartbeat tracked 4.200.534 residential proxy addresses in 31 days, spread over 25.061 networks in 235 countries.
Residential proxy addresses by country.
- Brazil leads by far with 816.269 addresses, 19% of the 4.200.534. India (217.772), the United States (169.793) and Russia (143.015) follow.
- No network dominates. The largest single network, the national telecom of Uruguay, holds 71.026 addresses. It takes the 100 largest networks to reach 48% of the list.
- Satellite internet appears too. SpaceX's Starlink network in Brazil carried 40.891 residential proxy addresses, more than most national telecoms.
The live residential proxy ranking shows the networks carrying the most proxy addresses right now.
One in nine attackers was a residential proxy address
We compared the list with every address that attacked our honeypot sensors in the same 31 days:
Residential proxy addresses among the addresses that attacked our sensors.
- 109.042 of 997.591 attacking addresses (11%) were residential proxy addresses.
- They were quiet. Together they sent 14.525.322 of 2.366.144.915 attack events, under 1%. That is 133 events per address, against 2.372 for the average attacker. Few requests from many addresses is exactly how residential proxies slip under rate limits.
- The strict test. Home addresses change hands, so some of those 109.042 may be a different household on the same address. Counting only addresses that were listed and attacked on the same day still leaves 9.573.
What they attacked
Residential proxy addresses that attacked our sensors, by service.
The most common activity was spreading malware: 40.773 of the 109.042 addresses (37%) tried to infect our sensors with botnet malware. The rest probed Docker (16.831), Telnet (12.552), HashiCorp Vault (8.380), IPFS, web servers and Windows file sharing.
Infected and rented at the same time
Residential proxy networks and botnets overlap. In the same 31 days, 2.310 of the 33.125 bots that delivered malware to our sensors (7%) were residential proxy addresses, and so were 1.587 of the 11.200 C2 server addresses (14%). An infected router or TV box can spread malware and carry someone else's proxy traffic at the same time.
How attackers use residential proxies
The FBI's 2026 alert lists the main uses:
- Account takeover. With leaked bank credentials, "criminals could obtain a residential proxy IP address in the same city as the victim and login to the compromised bank account", so the bank is less likely to flag it.
- Brute force and credential stuffing. Rotating through many addresses bypasses rate limits and lockouts. Microsoft saw one covert network of about 8.000 compromised routers make only one login attempt per account per day in about 80% of cases.
- Fraud at scale. The 911 S5 network was linked to 560.000 fraudulent unemployment insurance claims, with confirmed fraudulent losses of more than 5.900 million USD.
- Fake accounts, spam and phishing, hosted or sent from addresses that look like ordinary users.
- Scalping. Buying concert tickets, sneakers and collectibles past per customer limits.
- Espionage. Google observed "over 550 individual threat groups", including groups from China, North Korea, Iran and Russia, using one network's exit nodes in a single week of January 2026.
Why IP reputation struggles with residential proxies
- Real users share the addresses. Cloudflare found that "4 out of 5 requests" from residential proxy networks were "direct and benign connections from residential devices". On mobile networks, many users share one address.
- The addresses rotate. One study saw a scraping bot blocked on 9.099 requests that came from 9.021 different addresses, almost one new address per request.
- Lists age fast. A 2026 joint advisory led by the UK National Cyber Security Centre warns that "static malicious IP block lists will be less effective" against networks of compromised home devices, and recommends dynamic feeds instead.
- They are spread thin. In our data, 25.061 networks carried residential proxy addresses. Blocking a few networks barely dents the list.
How to detect residential proxy traffic
No single signal is enough. Combine:
- A fresh residential proxy list. It tells you an address was recently rented out as a proxy. Freshness matters more than size.
- Behaviour on your side. Many accounts from one address, many addresses for one account, logins at impossible speeds, or traffic that never loads a page like a browser would.
- Mismatches. A browser time zone or language that does not match the address location, or a device fingerprint that does not fit a home user.
- Identity risk signals. Sign in protection in identity platforms flags unusual locations and address patterns, which residential proxies often trigger.
Should you block residential proxies?
It depends on the service:
- Block on services real customers do not reach from a home connection: SSH, RDP, VPN gateways, admin panels, databases and anything that should only be reached from known networks. The FBI tells businesses to "Block IP addresses that are known to be associated with residential proxy networks."
- Challenge or score on websites, logins and checkouts, where a real customer may share an address with a proxy. Ask for MFA, a CAPTCHA or extra checks instead of a hard block.
- Allow list where you can. For corporate VPNs, the 2026 joint advisory suggests "IP address allow lists rather than deny lists".
How to block residential proxies on your firewall
Whatoblock's Residential Proxies category is part of every paid blocklist plan, rebuilt every hour from the last 31 days. On 7 November it held 4.228.339 addresses, or 889.973 entries with /24 aggregation.
