Residential proxies evaded IP reputation checks in 78% of 4B sessions

GreyNoise analyzed ~4 billion malicious sessions over three months and found that a large portion of attack traffic appears to come from residential IPs (proxy networks and infected consumer devices), with 78% of those sessions invisible to IP-reputation feeds. The report details the short-lived and rotating nature of these residential proxies, their primary use for scanning/reconnaissance rather than direct exploitation, major contributing countries, the role of IoT botnets and abused SDKs in free apps, the partial disruption of the IPIDEA network, and recommends moving from IP-reputation to behavior-based detection (tracking sequential probing, blocking illegitimate ISP-space protocols, and persistent device fingerprints).