Residential proxies make a mockery of IP-based defenses

GreyNoise observed roughly 4 billion malicious sessions over 90 days and reports that attackers are weaponizing residential IP space — consumer broadband, mobile, and small-business connections — as short-lived residential proxies for large-scale scanning and reconnaissance. The research identifies two distinct supplier groups (long-running Windows SMB worms and Telnet-recruited IoT botnets), notes that IP rotation and brief appearance limit the effectiveness of IP-reputation defenses, finds residential proxies primarily used for reconnaissance (0.1% exploitation rate) including probes of enterprise VPNs, and documents how disruptions (e.g., the IPIDEA takedown) temporarily shifted activity toward datacenter infrastructure.