That is large. Many firewalls cap the number of entries per list, so check the limit first (our FortiGate threat feed guide lists them by version). If the full list does not fit, use /24 aggregation, apply it only to the exposed services above, or load it into a WAF or identity platform that handles large lists. Setup steps for each firewall are on the integrations page, and plans are on the pricing page.
Is your network a residential proxy exit?
If your own address shows up on a residential proxy list, a device on your network may be renting out your connection. Check for:
- Cheap or unbranded TV boxes and streaming sticks, especially ones that ask you to disable Google Play Protect.
- End of life routers that no longer get updates. Replace them, change default passwords and turn off remote administration.
- Bandwidth sharing apps and free VPNs on phones and PCs.
- Outbound proxy traffic. In a business, block outbound proxy ports and keep IoT devices on a separate network segment.
Recent takedowns
| When | What happened |
|---|---|
| May 2024 | The US Justice Department dismantled 911 S5 and arrested its alleged administrator. More than 19 million addresses, about 99 million USD in alleged revenue. |
| May 2025 | US authorities charged four people over Anyproxy and 5socks, which allegedly rented out infected older routers for over 20 years and earned more than 46 million USD. |
| June and July 2025 | The FBI warned about BADBOX 2.0, a botnet of infected TV boxes with backdoors to proxy services. Google sued its operators. |
| January 2026 | Google disrupted the IPIDEA network and cut its device pool "by millions". |
| March 2026 | US and European authorities took down SocksEscort, which allegedly offered about 369.000 addresses since 2020 from infected routers. |
| July 2026 | Google, with the FBI and Lumen, acted against NetNut, which it estimates at "at least 2 million devices". NetNut's parent company Alarum said it would fully cooperate with law enforcement and was investigating whether its services were misused. |
Takedowns help, but not for long. Google observed that operators hit by a takedown "begin buying capacity from their competitors", and Lumen reported that IPIDEA rebuilt to close to ten million daily addresses after its disruption.
Frequently asked questions
What is a residential proxy?
An internet connection of a home, phone or small business that someone else uses to route their traffic, so it appears to come from that household instead of from the real sender.
Are residential proxies legal?
Proxies are a legal tool in many countries, and some providers recruit devices with the owner's consent. Networks built from infected devices are not: US and European authorities have taken down several, including 911 S5, Anyproxy, 5socks and SocksEscort.
How do residential proxy networks get their IP addresses?
Through apps and SDKs that share bandwidth, free VPNs, bandwidth selling apps, infected TV boxes and routers, and malware hidden in pirated software. The FBI lists all five routes.
Can residential proxies be detected?
Yes, but not from the address alone. Combine a fresh residential proxy list with behaviour on your service, location mismatches and identity risk signals.
Should I block residential proxy IPs?
Block them on services home users never need, such as SSH, RDP, VPN gateways and admin panels. On websites, challenge or score them, because real customers can share the same addresses.
How can I tell if my IP is being used as a residential proxy?
Look for unknown apps, bandwidth sharing software, cheap TV boxes and outdated routers on your network, and watch for outbound proxy traffic you did not set up.
What is the difference between a residential proxy and a VPN?
A VPN sends your traffic through the provider's own servers, usually in data centres, with your knowledge. A residential proxy sends it through someone else's home connection, often without that person knowing.
About this data
- Period: 7 October to 6 November 2026, UTC, the same 31 day window the blocklist uses.
- Residential proxy addresses: tracked by Whatoblock Heartbeat. Daily counts change with collection, so we report totals only.
- Attacks: every address that sent traffic to our honeypot sensors in the same period. "Same day" means listed and attacking on the same UTC day.
- Botnets: bots and C2 servers identified by IP address.
- Outside sources are quoted as published and linked below. Allegations in court cases are allegations until proven.
Sources
- FBI, Evading Residential Proxy Networks, PSA, 12 March 2026
- US Justice Department, 911 S5 botnet dismantled, 29 May 2024
- US Justice Department, Anyproxy and 5socks, 9 May 2025
- FBI, BADBOX 2.0 PSA, 5 June 2025 and Google, legal action against BADBOX 2.0, 17 July 2025
- Google Threat Intelligence, disrupting IPIDEA, 28 January 2026
- US Justice Department, SocksEscort, 12 March 2026 and Europol, Operation Lightning
- Google Threat Intelligence, NetNut, 2 July 2026 and Alarum statement filed with the SEC
- CISA and partners, AA26-113A, covert networks of compromised devices, 23 April 2026
- Cloudflare, residential proxy bot detection, 24 June 2024
- Microsoft, Storm-0940 and CovertNetwork-1658, 31 October 2024
- Lumen Black Lotus Labs, the modern proxy ecosystem, 24 July 2026
- Khan et al., user installed residential proxies, CNSM 2024
Check the live data
Open Scanner Recon with the last 24 hours selected.